Proof-of-work Certificates for High Complexity Computations for - PowerPoint PPT Presentation

Proof-of-work Certificates for High Complexity Computations for Linear Algebra Erich L. Kaltofen NCSU , DUKE UNIVERSITY google->kaltofen

2 Computations for the Cloud: RSA Challenge RSA220 = 22601385262034057849416540486101975135080389157197767183211 97768109445641817966676608593121306582577250631562886676970 44807000181114971186300211248792819948748206607013106658664 6083327982803560379205391980139946496955261 = 68636564122675662743823714992884378001308422399791648446212 449933215410614414642667938213644208420192054999687 × 329290743948634981204930154921293529191645519653623395246 2860511692903493094652463337824866390738191765712603 S. Bai, P. Gaudry, A. Kruppa, E. Thom´ e, P. Zimmermann [May 2014–May 2016] Verification on any tablet computer in under one second

3 Computations for the Cloud: Sparse Matrix GL7d19 Rank From K-Theory Conjectures [Elbaz-Vincent, Gangle, Soul´ e ’05] 1 , 911 , 130 × 1 , 955 , 309 matrix of rank 1 , 033 , 568 Computed by J.-G. Dumas et al. 2007 with LinBox in 1050 CPU days With Monte-Carlo randomized algorithm ... Do you believe the rank?

3 Computations for the Cloud: Sparse Matrix GL7d19 Rank From K-Theory Conjectures [Elbaz-Vincent, Gangle, Soul´ e ’05] 1 , 911 , 130 × 1 , 955 , 309 matrix of rank 1 , 033 , 568 Computed by J.-G. Dumas et al. 2007 with LinBox in 1050 CPU days With Monte-Carlo randomized algorithm ... Do you believe the rank? [Dumas-Kaltofen ISSAC 2014] construct a linear-time checkable interactive proof-of-work certificate

4 Theoretical Computer Science Landmark Result In order to verify a proof/computation, one does not need to check every step: exponential speed-up for verifier is possible

4 Theoretical Computer Science Landmark Result In order to verify a proof/computation, one does not need to check every step: exponential speed-up for verifier is possible Ingredients 1. Randomized identity testing [DeMillo-Lipton’78;Schwartz,Zippel’79] 2. Interactive protocols [Goldwasser-Micali-Rackoff’85] 3. Replacing interaction by cryptography [Fiat-Shamir 1986] 4. Exponential speed-up for verifier [Lund-Fortnow-Karloff-Nisan’92]

5 Randomization: Rusin Freivalds’s 1979 Check Let A , B , C ∈ K n × n , K a field Certify C = A · B via a random vector y ∈ { 0 , 1 } n , and check Cy = A ( By ) : randomized of O ( n 2 ) complexity Probability ( Cy � = ABy | C � = AB ) ≥ 1 2

5 Randomization: Rusin Freivalds’s 1979 Check Let A , B , C ∈ K n × n , K a field Certify C = A · B via a random vector y ∈ { 0 , 1 } n , and check Cy = A ( By ) : randomized of O ( n 2 ) complexity Probability ( Cy � = ABy | C � = AB ) ≥ 1 2 Application: O ( n 2 ) verification of determinant Prover: Run fastest determinant algorithm, eg, Storjohann’s For the matrix multiplications, record inputs and outputs Verifier: rerun algorithm and instead of the doing matrix multiplications, verify the AB = C by Freivalds’s algorithm It’s like running the det algorithm with a quadratic-time matrix multiplication procedure

5 Randomization: Rusin Freivalds’s 1979 Check Let A , B , C ∈ K n × n , K a field Certify C = A · B via a random vector y ∈ { 0 , 1 } n , and check Cy = A ( By ) : randomized of O ( n 2 ) complexity Probability ( Cy � = ABy | C � = AB ) ≥ 1 2 Application: O ( n 2 ) verification of determinant Prover: Run fastest determinant algorithm, eg, Storjohann’s For the matrix multiplications, record inputs and outputs Verifier: rerun algorithm and instead of the doing matrix multiplications, verify the AB = C by Freivalds’s algorithm Problem: proof-of-work certificate has O ( n 2 ) size

6 Interactive Proof Protocol: Dumas’s & Kaltofen’s 2014 CharPoly Certificate Prover “Peggy” must convince Verifier “Victor” that χ A ( λ ) = det ( λ I − A ) , A ∈ Z n × n Prover Commun. Verifier χ A ( λ ) χ A ( λ ) = det ( λ I − A ) − − − − − − − − → “commits” p a smallish random prime p , r ← − − − − − − − − r a smallish random integer Non-interactive certificate for ∆ = det ( rI − A ) mod p Checks ∆ ≡ χ A ( r ) ( mod p )

6 Interactive Proof Protocol: Dumas’s & Kaltofen’s 2014 CharPoly Certificate Prover “Peggy” must convince Verifier “Victor” that χ A ( λ ) = det ( λ I − A ) , A ∈ Z n × n Prover Commun. Verifier χ A ( λ ) χ A ( λ ) = det ( λ I − A ) − − − − − − − − → “commits” p a smallish random prime p , r ← − − − − − − − − r a smallish random integer Non-interactive certificate for ∆ = det ( rI − A ) mod p Checks ∆ ≡ χ A ( r ) ( mod p ) Verification bit complexity: essentially linear in input bit size

7 Replace Interaction by Crypto: Dumas’s & Kaltofen’s 2014 CharPoly Certificate Prover “Peggy” must convince Verifier “Victor” that χ A ( λ ) = det ( λ I − A ) , A ∈ Z n × n Prover Commun. Verifier χ A ( λ ) χ A ( λ ) = det ( λ I − A ) − − − − − − − − → p , r p , r = hash ( A , χ A ) − − − − − − − − → Non-interactive certificate for ∆ = det ( rI − A ) mod p Checks p , r = hash ( A , χ A ) Checks ∆ ≡ χ A ( r ) ( mod p )

