Delegation with Updatable Unambiguous Proofs and PPAD-Hardness - - PowerPoint PPT Presentation

Delegation with Updatable Unambiguous Proofs and PPAD-Hardness

Lisa Yang MIT

Based on joint work with Yael Tauman Kalai and Omer Paneth

Delegation

𝑁(𝑦) = y Proof Π Can verifying be faster than computing? time 𝑈 computation 𝑁 𝑦 = ? 𝑊 checks Π in time ≪ 𝑈

Publicly Verifiable Delegation

𝑁(𝑦) = y Proof Π

𝐷𝑆𝑇

Prior Work: Publicly Verifiable Delegation

Strong assumptions

• Random Oracle Model

[Micali94]

• Knowledge assumptions
• Indistinguishability Obfuscation
• Multilinear maps

[Paneth-Rothblum17]

Delegation for bounded-depth circuits via Fiat-Shamir

• Optimal security of LWE

[Canetti-Chen-Holmgren-Lombardi-Rothblum-Rothblum-Wichs19]

• Sub-exponential LWE

[Kalai-Zhang20]

Delegation for polynomial-time computations

• Bilinear groups

[Kalai-Paneth-Y19] [Groth10, Lipma12, Gennaro-Gentry-Parno-Raykova12, Bitansky- Canetti-Chiesa-Tromer12, Bitansky-Chiesa-Ishai-Ostrovsky-Paneth13…] [Bitansky-Sanjam-Lin-Pass-Telang14,Canetti-Holmgren-Jain- Vaikuntanathan14,Koppula-Lewko-Waters14, Canetti- Holmgren16, Chen-Chow-Chung-Lai16]

𝐷𝑈 … 𝐷𝑀𝑗+1 𝐷𝑀𝑗 𝐷0

Updatable Proofs [Valiant08]

Consider a long computation 𝐷0 → 𝐷𝑈 carried

• ut over 𝐶 iterations

Updatable Proofs: update Π𝑗 into Π𝑗+1 Want the proof update to take time ~ computation performed Want proofs to remain succinct

[Bitansky-Canetti-Chiesa-Tromer13] using SNARKs

(based on strong assumptions)

Π𝑗 Π𝑗+1

Unambiguous Proofs

𝑁(𝑦) = y Proofs Π ≠ Π′

𝐷𝑆𝑇 Unambiguous Proofs: 𝑄∗(𝐷𝑆𝑇) cannot output Π ≠ Π′ for the same statement 𝑁 𝑦 = 𝑧 (except with negligible probability over 𝐷𝑆𝑇)

[Reingold-Rothblum-Rothblum]

Our Results: Delegation

Delegation with updatable and unambiguous proofs based on the decisional bilinear group assumption:

For a bilinear group 𝐻 of order 𝑞 = 2Θ(𝜆) and 𝛽 = 𝑃(log 𝜆) given for random 𝑕 ∈ 𝐻 and 𝑡 ∈ ℤ𝑞 it is hard to distinguish whether 𝑢 = 𝑡2𝛽+1 or 𝑢 is an independent random element in ℤ𝑞.

[Kalai-Paneth-Y19]

Our Results: PPAD-Hardness

PPAD-Hardness based on:

• 1. The quasi-polynomial hardness of KPY’s bilinear group assumption
• 2. Any hard language 𝑀 decidable in super-polynomial time (and

polynomial space)

• For example, the hardness of SAT for sub-exponential size circuits

(non-uniform ETH) suffices

[Choudhuri-Hubacek-Kamath-Pietrzak-Rosen-Rothblum19]

Related Work: PPAD-Hardness

Strong assumptions

• Indistinguishability Obfuscation
• Functional Encryption assumptions [Garg-Pandey-Srinivasan16, Komargodski-Segev17]

Fiat-Shamir interactive protocol for a particular language

• Security of Fiat-Shamir/Optimal security of LWE
• Sub-exponential LWE

Polynomial Local Search (PLS) Hardness

[Abbot-Kane-Valiant04, Bitanski-Paneth-Rosen15, Hubacek-Yogev17] [Choudhuri-Hubacek-Kamath-Pietrzak-Rosen- Rothblum19, Ephraim-Freitag-Komargodski-Pass19] [Lombardi-Vaikuntanathan20, Kalai-Zhang20, Jawale-Khurana20] [Bitansky-Gerichter20]

• 1. Delegation with Updatable Proofs
• Use recursive proof composition
• Without strong assumptions!

