Folding Custom Gates with Verifier Input

Aard Vark,Yan X Zhang
2024-01-21
Abstract:In the context of interactive proofs, a "folding scheme" (popularized by Nova) is a way to combine multiple instances of a constraint system into a single instance, so the validity of the multiple instances can statistically be reduced to the validity of a single one. We show how Nova folding can be generalized to ``custom'' gates and extra rounds of verifier randomness. As an application of this extension, we present Origami, the first (to our knowledge) known example of a folding scheme for lookups.
Cryptography and Security,Logic in Computer Science
What problem does this paper attempt to address?
The problem that this paper attempts to solve is in the fields of Interactive Proofs (IPs) and Zero - Knowledge (ZK), how to collapse the constraint systems of multiple instances (such as systems of polynomial equations) into a single instance, thereby reducing the resources required to verify the validity of multiple computations. Specifically, the paper aims to generalize existing folding schemes (such as Nova) to be applicable to custom gates and additional verifier input rounds. ### Background of Folding Schemes A folding scheme is a protocol that can aggregate multiple instances satisfying a certain arithmetization into a single instance. Arithmetization refers to embedding a computation into some algebraic constraint system, such as a polynomial or a linear equation. Through the folding scheme, multiple computations can be combined and verified all at once, thus significantly saving the resources for implementing the proof system. ### Main Objectives of the Paper 1. **Generalize the Nova - style Folding Scheme**: The paper shows how to generalize the Nova - style folding scheme to any polynomial "custom gate". A custom gate refers to a non - standard logic gate introduced in a circuit, and these gates can be represented by specific polynomials. 2. **Handle Additional Verifier Randomness**: The paper also extends the protocol so that it can handle the verifier randomness in the protocol with additional rounds. In this case, it is called custom gates with verifier input. 3. **Apply to Lookup Folding**: As an application of the above extensions, the paper introduces Origami, which is the first known lookup folding scheme. A lookup table is a mechanism for verifying whether certain values exist in a predefined set and is very useful in blockchain and cryptography applications. ### Technical Details To achieve these goals, the paper proposes the following technical details: - **Relaxed AIR Instances**: Relaxed AIR (Algebraic Intermediate Representation) instances are introduced, allowing the use of "slack terms" during the folding process, so that polynomial constraints can remain stable under random linear combinations. - **Commitment Mechanism**: A commitment scheme is used to ensure the security and non - tamperability of intermediate results. - **Single - step Folding Protocol**: A Single Fold Protocol is designed, allowing two relaxed AIR instances to be folded into one. - **Custom Gates with Verifier Input**: It is described in detail how to introduce the verifier's random challenges during the computation process and apply them to the folding of lookup tables. ### Conclusion Overall, this paper solves the problem of how to apply folding schemes in a broader range of scenarios, especially for custom gates and lookup tables. This not only expands the application scope of existing technologies but also provides new directions for future research.