Lite-PoT：实用的Powers-of-Tau设置仪式
Lite-PoT: Practical Powers-of-Tau Setup Ceremony
AI总结：
本文提出Lite-PoT，通过欺诈证明协议和证明聚合技术大幅降低Powers-of-Tau设置仪式的链上参与成本，在提升去中心化程度的同时实现了约16倍的规模改进。
摘要：
零知识简洁非交互式知识论证（zk-SNARK）方案因其效率而在隐私保护应用、去中心化系统（例如区块链）和可验证计算中获得了广泛采用。然而，最高效的zk-SNARK通常依赖于一次性可信设置来生成公共参数，通常被称为“Powers of Tau”（PoT）串。该串中秘密参数$τ$的泄露将允许攻击者生成虚假证明，从而破坏所有基于此构建的zk-SNARK系统的可靠性。\n 先前关于去中心化设置仪式的提案利用基于区块链的智能合约，允许任何参与方为$τ$贡献随机性，同时防止对贡献的审查。对于由$m$个贡献者的随机性生成的$d$次PoT串，这些解决方案总共需要$O(md)$次链上操作（即包括存储和密码学操作）。这些操作主要由昂贵的群运算组成，特别是配对曲线上的标量乘法，这阻碍了参与并限制了去中心化的效果。\n 在这项工作中，我们提出了Lite-PoT，它包含两个旨在降低参与成本的关键协议：(i) 一种欺诈证明协议，将每个贡献者昂贵的链上密码学群运算数量减少到$O(1)$。我们的实验结果表明（每次更新一笔交易），我们的协议支持最高$2^{15}$次PoT串的去中心化仪式，比现有的链上解决方案提高了约16倍；(ii) 一种证明聚合技术，将$m$个随机性贡献批量合并为一次链上更新，仅需$O(d)$次链上操作，与$m$无关。这通过摊销显著将链上更新的资金成本降低了$m$倍。
英文摘要：
Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARK) schemes have gained significant adoption in privacy-preserving applications, decentralized systems (e.g., blockchain), and verifiable computation due to their efficiency. However, the most efficient zk-SNARKs often rely on a one-time trusted setup to generate a public parameter, often known as the ``Powers of Tau" (PoT) string. The leakage of the secret parameter, $τ$, in the string would allow attackers to generate false proofs, compromising the soundness of all zk-SNARK systems built on it. Prior proposals for decentralized setup ceremonies have utilized blockchain-based smart contracts to allow any party to contribute randomness to $τ$ while also preventing censorship of contributions. For a PoT string of $d$-degree generated by the randomness of $m$ contributors, these solutions required a total of $O(md)$ on-chain operations (i.e., in terms of both storage and cryptographic operations). These operations primarily consisted of costly group operations, particularly scalar multiplication on pairing curves, which discouraged participation and limited the impact of decentralization In this work, we present Lite-PoT, which includes two key protocols designed to reduce participation costs: \emph{(i)} a fraud-proof protocol to reduce the number of expensive on-chain cryptographic group operations to $O(1)$ per contributor. Our experimental results show that (with one transaction per update) our protocol enables decentralized ceremonies for PoT strings up to a $2^{15}$ degree, an $\approx 16x$ improvement over existing on-chain solutions; \emph{(ii)} a proof aggregation technique that batches $m$ randomness contributions into one on-chain update with only $O(d)$ on-chain operations, independent of $m$. This significantly reduces the monetary cost of on-chain updates by $m$-fold via amortization.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
