Using Efficient Set Accumulators USENIX Security, 2020 Alex Ozdemir* - - PowerPoint PPT Presentation

โ–ถ
using efficient set accumulators
SMART_READER_LITE
LIVE PREVIEW

Using Efficient Set Accumulators USENIX Security, 2020 Alex Ozdemir* - - PowerPoint PPT Presentation

Jan 22, 2024 466 likes โ€ข760 views

Scaling Verifiable Computation Using Efficient Set Accumulators USENIX Security, 2020 Alex Ozdemir* , Riad Wahby*, Barry Whitehat^, Dan Boneh* *Stanford ^Unaffiliated Problem: Verifiable Storage Represent a large storage (e.g. array)

slide-1
SLIDE 1

Scaling Verifiable Computation Using Efficient Set Accumulators

USENIX Security, 2020 Alex Ozdemir*, Riad Wahby*, Barry Whitehat^, Dan Boneh* *Stanford ^Unaffiliated

slide-2
SLIDE 2

Problem: Verifiable Storage

  • Represent a large storage (e.g. array) with a small digest
  • Verifiably read and update the digest

๐‘Š๐‘“๐‘ ๐‘—๐‘”๐‘ง๐‘ ๐‘“๐‘๐‘’(๐‘’, ๐‘—, ๐‘ค, ๐œŒ๐‘ ) ๐‘Š๐‘“๐‘ ๐‘—๐‘”๐‘ง๐‘ฃ๐‘ž๐‘’๐‘๐‘ข๐‘“(๐‘’, ๐‘—๐‘ฅ, ๐‘ค๐‘ฅ, ๐‘’โ€ฒ, ๐œŒ๐‘ฅ)

Prover(๐ต, ๐‘’) Verifier(๐‘’)

๐‘—, ๐‘ค, ๐œŒ๐‘  ๐‘’โ€ฒ, ๐‘—๐‘ฅ, ๐‘ค๐‘ฅ, ๐œŒ๐‘ฅ ๐‘ค โ† ๐ต[๐‘—] ๐ต ๐‘—๐‘ฅ โ† ๐‘ค๐‘ฅ ๐‘’ โ† ๐ธ๐‘—๐‘•๐‘“๐‘ก๐‘ข(๐ต) Our Work: Concretely cheaper verifiable storage using RSA accumulators Context: Verifiable outsourcing/cryptographic proof systems

slide-3
SLIDE 3

๐‘ฆ ๐†

Cryptographic Proof Systems Programming Them

๐‘ฆ0 ๐‘ฆ1 ๐‘ฆ2 ๐‘ฅ0 ๐‘ฅ1 ๐‘ฅ2

RSA Accumulators

slide-4
SLIDE 4

๐‘ฆ ๐†

Cryptographic Proof Systems Programming Them

๐‘ฆ0 ๐‘ฆ1 ๐‘ฆ2 ๐‘ฅ0 ๐‘ฅ1 ๐‘ฅ2

RSA Accumulators

slide-5
SLIDE 5

NP Proof Systems

๐‘ฆ ๐‘ฅ โˆƒ ๐‘ฅ. ๐‘พ๐‘ด ๐‘ฆ, ๐‘ฅ ? ๐‘€ โˆˆ ๐‘‚๐‘„ (๐‘ฆ โˆˆ ๐‘€)?

Properties

  • ๐‘ฅ โˆˆ ๐‘ž๐‘๐‘š๐‘ง(|๐‘ฆ|)
  • ๐‘ˆ๐‘Š๐‘€ โˆˆ ๐‘ž๐‘๐‘š๐‘ง |๐‘ฆ|
  • Aladdin learns ๐‘ฅ

๐‘ฅ โ† ?

slide-6
SLIDE 6

Cryptographic Proof Systems: Abstract

๐‘ฆ ๐† ๐‘พ๐’‡๐’”๐’‹๐’ˆ๐’›๐‘พ๐‘ด(๐†, ๐‘ฆ โˆˆ ๐‘€)

Extra Properties

  • ๐œŒ โˆˆ ๐‘ƒ(1)
  • ๐‘ˆ๐‘Š๐‘“๐‘ ๐‘—๐‘”๐‘ง โˆˆ ๐‘ƒ |๐‘ฆ|
  • (Aladdin doesnโ€™t learn ๐‘ฅ)
  • ๐‘ˆ๐‘„๐‘ ๐‘๐‘ค๐‘“ โˆˆ ๐‘ž๐‘๐‘š๐‘ง ๐‘ˆ๐‘Š๐‘€

