AI generates interpretation videos

AI extracts and analyses the key points of the paper to generate videos automatically Go Generating

AI Traceability

AI parses the academic lineage of this thesis Generate MRT

AI Insight

AI extracts a summary of this paper

Weibo:
Our work provides a brand new form of arithmetization which we call Quadratic Span Programs, since it is a generalization of the notion of Span Programs proposed by Karchmer and Wigderson

Quadratic Span Programs and Succinct NIZKs without PCPs.

ADVANCES IN CRYPTOLOGY - EUROCRYPT 2013, (2013): 626-645

Cited by: 568|Views167
EI
Full Text
Bibtex
Weibo

Abstract

We introduce a new characterization of the NP complexity class, called Quadratic Span Programs (QSPs), which is a natural extension of span programs defined by Karchmer and Wigderson. Our main motivation is the quick construction of succinct, easily verified arguments for NP statements. To achieve this goal, QSPs use a new approach to the...More

Code:

Data:

Introduction
• Arithmetization of Boolean computations is a well known technique: it maps a Boolean circuit to a set of polynomial equations over a field.
• To compensate for the weakness of the wire checker, the authors require the SP being checked to be conscientious, which guarantees that every satisfying linear combination uses at least one polynomial from the sets associated with its input.
• To obtain a conscientious SP for an entire circuit, the authors build a conscientious SP for each gate, using a distinct set of roots Ri for each SP, and compose the gate SPs together using the Chinese Remainder Theorem, just as the authors did when building the aggregate wire checker.
Highlights
• Arithmetization of Boolean computations is a well known technique: it maps a Boolean circuit to a set of polynomial equations over a field
• The celebrated result IP=PSPACE [35, 41] used arithmetization as a crucial tool and set the stage for the probabilistically checkable proofs theorem [2,3,4, 20], which provided a new characterization of NP that revolutionized the notion of “proof” – in particular, it shows that NP statements have probabilistically checkable proofs (PCPs) that can be verified in time polylogarithmic in the size of a classical proof
• Our work provides a brand new form of arithmetization which we call Quadratic Span Programs (QSPs), since it is a generalization of the notion of Span Programs proposed by Karchmer and Wigderson 
• If the q-power Diffie-Hellman and d-PKE assumptions hold for some q ≥ max{2d− 1, d + 2}, the non-interactive zero-knowledge scheme defined in Section 3.3, instantiated with a Quadratic Span Programs of degree d, is secure under Definition 6
• The full details of the Quadratic Arithmetic Programs construction appear in the final version ; here we present the definition of Quadratic Arithmetic Programs and our main result about them
• We developed a system called Pinocchio  that includes a compiler that transforms a subset of C into either a Quadratic Span Programs or Quadratic Arithmetic Programs, and a set of programs for generating the common reference string, creating proofs, and verifying proofs
Results
• For each gate g ∈ Γ , there is a conscientious SP of size m and degree d that computes whether its input is a satisfying assignment of g’s input/output wires.
• The wire checker’s guarantee of no double assignments relies on the fact that the SP for the gate checker is conscientious, and must use at least one polynomial for each wire to arrive at a satisfying linear combination.
• The authors construct the polynomials for the aggregate wire checker described above, using a third set of distinct roots.
• 4. Using disjoint sets of roots R = {R(i0), R(i1) : i ∈ [N ]} and the partition of Ilabeled, construct the aggregate wire checker from Lemma 3, which consists of the following polynomials: D (x) = r∈R(x − r), V = {v1(x), .
• For any Boolean circuit C with n inputs, s gates, and N = n + s total wire values, the canonical QSP computes C.
• This property helps improve the performance of the cryptographic constructions for NIZKs and verifiable computation, since a verifier who knows part of the circuit input will be able to “predict” the portion of the QSP linear combination that corresponds to u.
• When it is applied to the partition Ilabeled = ∪i∈[N],j∈{0,1}Iij of the SP for the gate checker function, the size of the aggregate wire checker is |Ilabeled| ≤ 24s and the degree is 76s.
Conclusion
• At a high-level, the prover uses his inputs to evaluate the circuit for f , obtaining linear combinations for the QSP that satisfy Eq.1.
• If the q-PDH and d-PKE assumptions hold for some q ≥ max{2d− 1, d + 2}, the NIZK scheme defined in Section 3.3, instantiated with a QSP of degree d, is secure under Definition 6.
• The authors construct Quadratic Arithmetic Programs (QAPs), a natural extension of QSPs which “naturally” compute arithmetic circuits modulo the group order p.
Funding
• The research of this author was sponsored by the U.S Army Research Laboratory and the U.K
• Supported by NSF Grant No.1017660
Reference
Author     