Analgebraic execution trace of a program running forTsteps is represented by a w×Tarray in which each entry is an element of a finite field. A single row describes the state of the computation at a certain point in time, and a single column tracks a “register” and its contents over time. It is straightforward to reduce (instance,witness) pairs for a relation that defines a languageL∈NTimeSpace( ˆT(n),wˆ(n))toAIR instances with algebraic execution traces of sizeT(n) = O( ˆT(n))and widthw(n) = O( ˆw(n)), see, e.g., [90] for examples of such reductions.
Definition B.3 (Algebraic internal representation (AIR)). The relation RAIR is the set of pairs (x,w) =
(xAIR,wAIR)satisfying
• Fis a finite field
• Tis an integer representing a bound on running time • wis an integer representing state width
• P = {P1, . . . , Ps} ⊂ F[X1, . . . , Xw, Y1, . . . , Yw]is a set of constraints. The degree of P is
deg(P)4= maxP∈Pdeg(P)
• Cis a monotone boolean circuit over variablesZ1, . . . , Zswith multi-input AND and OR gates. Thesize of the circuit is the number of gates in it, and its degree, denoted deg(C) is defined inductively thus:
– the degree of the input variableZi isdeg(Zi) = deg(Pi), wherePi ∈ Pis defined above;
– the degree of an AND gategjwith input gatesg1, . . . , gtisdeg(gj) = max{deg(g1,), . . . ,deg(gt)} – the degree of an OR gategjwith input gatesg1, . . . , gtisdeg(gj) = deg(g1)+. . .+deg(gt)
– finally,deg(C)is the degree of its (single) output gate.
• Bis a set of boundary constraints, where each boundary constraint is a tuple (i, j, α) fori ∈
[T], j ∈[w], α∈F
2. Witness Format: The witnesswis a set of functionsw1, . . . , ww : [T]→ F; we saywsatisfiesthe instance if and only if
(a) For all boundary constraints(i, j, α)we havewj(i) =α
(b) For allt∈[T−1]and we haveC(IsZeros(P(w[t], w[t+ 1]))) =TRUEwhere • w[t] = (w1(t), . . . , ww(t))
• IsZero : F → {TRUE,FALSE} is the mapping that sends0 ∈ F toTRUEand all non- zero elements toFALSE, andIsZerok:Fk → {TRUE,FALSE}kis the natural extension of
IsZeroto multiple inputs and outputs, namely,IsZerok(α1, . . . , αk) := (IsZero(α1), . . . ,IsZero(αk))
Finally,RAIRis the set of all pairs(x,w)such thatwsatisfiesx, andLAIR
4
={x| ∃w,(x,w)∈RAIR}. Remark B.4(Generalization to non-monotone circuits). The reason that we restrict the definition above to monotone circuits, as opposed to general circuit which are more expressive, is that adding negation gates to the boolean circuit may destroy perfect completeness, reduce efficiency, or require more rounds of interaction (depending on the way negation gates are arithmetized). Often (as is the case with our benchmarks here), it suffices to use De Morgan’s laws to effectively push negation gates to the inputs ofC and incorporate them into the system of polynomialsP.
Our reductions will useAIRs in whichF is invariably a binary field, and we shall further assume the witness size and degree are “binary friendly” according to the following definition.
Definition B.5(BAIR). AbinaryAIR(BAIR) instance is anAIRinstancex= (F,T,w,P,C,B)satisfying for somen,t,d ∈ N+(i) |
F| = 2n; (ii)T = 2t−1; and (iii)deg(C) ≤ 2d. We callxan(n,t,d)-BAIR instance. The relations RBAIR and languageLBAIR are the natural restriction of RAIR andLAIR to binary AIRinstances.
The following lemma implies Theorem 3.4, as shown in Appendix B.7. Its statement is “information theoretic”, i.e., relies on no unproven cryptographic assumptions and holds against computationally un- bounded provers. In contrast to prior ZK-IOP protocols [22, 15], it fully specifies all constants and uses no asymptotic notation.
Lemma B.6(wi-IOP of knowledge forRBAIR). For soundness error parameterλ:N+ →N+, rate integer
R ≥2, and ZK parameterk≥1, letδ= 1−2−R 1 + 2−d. Let relationR(λ,AIRR,k)denote the restriction ofRAIRto(n,t,d)-BAIRinstances that satisfy (i)n> λ+t+d+R+k+ 2and (ii)k+t≥6 + logλ+
log log 1
1−10δ . Then R
(λ,R)
AIR has a ZK-IOP of knowledge with the following parameters for(n,t,d)-BAIR instances:
• soundness error at mosterr= 2−λ
• knowledge error bound at most0 = 4·err • prover arithmetic complexity
tpF ≤(9w(t+d+R+ 3) +|P|+w+T
arith(P) + 12)·2t+d+R+3,
• verifier arithmetic complexity
tvF ≤2 |B|2+d λ+ 2 log1−δ/101 e ·(8(w+|Φ|+Tarith(P) +|B|) + 21(k+R+t+d+ 2)) ! , • round complexityr= t+2d+ 2, • query complexityq≤8d λ+2 log1−δ/110e ·(2w+k+t+d+ 2)
We conjecture that the soundness (of two separate components) in the IOP above is not tight. Con- sequently, we conjecture that the same soundness as above can be obtained with fewer queries, as stated next.