๐† โ† ๐‘ธ๐’”๐’‘๐’˜๐’‡๐‘พ๐‘ด(๐‘ฆ, ๐‘ฅ) ๐‘ฅ โ† ? ๐‘ก. ๐‘ข. ๐‘Š

๐‘€ ๐‘ฆ, ๐‘ฅ = โŠค

Using PCPs + Cryptography ๐‘€ โˆˆ ๐‘‚๐‘„ (๐‘ฆ โˆˆ ๐‘€)?

slide-7
SLIDE 7

Cryptographic Proof Systems: Concrete

๐‘€ must be verifiable by an arithmetic constraint system (arithmetic circuit)

๐‘Š

๐‘€ ๐‘ฆ, ๐‘ฅ

๐‘ฆ0 ๐‘ฆ1 ๐‘ฆ2 ๐‘ฅ0 ๐‘ฅ1 ๐‘ฅ2

slide-8
SLIDE 8

Rank-1 Constraint Systems (R1CS)

  • Constraints have the form

๐ต ร— ๐ถ = ๐ท where ๐ต, ๐ถ, ๐ท are linear combinations of variables

  • Prover time proportional to

constraint count. ๐‘ฆ0 1 โˆ’ ๐‘ฆ0 = 0 0 = ๐‘ฅ0 + 2๐‘ฅ1 + 4๐‘ฅ2 โˆ’ ๐‘ฆ ๐‘ฆ0๐‘ฆ1 = ๐‘ฅ ๐‘ฆ0๐‘ฆ1๐‘ฆ2 = ๐‘ฅ

slide-9
SLIDE 9

๐‘ฆ ๐†

Cryptographic Proof Systems Programming Them

๐‘ฆ0 ๐‘ฆ1 ๐‘ฆ2 ๐‘ฅ0 ๐‘ฅ1 ๐‘ฅ2

RSA Accumulators

slide-10
SLIDE 10

What Does Programming in R1CS Mean?

๐‘จ < 16

Abstract Constraint

โ€œProgrammingโ€

Rank-1 Constraints

๐ต1 ร— ๐ถ1 = ๐ท1 ๐ต2 ร— ๐ถ2 = ๐ท2 ๐ต3 ร— ๐ถ3 = ๐ท3 โ‹ฎ ๐ต๐‘œ ร— ๐ถ๐‘œ = ๐ท๐‘œ

Variables encoded as field variables Predicates encoded as constraints Constraints may use witness variables

slide-11
SLIDE 11

Inequality in R1CS

๐‘จ < 16

Abstract Constraint

Encoded as the field variable ๐’œ

Rank-1 Constraints

๐‘ฅ0 ร— (1 โˆ’ ๐‘ฅ0) = 0 ๐‘ฅ1 ร— (1 โˆ’ ๐‘ฅ1) = 0 ๐‘ฅ2 ร— (1 โˆ’ ๐‘ฅ2) = 0 ๐‘ฅ3 ร— (1 โˆ’ ๐‘ฅ3) = 0 0 = ๐‘ฅ0 + 2๐‘ฅ1 + 4๐‘ฅ2 + 8๐‘ฅ3 โˆ’ ๐‘จ

slide-12
SLIDE 12

Polynomial Multiplication

๐‘” ๐‘ฆ โ‹… ๐‘• ๐‘ฆ = โ„Ž(๐‘ฆ)

Abstract Constraint Rank-1 Constraints

๐‘”

0 + ๐‘” 1 + ๐‘” 2

๐‘•0 + ๐‘•1 + ๐‘•2 = โ„Ž0 + โ„Ž1 + โ„Ž2 + โ„Ž3 + โ„Ž4 ๐‘”

0 + 2๐‘” 1 + 4๐‘” 2

๐‘•0 + 2๐‘•1 + 4๐‘•2 = โ„Ž0 + 2โ„Ž1 + 4โ„Ž2 + 8โ„Ž3 + 16โ„Ž4 ๐‘”

0 + 3๐‘” 1 + 9๐‘” 2

๐‘•0 + 3๐‘•1 + 9๐‘•2 = โ„Ž0 + 3โ„Ž1 + 9โ„Ž2 + 27โ„Ž3 + 81โ„Ž4 ๐‘”

0 + 4๐‘” 1 + 16๐‘” 2

๐‘•0 + 4๐‘•1 + 16๐‘•2 = โ„Ž0 + 4โ„Ž1 + 16โ„Ž2 + 64โ„Ž3 + 256โ„Ž4 ๐‘”

0 + 5๐‘” 1 + 25๐‘” 2

๐‘•0 + 5๐‘•1 + 25๐‘•2 = โ„Ž0 + 5โ„Ž1 + 25โ„Ž2 + 125โ„Ž3 + 625โ„Ž4

Each coefficient is a field variable:

  • ๐‘” ๐‘ฆ = ๐‘”

