UltraGroth

Challenge rounds in Groth16-like system

This is a continuation and clarification of my previous post which was a very rough description of a possible scheme of adding lookups (and any other challenge arguments) to Groth16.

It generated some traction and comments. Mainly I would like to thank Weikeng Chen who gave me some references on similar approaches (based on LegoSNARK), and confirmed that it should be possible to get rid of all interfacing between different argument systems (which loosely works similar to Pinoccio), instead using a singular Groth16-styled equation.

It seems that it is, indeed, possible. I describe the protocol here, and provide a sketch of proof.

Let's recall normal Groth16 protocol, first

This turned out to be quite long, tbh. Can be skipped, but it makes sense to look on zero-knowledgness / soundness proofs here to make sense of my arguments for the UltraGroth.

R1CS

In normal Groth16, we start from a rank 1 constraint system, R1CS:

$Lw\circ Rw=Ow$

Here,

$L,R,O$ are matrices of size

$m\times n$, where

$m$ is a size of a witness vector

$w^i$, and

$n$ is the amount of constraints, and

$\circ$ is a Hadamard product.

Individual constraints, thus, correspond to the rows of the matrix:

$L^{i}w\ast R^{i}w=O^{i}w$

$(\sum _j{L}_j^i{w}^j)\ast (\sum _j{R}_j^i{w}^j)=\sum _j{O}_j^i{w}^j$

Some subset of indices of the witness, is also called "public inputs", and will be exposed by the proof, and all others are private.

Now, we map the set of constraints to some set

$S$ in the scalar field of a pairing-friendly curve - I will denote

$x_i$ the point corresponding to the constraint

$i$.

$Z(x)=\prod _i(x-x_i)$ denotes the vanishing polynomial of this set, and we also define

$L_j(x),R_j(x),O_j(x)$ by their Lagrange interpolation of the values over the set:

$L_j(x_i)=L_j^i$ (and the same for

$R,O$).

Then, the R1CS problem can be reformulated as finding such witness vector

$w^j$ that

$(\sum _j{w}_j{L}_j(x))(\sum _j{R}_j(x))-(\sum _j{O}_j(x))$ vanishes on

$S$, <=> divisble by

$Z(x)$, <=> there exists such

$H(x)$ (of degree at most

$n$) that:

$L(x)R(x)-O(x)=Z(x)H(x)$
where

$L=\sum _j{w}_j{L}_j(x)$

$R=\sum _j{w}_j{R}_j(x)$

$O=\sum _j{w}_j{O}_j(x)$

Groth16 argument

Now, lets recall how this problem is turned into a zk-proof.

We have the following toxic waste elements:

$(\alpha ,\beta ,\gamma ,\delta ,\tau )$, and the reference string is computed as follows:

$[\alpha {]}_1,[\beta {]}_1,[\beta {]}_2,[\gamma {]}_2,[\delta {]}_1,[\delta {]}_2$,
for

$0\le k\le n:$

$Z_k=[\frac{{\tau }^{k}Z(\tau )}{\delta }{]}_1$ <– these will allow us to compute

$[\frac{H(\tau )Z(\tau )}{\delta }{]}_1$

$A_j=[L_j(\tau ){]}_1,B_j=[R_j(\tau ){]}_2$,

$B_j^{\prime }=[R_j(\tau ){]}_1$
for

$j\in \text{priv}:$

$C_j=[\frac{O_j(\tau )+\beta L_j(\tau )+\alpha R_j(\tau )}{\delta }{]}_1$
for

$j\in \text{pub}:$

$C_j=[\frac{O_j(\tau )+\beta L_j(\tau )+\alpha R_j(\tau )}{\gamma }{]}_1$

[…]

The Groth16 prover (given the solution to R1CS in the polynomial form described above) creates two random blinding scalars

$r,s$ and computes the following:

$A=[\alpha {]}_1+\sum _j{w}_j{A}_j+r[\delta {]}_1$

$B=[\beta {]}_2+\sum _j{w}_j{B}_j+s[\delta {]}_2$,

$B^{\prime }=[\beta {]}_1+\sum _j{w}_j{B}_j^{\prime }+s[\delta {]}_1$

$C=\sum _{j\in \text{priv}}{w}_j{C}_j+\sum h_k{Z}_k+r{B}^{\prime }+sA-rs[\delta {]}_1$

and

$IC$ is computed from public inputs by both sides:

$IC=\sum _{j\in \text{pub}}{w}_j{C}_j$

And the verifier does the following check:

$⟨A,B⟩=⟨[\alpha {]}_1,[\beta {]}_2⟩+⟨C,[\delta {]}_2⟩+⟨IC,[\gamma {]}_2⟩$

Why this holds for a valid R1CS instance

Let's see why this works:

First, unwind this check to see that it passes. I will calculate LHS and RHS (and abuse notation a bit to calculate by omitting casting it to multiplication group

$[{]}_m$ everywhere). I will also use "A, B, C" as shorthands of their dlogs as scalars.

LHS:

$AB=(\alpha +\sum _j{w}_j{L}_j(\tau )+r\delta )(\beta +\sum _j{w}_j{R}_j(\tau )+s\delta )$

RHS:

$\alpha \beta +C\delta +IC\gamma =\alpha \beta +\sum _j{w}_j(O_j(\tau )+\beta L_j(\tau )+\alpha R_j(\tau ))+H(\tau )Z(\tau )+r\delta B+s\delta A-rs{\delta }^2$

Now, small modification of LHS makes clear that all terms with

$\delta$ will cancel out:

LHS:

$AB=sA\delta +rB\delta -rs{\delta }^2+(\alpha +\sum _j{w}_j{L}_j(\tau ))(\beta +\sum _j{w}_j{R}_j(\tau ))$.

The rest is direct inspection.

Zero-knowledge

Now, let's recall why this is perfectly zero-knowledge, and why this is computationally sound in algebraic group model.

Zero-knowledge: it is clear that

$A,B$ are uniformly distributed (because prover adds up random uniformly distributed elements

$r[\delta {]}_1,s[\delta {]}_2$).

$C$ is uniquely defined if other variables are fixed (because it is a linear equation), and, therefore, the probability distribution of proofs on a space of solutions of this equation is uniformly random.

Note: even a stronger fascinating property, re-randomizability, holds. It means that having a correct proof triple (A, B, C) one can construct a new proof (A', B', C') uniformly randomly distributed in the space of all proofs, without knowing the original witness. This property will, sadly, be broken in my extended UltraGroth protocol.

Soundness in Algebraic Group Model

Soundness in AGM: I won't go into details of AGM, but this has the following intuition: imagine that

$\alpha ,\beta ,\gamma ,\delta ,\tau$ are variables (i.e. we now calculate in a rational function ring depending on this variables). The adversary then tries to construct a proof, with

$A$ and

$C$ being linear combination of expressions

$\alpha ,\beta ,\delta ,\frac{{\tau }^{k}Z(\tau )}{\delta },L_j(\tau ),R_j(\tau )$, for

$j\in \text{priv}:$

$\frac{O_j(\tau )+\beta L_j(\tau )+\alpha R_j(\tau )}{\delta }$, for

$j\in \text{pub}:$

$\frac{O_j(\tau )+\alpha R_j(\tau )+\beta L_j(\tau )}{\gamma }$

and

$B$ being linear combination of

$\beta ,\delta ,\gamma ,R_j(\tau )$

And let's assume they succeed, i.e. the expressions satisfy

$AB=\alpha \beta +C\delta +IC\gamma$

First, let's notice that

$A$ must contain

$\alpha$ and

$B$ must contain

$\beta$. Moreover, let's wlog rescale them in such a way that both of these are with coefficient

$1$.

Ocurrence of

$\beta$ in

$A$ is then prohibited due to the fact that

${\beta }^2$ can not occur on RHS.

Now, let's see that in

$A$ there should be no terms with

$\delta$ or

$\gamma$ in denominator. Indeed, if there were, their products by

$\beta$ would not be cancelled by anything in LHS, and neither in RHS (because RHS doesn't have a pole at

$\delta =0$).

Let us also notice that occurence of

$\gamma$ in

$B$ is unwelcome because

$\gamma \alpha$ can not occure in RHS.