Local extraction [Kalai-Paneth-Y19]

𝐷𝑀𝐶 … 𝐷𝑀2 𝐷𝑀1 𝐷0 𝐷𝑀𝐶 Verify Π𝐶 … 𝐷𝑀2 Verify Π2 𝐷𝑀1 Verify Π1 𝐷0 Π′ Π1 Π𝐶 Π2 … 𝑁𝑓𝑠𝑕𝑓 𝐷𝑀𝑗−1, Π𝑗, 𝐷𝑀𝑗 𝑗∈[𝐶] replaces this with 𝐷0, Π′, 𝐷𝑀𝐶

• 1. Delegation with Updatable Proofs

Π contains 𝐶 proofs Π𝑗:𝐷𝑀𝑗−1 → 𝐷𝑀𝑗

Π′ ≪ Π1 + ⋯+ |Π𝐶|

nondeterministic Π: 𝐷0 → 𝐷𝑀 Update Π: Append proof for computation performed Proof grows!! Local extraction suffices!

Π = ?

𝑟1 𝑏1 𝑟𝑙 𝑏𝑙 𝐷𝑆𝑇 encoded computation tableau

𝑁 𝑦 = 𝑧

𝑧 𝑦

𝑈 𝑊 checks Π using Zero-Test

[Paneth-Rothblum17]

Homomorphic encryption

KPY Delegation

𝑏 = 𝐺(𝑟)

• 2. Delegation with Unambiguous Proofs
• Observation: need to use encryption with unambiguity property
• Unambiguity of Ciphertexts: any 𝑄∗(𝐷𝑆𝑇) cannot generate two

different ciphertexts that encrypt the same message

• KPY Encryption:
• 𝑡𝑙 = 𝑡 ← 𝔾
• 𝑑 = 𝑕𝑆 ∈ 𝔾[𝑦]
• 𝑄∗ ↛ 𝑑 = 𝑕𝑆,𝑑′ = 𝑕𝑆′ such that 𝑆 𝑡 = 𝑆′ 𝑡 = 𝑛
• Unambiguous Proofs: suffices to ensure unambiguity of answers

𝑆 𝑡 = 𝑛

• 2. Unambiguity of Answers
• [Kalai-Raz-Rothblum14] for 𝑟 ∈ 0,1 ℓ answers are unambiguous
• Need unambiguous answers for 𝑟 ∈ 𝔾ℓ
• Observation: If 𝑄 evaluates a multilinear polynomial then can

show unambiguity of answers for every 𝑟 ∈ 𝔾ℓ

• Idea: Ask 𝑄 to send a “proof of multilinearity” for his

evaluated ciphertexts

𝑧 𝑦

𝑈

Notion of local multilinearity!

𝑏 = 𝐺(𝑟)

Proof of Local Multilinearity

• 𝑄 homomorphically evaluates 𝐺(𝑟1 … 𝑟ℓ)
• First attempt: ask 𝑄 for the restriction of 𝐺 in each coordinate

Evaluate encryptions of (𝐵𝑗, 𝐶𝑗) such that 𝐺 Ԧ 𝑟 = 𝐵𝑗 ⋅ 𝑟𝑗 + 𝐶𝑗 𝑊 checks consistency using the Zero-Test

• Problem: 𝑄∗ can compute (𝐵𝑗, 𝐶𝑗) using 𝐹𝑜𝑑(𝑟𝑗)
• Idea: encrypt Ԧ

𝑟 again without 𝑗'th coordinate Ask 𝑄 for 𝐵𝑗

′,𝐶𝑗 ′

• Test that 𝐵𝑗, 𝐶𝑗 = 𝐵𝑗

′,𝐶𝑗 ′

“Proof of Equality” 𝑄 evaluated same function on both encryptions

Delegation with Updatable Unambiguous Proofs

Not done yet… To show unambiguity of entire proof:

• Unambiguity of other ciphertexts in KPY proof
• Unambiguity of ciphertexts we added ☺

Equality and Multilinearity proofs

• Show unambiguity preserved in recursive proof composition

Updatable proofs

Summary

• Our Results:
• Delegation with updatable and unambiguous proofs based on

the KPY bilinear group assumption

• PPAD-Hardness based on the quasi-polynomial hardness of the

KPY bilinear group assumption (and any hard language)

• Power of local proofs:
• recursive proof composition (updatable proofs)
• proof of multilinearity (unambiguous proofs)

Standard assumptions!

Thank you!

lisayang@mit.edu