0 + ๐‘” 1๐‘ฆ + ๐‘” 2๐‘ฆ2

  • ๐‘• ๐‘ฆ = ๐‘•0 + ๐‘•1๐‘ฆ + ๐‘•2๐‘ฆ2
  • โ„Ž ๐‘ฆ = โ„Ž0 + โ„Ž1๐‘ฆ + โ„Ž2๐‘ฆ2 + โ„Ž3๐‘ฆ3 + โ„Ž4๐‘ฆ4

Check ๐‘” ๐‘ โ‹… ๐‘• ๐‘ = โ„Ž ๐‘ for different ๐‘

slide-13
SLIDE 13

Big Natural Multiplication

๐‘ฆ โ‹… ๐‘ง = ๐‘จ

Abstract Constraint Rank-1 Constraints Sketch

Represent naturals with limbs, base ๐‘. Each limb is a field element.

  • ๐‘ฆ = ๐‘ฆ0 + ๐‘ฆ1๐‘ + ๐‘ฆ2๐‘2
  • ๐‘ง = ๐‘ง0 + ๐‘ง1๐‘ + ๐‘ง2๐‘2
  • z = ๐‘จ0 + ๐‘จ1๐‘ + ๐‘จ2๐‘2 + ๐‘จ3๐‘3 + ๐‘จ4๐‘4 + ๐‘จ5๐‘5

๐‘‘๐‘๐‘ ๐‘ ๐‘ง ๐‘œ๐‘๐‘ข ๐‘ž๐‘๐‘š๐‘ง ๐‘ฆ ร— ๐‘ž๐‘๐‘š๐‘ง ๐‘ง = ๐‘จ ~ a ripple-carry adder from digital architecture (range checks!)

slide-14
SLIDE 14

Big Natural Division

๐‘ง/๐‘ฆ = ๐‘Ÿ

Abstract Constraint Rank-1 Constraints Sketch

Represent naturals with limbs, base ๐‘. Each limb is a field element.

  • ๐‘ฆ = ๐‘ฆ0 + ๐‘ฆ1๐‘ + ๐‘ฆ2๐‘2
  • ๐‘ง = ๐‘ง0 + ๐‘ง1๐‘ + ๐‘ง2๐‘2
  • ๐‘Ÿ = ๐‘Ÿ0 + ๐‘Ÿ1๐‘ + ๐‘Ÿ2๐‘2

โˆƒ๐‘ . ๐‘ง = ๐‘ฆ๐‘Ÿ + ๐‘ 

slide-15
SLIDE 15

๐‘ฆ ๐†

Cryptographic Proof Systems Programming Them

๐‘ฆ0 ๐‘ฆ1 ๐‘ฆ2 ๐‘ฅ0 ๐‘ฅ1 ๐‘ฅ2

RSA Accumulators

slide-16
SLIDE 16

The Competition: Merkle Trees

  • Based on a hash function

๐ผ: ๐บ ร— ๐บ โ†’ ๐บ

  • Collision-Resistant
  • Reduce the array to a single

value with a hash-tree

  • Proofs based on paths in the

tree

x0 x1 x2 x3 x4 x5 x6 x7 H H H H H H H ๐‘’ โ„Ž0 โ„Ž1 โ„Ž2 โ„Ž3 โ„Ž4 โ„Ž5

Verification cost: (roughly) ๐’ ๐ฆ๐ฉ๐ก ๐’ hashes for ๐‘™ updates and a storage of capacity ๐‘›.

slide-17
SLIDE 17

RSA Accumulators

  • Based on RSA groups
  • The integers modulo ๐‘ž๐‘Ÿ: the produce of two unknown primes.
  • Hard to compute roots.
  • ๐‘ฆ๐‘œ is easy, ๐‘œ ๐‘ฆ is hard.
  • The digest of an RSA Accumulator is

๐‘’ = ๐‘•ฯ‚๐‘— ๐ผฮ” ๐‘ง๐‘—

Fixed generator A (special) hash function The stored elements

slide-18
SLIDE 18

RSA Accumulator Proofs

  • Insertion proof:
  • Verifier checks an exponentiation
  • Removal proof:
  • Insertion in reverse
  • Membership proof:
  • A removal proof, but the new digest is forgotten
  • Sound because computing roots is hard!

