基于QAP的zk-SNARKs中的多方证明生成
Multi-Party Proof Generation in QAP-based zk-SNARKs
摘要：
零知识简洁非交互式知识论证（zkSNARK）允许一方（称为证明者）说服另一方（称为验证者）他知道私有值$v$，而不透露它，使得对于某些函数$F$和公共值$u$和$y$，$F(u,v)=y$。zk-SNARK有各种版本，其中基于二次算术程序（QAP）的zk-SNARK在实践中得到了广泛的应用，特别是在区块链技术中。这归因于两个理想的功能;其固定大小的证明和验证器的计算负载非常轻。然而，基于QP的zkSNARKs中的证明器的计算负载非常重，即使它被设计为非常高效。这种负载可能超出证明器的计算能力，必须卸载到一些外部服务器。在现有的卸载解决方案中，（i）卸载到每个服务器的计算负载是证明器的主要计算的一部分（例如，DZIK），但是服务器需要被信任，（ii）服务器不需要被信任，但是施加给每个服务器的计算复杂度与证明器的主要计算相同（例如，Trinocchio）。在本文中，我们提出了一个方案，它具有这两种解决方案的好处。特别是，我们提出了一个安全的多方证明生成算法，证明者可以将其任务委托给$N $服务器，其中（i）即使一组$T \in \mathbb{N}$服务器，$T\le N$，串通，他们不能获得任何信息的秘密值$v$，（ii）每个服务器的计算复杂度小于证明者的主要计算的$1/(N-T)$。这种设计使得我们在将任务委托给外部服务器的过程中不会失去证明器算法的效率。
英文摘要：
Zero-knowledge succinct non-interactive argument of knowledge (zkSNARK) allows a party, known as the prover, to convince another party, known as the verifier, that he knows a private value $v$, without revealing it, such that $F(u,v)=y$ for some function $F$ and public values $u$ and $y$. There are various versions of zk-SNARK, among them, Quadratic Arithmetic Program (QAP)-based zk-SNARK has been widely used in practice, specially in Blockchain technology. This is attributed to two desirable features; its fixed-size proof and the very light computation load of the verifier. However, the computation load of the prover in QAP-based zkSNARKs, is very heavy, even-though it is designed to be very efficient. This load can be beyond the prover's computation power to handle, and has to be offloaded to some external servers. In the existing offloading solutions, either (i) the load of computation, offloaded to each sever, is a fraction of the prover's primary computation (e.g., DZIK), however the servers need to be trusted, (ii) the servers are not required to be trusted, but the computation complexity imposed to each one is the same as the prover's primary computation (e.g., Trinocchio). In this paper, we present a scheme, which has the benefits of both solutions. In particular, we propose a secure multi-party proof generation algorithm where the prover can delegate its task to $N $ servers, where (i) even if a group of $T \in \mathbb{N}$ servers, $T\le N$, collude, they cannot gain any information about the secret value $v$, (ii) the computation complexity of each server is less than $1/(N-T)$ of the prover's primary computation. The design is such that we don't lose the efficiency of the prover's algorithm in the process of delegating the tasks to external servers.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
