Sublinear Zero-Knowledge Arguments for RAM Programs Payman Mike - PowerPoint PPT Presentation

Sublinear Zero-Knowledge Arguments for RAM Programs Payman Mike Alessandra Mohassel Scafuro Rosulek OSU NCState V I S Oregon State University A

Problem C Data S

Problem C Data S R 1

Problem C Data S R 1 y 1

Problem C Data S R 1 y 1 R 2

Problem C Data S R 1 y 1 R 2 y 2

Problem C Data S R 1 y 1 R 2 y 2 . . . .

Problem C Data S R 1 proof 𝜌 1 y 1 correct computation on same data R 2 y 2 𝜌 2 . . . .

Problem C Data S R 1 Zero-Knowledge proof 𝜌 1 y 1 correct computation on same data R 2 y 2 𝜌 2 . . . .

Problem Data S C R 1 Zero-knowledge y 1 𝜌 1 proof Properties

Problem Data S C R 1 Zero-knowledge y 1 𝜌 1 proof Properties Efficiency: work depends only on running time T

Problem Data S C R 1 Zero-knowledge y 1 𝜌 1 proof Properties Efficiency: work depends only on running time T Security: Composability

Problem Data S C R 1 Zero-knowledge y 1 𝜌 1 proof Properties Efficiency: work depends only on running time T Security: Composability [constant-round]

Sub-linear Zero Knowledge

Sub-linear Zero Knowledge [Kil92,Mic94,Gro10a,Lip12, GGPR13,….] P V pcp / Goal: proof as short as possible snarks

Sub-linear Zero Knowledge [Kil92,Mic94,Gro10a,Lip12, GGPR13,….] P V pcp / Goal: proof as short as possible snarks Problem P’s work depends on size of the input

Sub-linear Zero Knowledge [Kil92,Mic94,Gro10a,Lip12, GGPR13,….] P V pcp / Goal: proof as short as possible snarks Problem P’s work depends on size of the input Circuit-based approaches

Sub-linear Zero Knowledge [Kil92,Mic94,Gro10a,Lip12, GGPR13,….] P V pcp / Goal: proof as short as possible snarks Problem P’s work depends on size of the input Circuit-based approaches

Sub-linear Zero Knowledge [Kil92,Mic94,Gro10a,Lip12, GGPR13,….] P V pcp / Goal: proof as short as possible snarks Problem P’s work depends on size of the input ORAM Circuit-based approaches [GO96…]

Sub-linear amortized Zero-Knowledge [HMR15] P V Setup phase proof phase

Sub-linear amortized Zero-Knowledge [HMR15] P V Setup phase proof phase

Sub-linear amortized Zero-Knowledge [HMR15] P V Setup phase proof phase GC GC GC GC T garbled circuits

Sub-linear amortized Zero-Knowledge [HMR15] P V Setup phase proof phase GC GC GC GC T garbled circuits Problem Setup Phase : O(N) for both !

Sub-linear amortized Zero-Knowledge [HMR15] P V Setup phase proof phase GC GC GC GC T garbled circuits Problem Setup Phase : O(N) for both !

Sub-linear amortized Zero-Knowledge [HMR15] P V Setup phase proof phase Special cases ZK Sets [MRK03] and generalizations [ORS07,..] GC GC GC GC T garbled circuits Problem Setup Phase : O(N) for both !

Our Result

Sulinear Zero-Knowledge for RAM programs Setup Phase V P Proof Phase T = running time work depends only on running time T UC-Secure [based on efficient primitives (GC, Zkboo[GMO16])]

Sulinear Zero-Knowledge for RAM programs Setup Phase V P Proof Phase T = running time work depends only on running time T UC-Secure [based on efficient primitives (GC, Zkboo[GMO16])]

UC-Secure Ideal functionality F zkRAM F zkRAM V P

UC-Secure Ideal functionality F zkRAM F zkRAM Init: M V P

UC-Secure Ideal functionality F zkRAM M F zkRAM Init: M V P

UC-Secure Ideal functionality F zkRAM M F zkRAM Init: M V P Prove: R i , w i

UC-Secure Ideal functionality F zkRAM M’,y ← R i ( M , w i ) M F zkRAM Init: M V P Prove: R i , w i