๐‘’โ€ฒ = ๐‘’๐ผฮ” ๐‘ง

slide-19
SLIDE 19

Batched RSA Accumulator Proofs

  • Batches require two small exponentiations [BBF 18]/[Wes 18]
  • Requires a hash function to prime numbers (for non-interactivity)

๐‘’โ€ฒ = ๐‘…โ„“ โ‹… ๐‘’ฯ‚๐‘— ๐ผฮ” ๐‘ง๐‘— %โ„“

Verification cost: ๐’ (๐ข๐›๐ญ๐ข๐Ÿ๐ญ & ๐ง๐ฉ๐ž๐ฏ๐ฆ๐›๐ฌ ร—) + ๐Ÿ‘ ๐Ÿ๐ฒ๐ช๐ฉ๐จ๐Ÿ๐จ๐ฎ๐ฃ๐›๐ฎ๐ฃ๐ฉ๐จ๐’• for ๐‘™ updates and a storage of capacity ๐‘›.

๐‘’โ€ฒ = ๐‘’ฯ‚๐‘— ๐ผฮ” ๐‘ง๐‘—

Prover Verifier

โ„“ โ‡œ Primes โ„“ ๐‘… โ† ๐‘’

เต— ฯ‚๐‘— ๐ผฮ”(๐‘ง๐‘—) โ„“

๐‘…

slide-20
SLIDE 20

RSA Accumulator Circuit Overview

โ„“ โ† ๐ผ๐‘ž(โ€ฆ ) ๐‘’โ€ฒ = ๐‘…โ„“ โ‹… ๐‘’ฯ‚๐‘— ๐ผฮ” ๐‘ง๐‘— %โ„“

Multiprecision Arithmetic

slide-21
SLIDE 21

Traditional Hash-to-Prime

  • Rejection sampling of primes
  • Miller Rabin primality test
  • Probabilistic!
  • 2โˆ’๐œ‡ soundness uses ๐‘ƒ(๐œ‡), เทจ

๐‘ƒ ๐œ‡ - bit exponentiations

  • Many constraints

procedure HashToPrime(x): ๐‘• โ† ๐‘„๐‘†๐ป(๐‘ก๐‘“๐‘“๐‘’ = ๐‘ฆ) while ๐‘•.output() is composite: ๐‘•.advance() Return ๐‘•.output()

slide-22
SLIDE 22

Pocklington Prime Generation

  • Pocklingtonโ€™s criterion:
  • If
  • ๐‘ž is prime
  • ๐‘œ < ๐‘ž
  • โˆƒ๐‘. ๐‘๐‘œ๐‘ž โ‰ก๐‘œ๐‘ž+1 1 โ‹€ gcd ๐‘๐‘œ โˆ’ 1, ๐‘œ๐‘ž + 1 = 1
  • Then ๐‘œ๐‘ž + 1 is prime
  • Basis for a recursive primality

certificate

  • Idea: Rejection sampling of prime

certificates

๐‘ž0 ๐‘ž1 ๐‘ž2 ๐‘ž3

Pโ€™s Criterion with ๐‘œ1 Pโ€™s Criterion with ๐‘œ2 Pโ€™s Criterion with ๐‘œ3 Base prime test PRG-based rejection sampling Many fewer constraints than Miller-Rabin, and provably prime

slide-23
SLIDE 23

Other Techniques and Tricks

  • Optimizations for multiprecision arithmetic in constraints
  • Based on xjSnark [KPS 18]
  • A new hash function, conjectured to be division-intractable
  • Precise semantics for batching dependent accesses.
slide-24
SLIDE 24

Evaluation: Constraints

  • Implementation in

Bellman, using Groth16.

  • Consider storage of

varying size

  • Perform varying

numbers of swaps (remove x, add y)

  • Measure constraints
  • Crossover occurs at a

few thousand operations

25 210 215 220

slide-25
SLIDE 25

Evaluation: Prover Time

  • Includes RSA accumulator

removal time (โ‰ˆ43s)

  • Computing ๐‘’โ€ฒ such that

๐‘’ = ๐‘’โ€ฒฯ‚๐‘— ๐ผฮ” ๐‘ง๐‘—

  • Independent of batch size,

linear in storage size.

  • Machine info:
  • 48 logical cores
  • 132GB memory

220 220

slide-26
SLIDE 26

Future Directions

  • Better investigation of concrete prover costs
  • Integration with the proof system
  • Direct support for range-proofs (๐‘จ < 232)
  • Arithmetic circuits over โ„ค/๐‘ž๐‘Ÿโ„ค (crazy?)
  • Managing non-proof prover costs
  • Multi-tiered accumulators?
  • Hybrid RSA-Merkle accumulators?
slide-27
SLIDE 27

Summary

Techniques

  • Multiprecision arithmetic
  • Division-intractable hashing
  • Hashing to prime numbers
  • Semantics of dependent

accesses

Conclusions Research Question

Do RSA accumulators use fewer constraints than Merkle Trees?

Implementation: github.com/alex-ozdemir/bellman-bignat Paper: ia.cr/2019/1494