Lemma B.7(wi-IOP forRλBAIRwith improved conjectured soundness). Assuming Conjectures B.17 and B.19, the following holds. For soundness error parameterλ : N+ → N+, rate integerR ≥ 3, and ZK param- eter k ≥ 1, let relation R0AIR(λ,R,k) denote the restriction of RAIR to (n,t,d)-BAIR instances that satisfy (i) n > max{58, λ,t+d+R+k}+ 2 and (ii)k+t > 5 + logdλ+2R e. ThenR0AIR(λ,R) has a ZK-IOP of knowledge with the following parameters for(n,t,d)-BAIRinstances:
• soundness error and round complexity as stated in Lemma B.6, • verifier arithmetic complexity
tvF ≤2|B|2+dλ+ 2 R e ·(16(w+|Φ|+Tarith(P) + 42·(k+R+t+d+ 2))) • query complexityq≤4·dλ+2 R+de ·(w+ 3 +k+t+d) +d λ+2 R e ·(3w+ 3 +k+t+d)
• prover arithmetic complexity tpF≤ 9w(t+d+R+ 3) +|P|+w+Tarith(P) + 12d λ+ 2 n−(10 + 2 logn)e ·2t+d+R+3
Definition B.3 assumes that the full machine state is captured bywfield elements. Certain computations require as much space complexity as time complexity(w = Ω(T)), leading toAIRwitnesses of total size
Ω(w·T) = Ω(T2). To reach witnesses of sizeO(TlogT), irrespective of memory consumption, we require the following definition. It follows the approach of [19, 20] and uses apair ofAIR constraints — one for verifying the validity of consecutive time steps and another for verifying memory consistency; the latter set of constraints is applied to a permutation of the steps of the execution trace, and part of the witness is a specification of this permutation. We call this relation thepermuted algebraic intermediate representation (RPAIR).
Definition B.8(Permuted algebraic intermediate representation (PAIR)). The relation RPAIR is the set of pairs(x,w) = (xPAIR,wPAIR)satisfying
1. Instance Format:the instancexis a tuplex= (F,T,w,PT,Pπ,B)where • Fis a finite field
• Tis an integer representing a bound on running time • wis an integer representing state width
• PT,Pπ ⊂F[X1, . . . , Xw, Y1, . . . , Yw]are two sets of constraints.
• Bis a set of boundary constraints, where each boundary constraint is a tuple (i, j, α) fori ∈
[T], j ∈[w], α∈F
2. Witness Format:The witnesswis a pair( ˆw, π)wherewˆis a sequence ofwfunctionsw1, . . . , ww: [T]→
F, andπ: [T]→[T]is a permutation; we saywsatisfiesthe instance if and only if (a) For all boundary constraints(i, j, α)we havewj(i) =α
(b) For allt∈[T−1]and for allP ∈ PTwe haveP(w[t], w[t+ 1]) = 0 (c) For allt∈[T−1]and for allP ∈ Pπ we haveP(w[t], w[π(t)]) = 0
Finally,RPAIRis the set of all pairs(x,w)such thatwsatisfiesx, andPAIR
4
={x| ∃w,(x,w)∈RAIRwRAM}. We define the sub-relation of binary PAIR (BPAIR) analogously to the definition of binary AIR in Definition B.5.
LPAIRisNEXP-complete, as stated next. We omit the proof, which appears, e.g., in [90].
Lemma B.9 (wi-STIK for BPAIR). For every language L ∈ NTIME(T(n)), T(n) ≥ n there exists a deterministic polynomial time reduction from LtoLPAIR, mapping an instance xofLto an instance x =
(F,T,w,PT,Pπ,B)ofLPAIRthat satisfies • T=O(T(n)),
• w=O(logT(n)),
• deg(PT∪ Pπ) =O(1),|PT∪ Pπ|=O(logT(n)), andTarith(P) =O(logT(n)), • |B|=O(n).
Furthermore, a nondeterministic witnesswforxcan be computed in timeO(T(n) logT(n)) +nO(1), given