第 5 课 补充讲义 ​

Modern SNARKs consist of two components: an information-theoretic interactive oracle proof (IOP) [1]; and a compatible cryptographic commitment scheme, which "compiles" the IOP into an argument system [5]. This note introduces several commonly used commitment schemes.

An IOP is "information-theoretic" in that it provides soundness and zero-knowledge guarantees even when the prover and verifier are computationally unbounded. To make this possible, the proof system makes the idealised assumption of "oracle access": in other words, the verifier can only access the prover's messages through random queries.

The commitment scheme instantiates this oracle access using cryptographic primitives (e.g. a one-way function): as a consequence, the resulting argument system is only secure with respect to a computationally bounded prover and/or verifier. To realise a succinct argument system, the chosen commitment scheme must provide low communication complexity relative to the computation being proven.

Figure 1: A $k$-round interactive oracle proof system. In the $i$-th round: the verifier $\mathcal{V}$ sends a message $m_i$ to the prover $\mathcal{P}$; then, $\mathcal{P}$ replies with a message $f_i$, which $\mathcal{V}$ can query (via random access) in this and all later rounds. After the $k$ rounds of interaction, $\mathcal{V}$ either accepts or rejects.

Definition 1.1 (Commitment scheme). A commitment scheme is a tuple $\mathrm{\Gamma }=$ (Setup, Commit, Open) of PPT algorithms where:

• $\mathrm{Setup}\left(1^{\lambda }\right)\to \mathrm{pp}$ takes security parameter $\lambda$ (in unary) and generates public parameters $\mathrm{pp}$;

• Commit $(\mathrm{pp};m)\to (C;r)$ takes a secret message $m$ and outputs a public commitment $C$ and (optionally) a secret opening hint $r$ (which might or might not be the randomness used in the computation).

• Open $(\mathrm{pp},C;m,r)\to b\in \{0,1\}$ verifies the opening of the commitment $C$ to the message $m$ provided with the opening hint $r$.

A commitment scheme $\mathrm{\Gamma }$ is binding if for all $\mathrm{PPT}$ adversaries $\mathcal{A}$ :

Informally, this states that a valid commitment $C$ to a message $m_0$ is binding if no adversary can produce a valid opening to some different message $m_1$.

A commitment scheme $\mathrm{\Gamma }$ is hiding if for any polynomial-time adversary $\mathcal{A}$ :

Informally, this states that if a commitment is hiding if an adversary cannot "reverse-engineer" which of their messages was committed to.

Recall: "locked boxes". [Lecture 3: "Mathematical Building Blocks"]

In the Hamilton cycle example, we use a collision-resistant hash function to construct our commitment scheme:

• $r\leftarrow \{0,1{\}}^{256}$ is a randomly sampled secret key that is input to the hash function.

• Commit: hash $(m;r)=h$.

• Open : check $h\stackrel{?}{=}\mathrm{hash}(m;r)$.

A vector commitment scheme [2] for the message space $M$ is a commitment scheme for a vector $\overrightarrow{m}=(m_1,\dots ,m_k)\in {\mathrm{M}}^k$. The main security property for a vector commitment is position binding:

Definition 2.1 (Position binding). A vector commitment scheme $\mathrm{\Gamma }$ is position binding if for any PPT adversary $\mathcal{A}$ :

Informally, this states that no adversary can open $C$ to two different values at the same position.

Vector Pedersen commitment. The Pedersen commitment [9] is a binding and hiding commitment scheme for the message space ${\mathbb{F}}_q$. For a secret message $m\in {\mathbb{Z}}_q$ :

• Pedersen.Setup $(1^{\lambda },q)\to \mathrm{pp}:\mathrm{pp}=G,H\in \mathbb{G}$, where $\mathbb{G}$ is a cryptographic group of order $q$.

• Pedersen.Commit $(\mathrm{pp};m)\to (C;r):C=[m]G+[r]H$, where $r\in {\mathbb{Z}}_q$ is a random secret.