Therefore, we are in a situation where

$A=\alpha +\sum a_j{L}_j(\tau )+\sum q_j{R}_j(\tau )+r\delta$ and

$B=\beta +\sum b_j{R}_j(\tau )+s\delta$. We have neither shown that

$a_j\ne b_j$ yet, nor

$q_j=0$, nor stated anything about

$C$.

WLOG, lets modify

$A$ and

$B$ by removing

$r\delta$ and

$s\delta$, and

$C$ by subtracting

$sA$,

$rB$ and adding

$rs\delta$. We have successfully exiled

$\delta$ from LHS, now it has the form:

$A=\alpha +\sum a_j{L}_j(\tau )$

$B=\beta +\sum b_j{R}_j(\tau )+\sum q_j{L}_j(\tau )$

In this form, appeareance of any nonzero

$L_j(\tau )$,

$R_j(\tau )$ or

$\alpha$ or

$\beta$ in

$C$ is strictly prohibited - it will lead to occurence of the uncancelled term divisible by

$\delta$ in RHS.

The terms with

$\gamma$ in numerator are also banned in

$C$ for trivial reasons.

Hence,

$C$ has the following form:

$C=\sum _{j\in \text{priv}}{c}_j\frac{O_j(\tau )+\beta L_j(\tau )+\alpha R_j(\tau )}{\delta }+\sum h_k\frac{Z(\tau ){\tau }^k}{\delta }$.

Wlog, assume that there is no linear dependencies between nonzero

$L_j(\tau )$-s and

$R_j(\tau )$-s (separately). If there were, we could use them to make some of the coefficients vanish, and proceed in such assumption.

Assume also wlog that in such form no linear combination of

$L_j(\tau )$-s occuring in

$B$ can be expressed as a sum of

$R_j$-s - if it was, make such substitution in

$B$ to increase the amount of vanishing coefficients, and proceed.

Now, we want to show that after such transformations

$q_j=0$, and

$a_j=b_j=c_j$. Indeed, grabbing all terms with

$\beta$, we see that RHS contains

$\sum c_j\beta L_j(\tau )$ and LHS contains

$\sum a_j{L}_j(\tau )$, which implies

$a_j=c_j$ using the fact that we don't have non-trivial linear combinations.

Similarly, all terms with

$\alpha$ yield in RHS contains

$\sum c_j\alpha R_j(\tau )$, and LHS contains

$\sum b_j\alpha R_j(\tau )+\sum q_j\alpha L_j(\tau )$. Due to our assumptions on absence of linear combinations, all

$q_j$ are forced to vanish,

$b_j=c_j$.

UltraGroth argument

Assume, that our R1CS circuit is endowed with the additional structure. I.e., private section of the set of indices

$1..n$ is separated into

$d+1$ parts,

${\text{round}}_0$, …,

${\text{round}}_d$. Additionally, some public inputs are called "challenges", and the set of challenges is separated into

$d$ parts. The vector space

$C^k$ will denote the space of challenges in round

$k$.

Let's define the space

$V^k$ as space of vectors with indices of nontrivial coeffs inside of

${\text{round}}_k$. The "old" witness then lives in

$\underset{k}{⨁}{V}^k\oplus \text{public inputs}$.

We define

$k+1$-st round strategy as a function

$F_k:C^k\times \underset{i\le k}{⨁}{V}^k\to V^{k+1}$

Strategy of

$0$-th round is just a vector in

$V^0$.

We will call a full witness the set of such strategies, for each round, which, while being used successively, succeed with overwhelming probability for random challenges.

Definition: Algebraic witness is a solution of R1CS over the field of rational functions on the space of challenges

${\mathbb{F}}_q(C)$, such that round k+1 witness depends only on challenges from rounds up to k.

Algebraic witness trivially implies the aforementioned strategy.

It is useful to think about algebraic witnessess, but likely not so useful to work with them in practice - computations in the field of rational functions are not that friendly. I believe the mentioned above general definition in terms of strategies is a more adequate abstractions; i.e. in practice the witness to the circuit will be a bunch of functions executing some computations on the already computed part of the witness vector.

---

Now, we will emulate the challenge responses of the verifier, using Fiat-Shamir heuristic. Let's construct the following toxic waste:

$\alpha ,\beta ,\gamma ,{\delta }_0,...,{\delta }_d,\tau$

and obtain the following reference string:
all as before, with

$\delta$'s known in both G1 and G2, and

$C_j$ for private indices being computed as for

$j\in {\text{round}}_k:$

$C_j=\frac{O_j(\tau )+\beta L_j(\tau )+\alpha R_j(\tau )}{{\delta }_k}$.