7 Replace Interaction by Crypto: Dumas’s & Kaltofen’s 2014 CharPoly Certificate Prover “Peggy” must convince Verifier “Victor” that χ A ( λ ) = det ( λ I − A ) , A ∈ Z n × n Prover Commun. Verifier χ A ( λ ) χ A ( λ ) = det ( λ I − A ) − − − − − − − − → p , r p , r = hash ( A , χ A ) − − − − − − − − → Non-interactive certificate for ∆ = det ( rI − A ) mod p Checks p , r = hash ( A , χ A ) Checks ∆ ≡ χ A ( r ) ( mod p ) Yields sum-of-squares proofs in non-linear optimization with fastest verification [Kaltofen, Li, Yang, Zhi 2008]

8 Sparse Determinant Proof-of-Work Based on Cramer’s Rule [Dumas and Kaltofen 2015] � w 1 � � 0 � . . . . = = ⇒ A . . w n − 1 0 w n 1   a 1 , 1 ... a 1 , n − 1 0 . . .   . . .   . . . det     ... M a n − 1 , 1 a n − 1 , n − 1 0 � �� � ... a n , 1 a n , n − 1 1 = det ( A 1 ... n − 1 , 1 ... n − 1 ) w n =   det ( A ) a 1 , 1 ... a 1 , n − 1 a 1 , n  . . .  . . .   . . . det     ... a n − 1 , 1 a n − 1 , n − 1 a n − 1 , n ... a n , 1 a n , n − 1 a n , n

9 Prover Communication Verifier χ A 1. χ A ( λ ) = det ( λ I n − A ) − − → 2. M = [ a i , j ] 1 ≤ i , j ≤ n − 1 , χ M ( λ ) = det ( λ I n − 1 − M ) χ M → Checks GCD ( χ A , χ M ) = 1; − − r 1 − r 1 ∈ S ⊆ K random with χ A ( r 1 ) � = 0 ← − 3. 4. Computes w such that � 0 � . . w ( r 1 I n − A ) w = e n = . − − → Checks ( r 1 I n − A ) w = e n and 0 w n = χ A ( r 1 ) / χ M ( r 1 ) ; 1 Returns det ( A ) = ( − 1 ) n χ A ( 0 ) 5. Note: GCD ( χ A , χ M ) = 1 is achieved by preconditioning

9 Prover Communication Verifier χ A 1. χ A ( λ ) = det ( λ I n − A ) − − → 2. M = [ a i , j ] 1 ≤ i , j ≤ n − 1 , χ M ( λ ) = det ( λ I n − 1 − M ) χ M → Checks GCD ( χ A , χ M ) = 1; − − r 1 − r 1 ∈ S ⊆ K random with χ A ( r 1 ) � = 0 ← − 3. 4. Computes w such that � 0 � . . w ( r 1 I n − A ) w = e n = . − − → Checks ( r 1 I n − A ) w = e n and 0 w n = χ A ( r 1 ) / χ M ( r 1 ) ; 1 Returns det ( A ) = ( − 1 ) n χ A ( 0 ) 5. Note: GCD ( χ A , χ M ) = 1 is achieved by preconditioning Prover cheats by sending monic h , H with GCD ( h , H )= 1 , h / H � = χ M / χ A Then with high probab.: w n = χ A ( r 1 ) / χ M ( r 1 ) � = h ( r 1 ) / H ( r 1 )

9 Prover Communication Verifier χ A 1. χ A ( λ ) = det ( λ I n − A ) − − → 2. M = [ a i , j ] 1 ≤ i , j ≤ n − 1 , χ M ( λ ) = det ( λ I n − 1 − M ) χ M → Checks GCD ( χ A , χ M ) = 1; − − r 1 − r 1 ∈ S ⊆ K random with χ A ( r 1 ) � = 0 ← − 3. 4. Computes w such that � 0 � . . w ( r 1 I n − A ) w = e n = . − − → Checks ( r 1 I n − A ) w = e n and 0 w n = χ A ( r 1 ) / χ M ( r 1 ) ; 1 Returns det ( A ) = ( − 1 ) n χ A ( 0 ) 5. Note: GCD ( χ A , χ M ) = 1 is achieved by preconditioning Protocol communication: O ( n ) scalars Prover complexity: fast by Block Wiedemann Algorithm

10 Our 2015 Preconditioner   τ − 1 0 ... 0   . ...   . − 1 . 0 τ     . ... ... A ) = det ( A ) ( τ n + σ ) �   det ( � . A = A , .  0 0    ...    τ − 1  0 σ 0 ... 0 τ ⇒ χ � A ( λ ) is irreducible for variables σ , τ det ( A ) � = 0 = ⇒ GCD ( χ � A , χ � M ) = 1 with high probability = for random scalars σ , τ

11 The Rank Profile Matrix [Dumas, Pernet, Sultan 2015] Definition: Let A ∈ K m × n ; the rank profile matrix R A = [ r A i , j ] ∈ { 0 , 1 } m × n satisfies: 1. all rows and columns have at most one 1 2. the ranks of all upper-left submatrices are the same: ∀ i , j : rank ([ a µ , ν ] 1 ≤ µ ≤ i , 1 ≤ ν ≤ j ) = rank ([ r A µ , ν ] 1 ≤ µ ≤ i , 1 ≤ ν ≤ j )     2 0 3 0 1 0 0 0     1 0 0 0 0 0 1 0 ⇒ R A =     Example: A =  =    0 0 4 0 0 0 0 0 0 2 0 1 0 1 0 0