• Pedersen.Open $(\mathrm{pp},C;m,r)\to \{0,1\}:$ the prover $\mathcal{P}$ reveals $m$ and $r$, and the verifier $\mathcal{V}$ checks $C\stackrel{?}{=}[m]G+[r]H$

Note that the Pedersen commitment is additively homomorphic:

We can extend the Pedersen commitment scheme to get VectorPedersen over vectors in the message space ${\mathbb{F}}_q^k$. For a message $\overrightarrow{m}=(m_0,\dots ,m_{k-1})$ :

• VectorPedersen.Setup $(1^{\lambda },q,k)\to \mathrm{pp}:\mathrm{pp}=(G_0,\dots ,G_{k-1}),H\in \mathbb{G}$, where $\mathbb{G}$ is a cryptographic group of $\mathrm{order}q$.

• VectorPedersen.Commit $(\mathrm{pp};\overrightarrow{m})\to (C;r):C=[r]H+\sum _{i=0}^{k-1}\left[m_i\right]G_i$, where $r\in {\mathbb{Z}}_q$ is a random secret.

• VectorPedersen.Open $(\mathrm{pp},C;\overrightarrow{m},r)\to \{0,1\}:$ the prover $\mathcal{P}$ reveals $m$ and $r$, and the verifier $\mathcal{V}$ checks $C\stackrel{?}{=}[r]H+\sum _{i=0}^{k-1}\left[m_i\right]G_i$

Merkle tree. A well-known solution for building vector commitments is a Merkle tree [8]. It is used in distributed systems like Git, Cassandra, and Bitcoin for summarizing sets of data. Merkle trees also have hiding and extractability properties, which make them an ideal candidate for compiling an IOP into a non-interactive proof secure in the random oracle model [1].

Figure 2: Each inner node of a Merkle tree is the hashed value of its two children.

• Merkle.Commit $(\mathrm{pp};\overrightarrow{m})\to C$ : for each $m_i\in \overrightarrow{m}$, compute a hash $h_i=\mathrm{Hash}\left(m_i\right)$. Compute the inner nodes of the Merkle tree $h_{ij}=\mathrm{Hash}(h_i,h_j)$. Output $C=\mathrm{root}=h_{1q}$.

• Merkle. Open $(\mathrm{pp},C,\overrightarrow{m},i)\to b\in \{0,1\}$ :

a) the prover $\mathcal{P}$ computes the path of inner nodes from $h_i$ to root, and $\pi =(m_i,path)$;

b) the verifier $\mathcal{V}$ checks that root can be recovered by hashing $m_i$ with path.

A univariate polynomial commitment scheme is a commitment scheme for the message space ${\mathbb{F}}^{\le d}[X]$, the ring of univariate polynomials with maximum degree $d\in \mathbb{N}$ and coefficients in the field $\mathbb{F}={\mathbb{Z}}_p$

It supports an argument of knowledge for proving the correct evaluation of a committed polynomial at a given point. A lot of information can be encoded in a polynomial: we will see in Lecture 7 ("Arithmetizations") and Lecture 8 ("PlonK and polynomial identities") how an arbitrary relation can be represented as a polynomial.

KZG commitment scheme [6]. This is used in protocols like Sonic [7], Marlin [3], and PlonK [4]. (Marlin and PlonK improve on Sonic by constructing a different polynomial IOP.)

Recall: Pairing-based cryptography. [Lecture 3: "Mathematical Building Blocks"]

Given cyclic groups ${\mathbb{G}}_1,{\mathbb{G}}_2,{\mathbb{G}}_T$, all of the same prime order $p$, a pairing is a nondegenerate bilinear map

a) bilinear: $e([a]P,[b]Q)=e(P,Q{)}^{a\cdot b}$

b) nondegenerate: with generators $G_1\in {\mathbb{G}}_1$ and $G_2\in {\mathbb{G}}_2,G_T:=e(G_1,G_2)\in {\mathbb{G}}_T$ is a generator.

