Doubly Efficient Interactive Proofs
Ron Rothblum
Outsourcing Computation
Weak client outsources computation to the cloud.
𝑥
𝑦 = 𝑓(𝑥)
Outsourcing Computation
We do not want to blindly trust the cloud.
𝑥
𝑦 = 𝑓(𝑥)
Key security concerns:
• Correctness: why should we trust the server’s
answer?
• Privacy: keep client’s sensitive data secret (closely
related to homomorphic encryption)
Interactive Proofs to the Rescue?
Interactive Proof [GMR85]: prover 𝑃 tries to interactively
convince a polynomial-time verifier 𝑉 that 𝑓 𝑥 = 𝑦.
𝑓 𝑥 = 𝑦 ⇒ 𝑃 convinces 𝑉.
𝑓 𝑥 ≠ 𝑦 ⇒ no 𝑃∗ can convince 𝑉 wp ≥ 1/2.
Key Problem: in classical results complexity of proving is
actually exponential:
IP=PSPACE [LFKN90,Shamir90]: Interactive Proofs for
space 𝑆 computations with 2poly 𝑆 prover, poly(𝑛, 𝑆)
verification, poly(𝑆) rounds.
Doubly Efficient Interactive Proof
[GKR08]
Interactive proof for 𝑓 𝑥 = 𝑦 where the prover
is efficient, and the verifier is super efficient.
Proportional to
complexity of 𝑓
Much faster than
complexity of 𝑓
Soundness holds against any (computationally
unbounded) cheating prover.
Doubly Efficient Interactive Proofs:
The State of the Art
1) [GKR08]: Bounded Depth
Logspace uniform
𝑁𝐶
• Any bounded-depth circuit.
• (Almost) linear time verifier, poly-time prover.
• Number of rounds proportional to circuit depth.
2) [RRR16]: Bounded Space
• Any bounded-space computation.
• (Almost) linear time verifier, poly-time prover.
• 𝑶 𝟏 rounds.
Constant-Round Doubly Efficient
Interactive Proofs
Theorem [RRR16]: ∃𝛿 > 0 s.t. every language
computable in poly(𝑛) time and 𝑛𝛿 space has an
unconditionally sound interactive proof where:
1. Verifier is (almost) linear time.
2. Prover is polynomial-time.
No cryptographic
3. Constant number of rounds.
assumptions or operations
Inherent (under reasonable
conjectures)
Roadmap: A Taste of the Proof
Iterative construction:
1. Start with interactive proof for short
computations.
2. Build interactive proof for slightly longer
computations.
3. Repeat.
Iterative Construction
Suppose we have interactive proofs for time 𝑇/𝑘
and space 𝑆 computations.
Consider a time 𝑇 and space 𝑆 computation.
𝑆
𝑥
𝑦
𝑇
Divide & Conquer
Divide: Prover sends Turing machine configuration
in 𝑘 ≪ 𝑇 intermediate steps.
𝑦
𝑥
𝑡𝑇/𝑘
𝑡2𝑇/𝑘 …
𝑡(𝑘−1)𝑇/𝑘
Conquer? recurse on all subcomputations.
Problem: verification blows up, no savings.
Divide & Conquer
Divide: Prover sends Turing machine configuration
in 𝑘 ≪ 𝑇 intermediate steps.
𝑦
𝑥
𝑡𝑇/𝑘
𝑡2𝑇/𝑘 …
𝑡(𝑘−1)𝑇/𝑘
Conquer? Choose a few at random and recurse.
Problem: huge soundness error.
Best of Both Worlds?
Can we batch verify 𝑘 instances much more
efficiently than 𝑘 independent executions.
Goal:
• Suppose 𝑥 ∈ 𝐿 can be verified in time 𝑡.
• Want to verify 𝑥1 , … , 𝑥𝑘 ∈ 𝐿 in ≪ 𝑘 ⋅ 𝑡 time.