UC-Secure Ideal functionality F zkRAM M’,y ← R i ( M , w i ) M ’ M F zkRAM Init: M V P Prove: R i , w i

UC-Secure Ideal functionality F zkRAM M’,y ← R i ( M , w i ) M ’ M F zkRAM Init: M R i , y V P Prove: R i , w i

UC-Secure Ideal functionality F zkRAM Challenge: extract M from M’,y ← R i ( M , w i ) M ’ M transcript F zkRAM Init: M R i , y V P Prove: R i , w i

Our technique

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - Garbling

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - Garbling R i

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - Garbling access pattern (i 1, i 2, i 3,.. ) R i

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - Garbling access pattern (i 1, i 2, i 3,.. ) R i prepares T garbled circuits

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - Garbling access pattern (i 1, i 2, i 3,.. ) R i prepares T garbled circuits GC GC GC [JOK13]

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i GC GC GC

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i i 1 GC GC GC

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i i 2 i 1 GC GC GC

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i i 2 i 1 i 3 GC GC GC

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i 0/1 i 2 i 1 i 3 GC GC GC

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i 0/1 i 2 i 1 i 3 GC GC GC y

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i 0/1 i 2 i 1 i 3 GC GC GC y replace used encoding

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i 0/1 i 2 i 1 i 3 GC GC GC y replace used encoding soundness: V fully controls encoding of the dataset

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data V should do nothing. Garbling values - ORAM - “Garbling” Soundness….? access pattern (i 1, i 2, i 3,.. ) R i 0/1 i 2 i 1 i 3 GC GC GC y replace used encoding soundness: V fully controls encoding of the dataset

P V Setup phase access pattern (i 1, i 2, i 3,.. ) GC GC GC

P V Setup phase access pattern (i 1, i 2, i 3,.. ) initial data GC GC GC

P V Setup phase access pattern (i 1, i 2, i 3,.. ) ORAM initial data GC GC GC

P V Setup phase encode access pattern (i 1, i 2, i 3,.. ) ORAM initial data GC GC GC

P V Merkle Tree Setup phase encode access pattern (i 1, i 2, i 3,.. ) ORAM initial data GC GC GC

P V Merkle Tree Setup phase encode access pattern (i 1, i 2, i 3,.. ) ORAM OT initial data GC GC GC

P V Merkle Tree Setup phase encode access pattern (i 1, i 2, i 3,.. ) ORAM OT initial data GC GC GC

P V Merkle Tree Setup phase encode access pattern (i 1, i 2, i 3,.. ) ORAM OT initial data GC GC GC

P V Merkle Tree Setup phase encode access pattern (i 1, i 2, i 3,.. ) ORAM OT initial data GC GC GC

P V Merkle Tree Setup phase encode ? access pattern (i 1, i 2, i 3,.. ) ORAM OT initial data GC GC GC 1. Consistency with committed input? (black-box)

P V Merkle Tree Setup phase encode ? access pattern (i 1, i 2, i 3,.. ) ORAM OT initial data GC GC GC 1. Consistency with committed input? (black-box) 2. Extraction committed input?

P V Merkle Tree Setup phase encode ? access pattern (i 1, i 2, i 3,.. ) ORAM OT initial data GC GC GC 1. Consistency with committed input? (black-box) 2. Extraction committed input? 3. “Malicious" ORAM?

P V Merkle Tree Setup phase encode ? access pattern (i 1, i 2, i 3,.. ) ORAM OT initial data GC GC GC 1. Consistency with committed input? (black-box) 2. Extraction committed input? 3. “Malicious" ORAM?

1. Black box proof of consistency V P y GC GC [GO S V14, IW14]

1. Black box proof of consistency V P y GC GC encode Reed- Solomon [GO S V14, IW14]

1. Black box proof of consistency V P commit y GC GC encode Reed- Solomon [GO S V14, IW14]

1. Black box proof of consistency V P Merkle Tree commit y GC GC encode Reed- Solomon [GO S V14, IW14]

1. Black box proof of consistency V P Merkle Tree commit codeword y GC GC encode Reed- Solomon i 1 [GO S V14, IW14]