In this lecture, we will use the shorthand notation $[x{]}_1:=[x]G_1,[x{]}_2:=[x]G_2$, for any $x\in {\mathbb{F}}_p$.

• KZG.Setup $(1^{\lambda },d)\to$ srs: set srs $=(\mathrm{ck},\mathrm{vk})=({\left\{{\left[{\alpha }^i\right]}_1\right\}}_{i=0}^{d-1},[\alpha {]}_2).\alpha$ here is a secret element and must be discarded after the Setup.

• KZG.Commit $(\mathrm{ck};f(X))\to C:$ for $f(X)=\sum _{i=0}^{n-1}{f}_i{X}^i,C=\sum _{i=0}^{n-1}\left[f_i\right]{\left[{\alpha }^i\right]}_1=[f(\alpha ){]}_1$.

• KZG.Open(srs, $C,x,y;f(X))\to \{0,1\}$ : To "open" the commitment at evaluation point $x$ to a claimed value $y$

a) the prover $\mathcal{P}$ computes the quotient polynomial $q(X)=\frac{f(X)-y}{X-x}$ and sends the verifier $\pi =\mathrm{KZG}\cdot$ Commit $($ ck; $q(X))=[q(\alpha ){]}_1$

b) the verifier $\mathcal{V}$ checks $e(C-[y{]}_1,H)\stackrel{?}{=}e(\pi ,[\alpha {]}_2-[x{]}_2)$.

The a) and b) steps in KZG.Open are often written as two separate algorithms:

• Open $(\mathrm{ck},C,x,y;f(X))\to \pi$ returns an opening proof for the relation

• Verify $(\mathrm{vk},C,x,y,\pi )\to \{0,1\}$ verifies the opening proof's correctness.

This note hopes to serve as a high-level introduction to commitment schemes, and where they fit in the construction of modern SNARKs. Below are a few excellent resources for further understanding and comparing commitment schemes:

• polynomial commitments: building block for universal SNARKS (Justin Drake): includes a taxonomy of polynomial commitment schemes based on the cryptographic primitives used (hash functions, pairing group, unknown order group, and discrete log group). (Parts $[1],[2]$, and $[3]$.

• KZG polynomial commitments (Dankrad Feist): an introduction to the KZG polynomial commitment scheme, and how to extend it to multiproofs and vector commitments.

• Inner Product Arguments (Dankrad Feist): an introduction to the inner product argument (IPA) protocol, a primitive that can be used to build a polynomial commitment scheme. The IPA is often instantiated with the vector Pedersen commitment scheme.

• bulletproofs: :notes : inner_product_proof excellent write-up on IPA.

• Anatomy of a STARK, Part 3: FRI (Alan Szepieniec): an introduction to the FRI (Fast Reed-Solomon IOP of Proximity) protocol, an oracle proof of proximity. The STARK polynomial IOP instantiates FRI with Merkle trees.

• Linear commitments work over linear functions. (Note that a polynomial commitment is a special form of a linear commitment, since $p(X)=\sum p_i{x}^i$ can be written as the dot product of two vectors $(p_0,\dots ,p_{d-1})$ and $(1,x,\dots ,x^{d-1})$.) These are used in constructions like Vortex (lattice-based), Brakedown, and Orion.

• Multilinear commitments work over multivariate linear polynomials. They can be used to instantiate the sumcheck protocol, an interactive proof (IP) which is by itself neither zeroknowledge nor succinct for NP statements. zk-SNARKs which use the sumcheck protocol with multilinear commitment schemes include: Hyrax, Libra, Virgo, and Spartan.

• arkworks-rs/poly-commit: a Rust library supporting four polynomial commitment schemes.

• Polynomial Commitment Benchmark (Remco Bloemen): benchmarks for the Commit algorithm in implementations of KZG, IPA-based, and FRI-based polynomial commitment schemes.