Warmup: Batch Verification for 𝐔𝐏
𝐔𝐏 ⊆ 𝐍𝐏 are all relations with unique accepting
witnesses.
Theorem [RRR16]: Every 𝐿 ∈ 𝐔𝐏, has an
interactive proof for verifying that 𝑥1 , … , 𝑥𝑘 ∈ 𝐿
with 𝒎 ⋅ 𝐩𝐨𝐥𝐲𝐥𝐨𝐠(𝒌) + 𝑶(𝒌) communication.
𝑚 = witness length
Tool: Probabilistically Checkable Proofs
PCP Theorem […,ALMSS92,…]: Every NP witness 𝑤 has a
PCP encoding 𝜋 = 𝑃𝐶𝑃(𝑥, 𝑤) that can be verified with a
constant number of queries.
𝜋 = 𝑃𝐶𝑃 𝑥, 𝑤
𝑽(𝒙)
Furthermore, query locations don’t depend on input.
PCPs ⇒ Batch Verification?
𝑽(𝒙𝟏 , … , 𝒙𝒌 )
𝑷(𝒙𝟏 , 𝒘𝟏 … , 𝒙𝒌 , 𝒘𝒌 )
1. Generate PCP queries 𝑄
𝜋1 = 𝑃𝐶𝑃 𝑥1 , 𝑤1
𝐴=
𝜋2 = 𝑃𝐶𝑃 𝑥2 , 𝑤2
⋮
𝜋𝑘 = 𝑃𝐶𝑃 𝑥𝑘 , 𝑤𝑘
𝑄
𝐴𝑄
2. Accept if PCP verifier
accepts all 𝑘 statements.
Extremely efficient – just 𝑶(𝒌 + 𝐥𝐨𝐠 𝒎)
communication!
Totally insecure – soundness of PCP is only
guaranteed if PCP proof is written in advance.
Batch Verification via Checksums
𝑽(𝒙𝟏 , … , 𝒙𝒌 )
𝑷(𝒙𝟏 , 𝒘𝟏 … , 𝒙𝒌 , 𝒘𝒌 )
𝐴=
𝜋1 = 𝑃𝐶𝑃 𝑥1 , 𝑤1
𝐶
𝜋2 = 𝑃𝐶𝑃 𝑥2 , 𝑤2
𝑄
⋮
𝐴𝑄
𝜋𝑘 = 𝑃𝐶𝑃 𝑥𝑘 , 𝑤𝑘
𝐶=
∑𝑖∈ 𝑘 𝜋𝑖
1. Generate PCP queries 𝑄
2. Check that PCP verifier
accepts all 𝑘 statements.
3. Check 𝐴𝑄 consistent
with 𝐶.
Single Deviation Provers
In general: not sound.
Intuitively the hardest case
Relaxed soundness: make two assumptions
• only one 𝑥𝑖 ∗ ∉ 𝐿.
• “single-deviation” 𝑃∗ : in answering queries 𝑄,
𝑃∗ must answer honestly on all rows 𝑖 ≠ 𝑖 ∗ .
Unjustifiable assumption!
