TY - GEN

T1 - Incrementally Verifiable Computation via Rate-1 Batch Arguments

AU - Paneth, Omer

AU - Pass, Rafael

N1 - Publisher Copyright:
© 2022 IEEE.

PY - 2022

Y1 - 2022

N2 - Non-interactive delegation schemes enable producing succinct proofs (that can be efficiently verified) that a machine M transitions from c1 to c2 in a certain number of deterministic steps. We here consider the problem of efficiently merging such proofs: given a proof ?1 that M transitions from c1 to c2, and a proof ?2 that M transitions from c2 to c3, can these proofs be efficiently merged into a single short proof (of roughly the same size as the original proofs) that M transitions from c1 to c3? To date, the only known constructions of such a mergeable delegation scheme rely on strong non-falsifiable 'knowledge extraction' assumptions. In this work, we present a provably secure construction based on the standard LWE assumption. As an application of mergeable delegation, we obtain a construction of incrementally verifiable computation (IVC) (with polylogarithmic length proofs) for any (unbounded) polynomial number of steps based on LWE; as far as we know, this is the first such construction based on any falsifiable (as opposed to knowledge-extraction) assumption. The central building block that we rely on, and construct based on LWE, is a rate-l batch argument (BARG): this is a non-interactive argument for NP that enables proving k NP statements x1, ... , xk with communication/verifier complexity m + o(m), where m is the length of one witness. rate-1 BARGs are particularly useful as they can be recursively composed a super-constant number of times.

AB - Non-interactive delegation schemes enable producing succinct proofs (that can be efficiently verified) that a machine M transitions from c1 to c2 in a certain number of deterministic steps. We here consider the problem of efficiently merging such proofs: given a proof ?1 that M transitions from c1 to c2, and a proof ?2 that M transitions from c2 to c3, can these proofs be efficiently merged into a single short proof (of roughly the same size as the original proofs) that M transitions from c1 to c3? To date, the only known constructions of such a mergeable delegation scheme rely on strong non-falsifiable 'knowledge extraction' assumptions. In this work, we present a provably secure construction based on the standard LWE assumption. As an application of mergeable delegation, we obtain a construction of incrementally verifiable computation (IVC) (with polylogarithmic length proofs) for any (unbounded) polynomial number of steps based on LWE; as far as we know, this is the first such construction based on any falsifiable (as opposed to knowledge-extraction) assumption. The central building block that we rely on, and construct based on LWE, is a rate-l batch argument (BARG): this is a non-interactive argument for NP that enables proving k NP statements x1, ... , xk with communication/verifier complexity m + o(m), where m is the length of one witness. rate-1 BARGs are particularly useful as they can be recursively composed a super-constant number of times.

UR - http://www.scopus.com/inward/record.url?scp=85146316744&partnerID=8YFLogxK

U2 - 10.1109/FOCS54457.2022.00102

DO - 10.1109/FOCS54457.2022.00102

M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???

AN - SCOPUS:85146316744

T3 - Proceedings - Annual IEEE Symposium on Foundations of Computer Science, FOCS

SP - 1045

EP - 1056

BT - Proceedings - 2022 IEEE 63rd Annual Symposium on Foundations of Computer Science, FOCS 2022

PB - IEEE Computer Society

T2 - 63rd IEEE Annual Symposium on Foundations of Computer Science, FOCS 2022

Y2 - 31 October 2022 through 3 November 2022

ER -