Simulation-Extractable Polynomial Commitment via Segmented Proofs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing polynomial commitment schemes struggle to provide simulation-extractable evaluation proofs that are not malleable and non-randomizable, which is essential for building simulation-extractable SNARKs from polynomial IOPs.
Innovation Solution
A method is provided where a prover computes a base evaluation proof using a base proof function to show that a committed polynomial evaluates to a specific value at a given argument, and then generates a zero-knowledge second proof using a non-interactive zero-knowledge scheme to prove knowledge of the base evaluation proof, without revealing it to the verifier.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing polynomial commitment schemes are used, then commitment and proof generation are efficient, but evaluation proofs are malleable and randomizable which prevents simulation-extractability
Solution Approach 1:
The proof is divided into two distinct components: a base evaluation proof that verifies the polynomial evaluation, and a zero-knowledge proof that proves knowledge of the base proof without revealing it. This segmentation allows each component to serve its specific function while together they achieve simulation-extractability.
Solution Approach 2:
The base evaluation proof acts as an intermediary element that the zero-knowledge proof refers to without revealing. The ZK proof proves knowledge of this intermediate object, creating a layered structure that prevents direct manipulation while maintaining verification efficiency.
2Reliability
If evaluation proofs are made non-malleable and non-randomizable for simulation-extractability, then security against adaptive adversaries is improved, but proof generation and verification complexity increases
Solution Approach 1:
The proof structure dynamically adapts to the verification needs by using a base proof that can be efficiently verified and a ZK layer that provides the necessary security properties. This dynamic structure allows the system to maintain efficiency while achieving the required security guarantees.
Solution Approach 2:
The invention changes the parameters of the proof system by introducing a hybrid structure that combines traditional evaluation proofs with zero-knowledge proofs. This parameter change enables the system to achieve simulation-extractability while controlling complexity through careful design of the underlying cryptographic primitives.
3Reliability
If a base evaluation proof is computed and then a zero-knowledge proof of knowledge of the base proof is generated, then simulation-extractability is achieved, but the overall proof size and verification time increase
Solution Approach 1:
Instead of directly using the base proof, the system creates a zero-knowledge copy that proves knowledge of the base proof without revealing it. This copying mechanism allows the verification to proceed without exposing the actual base proof, achieving both security and efficiency.
Solution Approach 2:
The proof structure is nested with the zero-knowledge proof containing a reference to the base evaluation proof. This nested structure allows the verification to be performed in layers, where the outer ZK proof provides security guarantees while the inner base proof provides the computational foundation.
Data Source
Figure 1a~1b
Figure 2a~2b
Figure 3
AI summary
Some embodiments are directed to a method for cryptographically committing to a polynomial and for succinctly proving to a verifier an evaluation of the committed polynomial by means of a non-malleable proof. The method may include computing a base evaluation proof using a base proof function showing that a committed-to polynomial evaluates to a function value at a function argument, and further computing a zero-knowledge proof proving knowledge of the base evaluation proof satisfying a base verification equation corresponding to the polynomial.