Soundness vs. Single-Deviation Provers
𝑽(𝒙𝟏 , … , 𝒙𝒊∗ , … , 𝒙𝒌 )
𝑷∗ (𝒙𝟏 , 𝒘𝟏 , … , 𝒙𝒊∗ , … . 𝒙𝒌 , 𝒘𝒌 )
𝐶∗
Soundness vs. Single-Deviation Provers
𝑽(𝒙𝟏 , … , 𝒙𝒊∗ , … , 𝒙𝒌 )
𝑷∗ (𝒙𝟏 , 𝒘𝟏 , … , 𝒙𝒊∗ , … . 𝒙𝒌 , 𝒘𝒌 )
𝜋1 = 𝑃𝐶𝑃 𝑥1 , 𝑤1
𝐴=
𝝅𝒊∗ = 𝑪∗ + ∑𝒊≠𝒊∗ 𝝅𝒊
⋮
𝜋𝑘 = 𝑃𝐶𝑃 𝑥𝑘 , 𝑤𝑘
𝐶∗ =
⊕
∑𝑖∈ 𝑘 𝜋𝜋𝑖𝑖
𝐶∗
Soundness vs. Single-Deviation Provers
𝑽(𝒙𝟏 , … , 𝒙𝒊∗ , … , 𝒙𝒌 )
𝑷∗ (𝒙𝟏 , 𝒘𝟏 , … , 𝒙𝒊∗ , … . 𝒙𝒌 , 𝒘𝒌 )
𝜋1 = 𝑃𝐶𝑃 𝑥1 , 𝑤1
𝐴=
𝝅𝒊∗ = 𝑪∗ + ∑𝒊≠𝒊∗ 𝝅𝒊
⋮
𝜋𝑘 = 𝑃𝐶𝑃 𝑥𝑘 , 𝑤𝑘
𝐶∗ =
⊕
∑𝑖∈ 𝑘 𝜋𝜋𝑖𝑖
𝐶∗
𝑄
1. Generate PCP queries 𝑄
Soundness vs. Single-Deviation Provers
𝑽(𝒙𝟏 , … , 𝒙𝒊∗ , … , 𝒙𝒌 )
𝑷∗ (𝒙𝟏 , 𝒘𝟏 , … , 𝒙𝒊∗ , … . 𝒙𝒌 , 𝒘𝒌 )
𝜋1 = 𝑃𝐶𝑃 𝑥1 , 𝑤1
𝐴=
𝝅𝒊∗ = 𝑪∗ + ∑𝒊≠𝒊∗ 𝝅𝒊
𝑄
⋮
𝜋𝑘 = 𝑃𝐶𝑃 𝑥𝑘 , 𝑤𝑘
𝐶∗ =
𝐶∗
⊕
∑𝑖∈ 𝑘 𝜋𝜋𝑖𝑖
𝐴𝑄
1. Generate PCP queries 𝑄
2. Check that PCP verifier
accepts all 𝑘 statements.
3. Check 𝐴𝑄 consistent
with 𝐶.
Single-deviation 𝑃∗ must answers row 𝑖 ∗ by 𝝅𝒊∗
• 𝝅𝒊∗ defined before queries 𝑄 were specified
• PCP soundness ⇒ 𝑃∗ can’t cheat
Handling General Cheating Provers
For 𝑑 deviation prover: use “fancy” checksum of size 𝑑 × 𝑚.
Consider 𝑑 = 𝑘. Cheating prover has two options:
1. deviate on ≤ 𝑘 rows ⇒ 𝑑 deviation, we’re fine.
2. deviate on > 𝑘 rows ⇒ answers disagree with unique
PCPs of more than 𝑘Since
of rows.
there is a unique PCP – verifier
will notice deviation and reject
𝑉 selects 100 𝑘 rows at random and asks prover to send the
entire PCP for these rows.
Batch Verification for 𝐔𝐏
This gives 𝑘 multiplicative overhead. Can be
improved to polylog 𝑘 by recursion.
For batch verification of interactive proofs we
introduce interactive analogs of 𝐔𝐏 and 𝐏𝐂𝐏.
Constant-Round Doubly Efficient
Interactive Proofs
Theorem [RRR16]: ∃𝛿 > 0 s.t. every language
computable in poly(𝑛) time and 𝑛𝛿 space has an
unconditionally sound interactive proof where:
1. Verifier is (almost) linear time.
2. Prover is polynomial-time.
3. Constant number of rounds.
Open Problems
• Research directions:
– Bridge theory and practice.
– Sublinear time verification.
• Concrete questions:
– IP=PSPACE with “efficient” prover.
– Batch verification for all of NP.
– [GR17]: Simpler and more efficient protocols (even
for smaller classes).