Succinct Non-Interactive Arguments via Linear Interactive Proofs

Abstract

AbstractSuccinct non-interactive arguments(SNARGs) enable verifying NP statements with lower complexity than required for classical NP verification. Traditionally, the focus has been on minimizing the length of such arguments; nowadays, researchers have focused also on minimizing verification time, by drawing motivation from the problem of delegating computation. A common relaxation is apreprocessingSNARG, which allows the verifier to conduct an expensive offline phase that is independent of the statement to be proven later. Recent constructions of preprocessing SNARGs have achieved attractive features: they are publicly-verifiable, proofs consist of onlyO(1) encrypted (or encoded) field elements, and verification is via arithmetic circuits of size linear in the NP statement. Additionally, these constructions seem to have “escaped the hegemony” of probabilistically-checkable proofs (PCPs) as a basic building block of succinct arguments. We present a general methodology for the construction of preprocessing$$\text{ SNARG } $$SNARGs, as well as resulting new efficiency features. Our contribution is threefold:(1)We introduce and study a natural extension of the interactive proof model that considersalgebraically-boundedprovers; this new setting is analogous to the common study of algebraically-bounded “adversaries” in other fields, such as pseudorandomness and randomness extraction. More concretely, in this work we focus on linear (or affine) provers, and provide several constructions of (succinct two-message)linear interactive proofs(LIPs) for NP. Our constructions are based on general transformations applied to bothlinearPCPs (LPCPs) and traditional “unstructured” PCPs.(2)We give conceptually simple cryptographic transformations from LIPs to preprocessing SNARGs, whose security can be based on different forms oflinear targeted malleability(implied by previous knowledge assumptions). Our transformations convert arbitrary (two-message) LIPs into designated-verifier SNARGs, and LIPs with degree-bounded verifiers into publicly-verifiable SNARGs. We also extend our methodology to obtainzero-knowledgeLIPs and SNARGs. Our techniques yield SNARGsof knowledgeand thus can benefit from known recursive composition and bootstrapping techniques.(3)Following this methodology, we exhibit several constructions achieving new efficiency features, such as “single-ciphertext preprocessing SNARGs.” We also offer a new perspective on existing constructions of preprocessing SNARGs, revealing a direct connection of these to LPCPs and LIPs.