How to delegate computations publicly

Yael Tauman Kalai, Omer Paneth, Lisa Yang

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review


We construct a delegation scheme for all polynomial time computations. Our scheme is publicly verifiable and completely non-interactive in the common reference string (CRS) model. Our scheme is based on an efficiently falsifiable decisional assumption on groups with bilinear maps. Prior to this work, publicly verifiable non-interactive delegation schemes were only known under knowledge assumptions (or in the Random Oracle model) or under non-standard assumptions related to obfuscation or multilinear maps. We obtain our result in two steps. First, we construct a scheme with a long CRS (polynomial in the running time of the computation) by following the blueprint of Paneth and Rothblum (TCC 2017). Then we bootstrap this scheme to obtain a short CRS. Our bootstrapping theorem exploits the fact that our scheme can securely delegate certain non-deterministic computations.

Original languageEnglish
Title of host publicationSTOC 2019 - Proceedings of the 51st Annual ACM SIGACT Symposium on Theory of Computing
EditorsMoses Charikar, Edith Cohen
PublisherAssociation for Computing Machinery
Number of pages10
ISBN (Electronic)9781450367059
StatePublished - 23 Jun 2019
Externally publishedYes
Event51st Annual ACM SIGACT Symposium on Theory of Computing, STOC 2019 - Phoenix, United States
Duration: 23 Jun 201926 Jun 2019

Publication series

NameProceedings of the Annual ACM Symposium on Theory of Computing
ISSN (Print)0737-8017


Conference51st Annual ACM SIGACT Symposium on Theory of Computing, STOC 2019
Country/TerritoryUnited States


FundersFunder number
National Science FoundationCNS-1413964, CNS-1350619, CNS-1414119
Army Research OfficeW911NF-15-C-0236, W911NF-15-C-0226
Defense Advanced Research Projects Agency
Microsoft Research


    • Bootstrapping
    • Delegation
    • Publicly verifiable


    Dive into the research topics of 'How to delegate computations publicly'. Together they form a unique fingerprint.

    Cite this