Now, for each round but the last, lets assume that the prover also exposes some point

$C^{(k)}$ to the verifier, and honest prover puts

$C^{(k)}=\sum _{j\in {\text{round}}_k}{w}_j{C}_j+r_k[{\delta }_d{]}_1$, with

$r_k$ being the blinding factor.

Verifier, then, sends the set of challenge inputs

$w_j|j\in {\text{chall}}_{k+1}$ by setting

${\text{acc}}_{k+1}=\text{Hash}({\text{acc}}_k,C^{(k)})$, and

$w_j=\text{Hash}(j,{\text{acc}}_{k+1})$.

!! Note: it is important that we can not just put challenge to be the hash of j and C^(k), without running the risk of prover retroactively rewinding previous rounds without changing C^(k), which might be possible in some cases.

After we have run such process non-interactively, we have obtained the full witness vector

$w$. We then do the same computation as in normal R1CS to obtain

$H(x)$.

Honest prover, then, picks two more random values

$r,s$, and sets the following:

$A=[\alpha {]}_1+\sum _j{w}_j{A}_j+r{\delta }_d$

$B=[\beta {]}_2+\sum _j{w}_j{B}_j+s{\delta }_d$

$IC=\sum _{j\in \text{pub}}{w}_j{C}_j$ - here as everywhere pub inputs include challenges
for k < d as before

$C^{(k)}=\sum _{j\in {\text{round}}_k}{w}_j{C}_j+r_k[{\delta }_d{]}_1$

$C^{(d)}=\sum _{j\in {\text{round}}_d}{w}_j{C}_j+\sum _{s\le n}{h}_s{Z}_s+sA+r{B}^{\prime }-\sum _{k<d}{r}_k[{\delta }_k{]}_1-rs[{\delta }_d{]}_1$

Then, the following equation (*) holds:

$⟨A,B⟩=⟨\alpha ,\beta ⟩+⟨IC,[\gamma {]}_2⟩+\sum _{k\le d}⟨C^{(k)},[{\delta }_k{]}_2⟩$

Full verification algorithm checks this equation, correctness of public input and correctness of challenges.

Why this equation holds

It is, in fact, a direct inspection. Only thing that sufficiently differs from normal Groth16 is the blinding factors. Let's see how it works: the factor

$r_k{\delta }_d$ from

$C^{(k)}$ is multiplied by

${\delta }_k$, which is exactly cancelled by the term

$-r_k{\delta }_k{\delta }_d$ coming from

$C^{(d)}$. The remaining blinding factors look exactly as in Groth16.

Zero knowledge

I claim that the honest verifier produces an uniformly random proof. Reason for this is the fact that

$A,B$ and

$C^{(k)}$ for k<d are all equidistributed, and

$C^{(d)}$ is then unique.

Soundness?

I feel a bit shaky here. Anyways, let's proceed and work in AGM + ROM for the hash. Then, we first prove the following lemma:

Lemma: Any solution to equation (*) is a valid solution to R1CS, and

$C^k$'s are binding commitments to the round witnesses.

The fact that solution to this equation in AGM leads to R1CS can be done with the following trick. Solution in AGM is solution in terms of some polynomials (i.e. treating toxic waste as variables). Let's substitute in this solution

${\delta }_k=\delta ,\mathrm{\forall }k$.
It is also easy to see that

$C^{(k)}$ are not allowed to contain any

$C_j$'s from different rounds as this leads to the uncancellable

$\frac{{\delta }_k}{{\delta }_s}$ factor (it can not come from RHS because

$A$ does no admit terms with nontrivial denominator, similar to the proof for normal Groth16). They might also contain some other terms, but because we don't know any linear dependencies between them, it is still a binding commitment.

$◻$.

Therefore, interactive protocol of communication with verifier (which we emulate by Fiat-Shamir) can be represented as follows: prover is providing some sequence of commitments to parts of the witness, and then generates a valid zk-proof with witness it had committed to.

I am not sure if I messed up here somewhere, requires proofread / review.