# Slide - UCL Computer Science

```Square Span Programs with Applications to
Succinct NIZK Arguments
George Danezis, University College London
Cédric Fournet, Microsoft Research
Jens Groth, University College London
Markulf Kohlweiss, Microsoft Research
Non-interactive zero-knowledge argument
Common reference string
Statement:  ∈
,  ∈
OK
Proof: 
Zero-knowledge:
Prover
Nothing but truth revealed
Soundness:
Verifier
Statement is true
Applications
NIZK arguments guarantee
honesty (soundness), yet
also preserve privacy (zeroknowledge)
Our contribution
• NIZK argument
– Perfect correctness
– Perfect zero-knowledge
– Computational soundness
• Knowledge extractor assumptions using pairings
• Conceptually simple
– New characterization of NP as Square Span Programs
• Small size
– Four group element proofs
Technical path
• Relation  for NP-language  given by circuit
1
2
3
4
• Characterize satisfiability of  as constraints
∈ {0,2}
• Rewrite constraints as square span program

divides
∑
2
−1
• Succinct NIZK argument for square span program
= (,  ,  , )
Example
• Consider circuit with single XOR-gate 0 = 1 ⊕ 2
• Satisfiability corresponds to the constraints
1 , 2 ∈ 0,1
1 + 1 + 2 ∈ {0,2}
• Which we can write
0 0 1
= 1, 1 , 2 2 0 1 ∈ 0,2 3
0 2 1
• This is satisfied if and only if for all columns
− 1
2
=1
Example continued
• Define
=  + 1  − 1  0  = − 2
1  = 1 −
2  = 1 +
• Chosen such that
0 −1 0 1
0 (0)
−1 −1 0
1 −1
1 1
1 (0) = 2
0 1
0
2 1
2 (−1) 2 (1) 2 (0)
• Then  − 1
divides
2
= 1 for all  if and only if
0  + 1 1  + 2 2
2
−1
• Using techniques presented later we can use the
latter equation in an NIZK argument
Characterizing circuit satisfiability as a set of
integer constraints

4
0
1
• Consider a circuit
2
with wires 0 , … ,  3
• The circuit is satisfiable if all wires  ∈ {0,1}, and
they respect all the gates, and the output is 1
• Write the wires as a vector  = 0 , 1 , … ,
The condition  ∈ 0,1 can be written  ∈ 0,1 +1
– Could omit trivial checks, e.g., we know 0 = 1 for satisfied
circuit and we may know some inputs 1 , … , ℓ ∈ {0,1}
Linearization of the gates
• Fan-in 2 gates can be linearized
– For the XOR-gate we have for , ,  ∈ {0,1}
⊕  =  if and only if  +  +  ∈ 0,2
– For the NAND-gate we have for , ,  ∈ 0,1
¬  ∧  =  if and only if  +  + 2c − 2 ∈ {0,1}
• In our paper we show that by multiplying some
equations by 2, we can write all non-trivial fan-in 2
gates on the form  +  +  +  ∈ {0,2}
Characterizing circuit satisfiability as
constraints on an affine map
• We write the gate equations in a matrix  such
that the wires respect the  gates if and only if
∈ 0,2
• Combined with the constraint  ∈ {0,1}+1 we get
the circuit is satisfiable if and only if
=  2| ∈ {0,2}++1
• The constants are small, so the equivalence with
circuit satisfiability also holds over  for  ≥ 8
Technical path
• Relation  for NP-language  given by circuit
1
2
3
4
• Characterize satisfiability of  as constraints
∈ {0,2}
• Rewrite constraints as square span program

divides
∑
2
−1
• Succinct NIZK argument for square span program
= (,  ,  , )
Square span program
• A square span program consists of polynomials
Two sequences of polynomials:
0  , … , ()
divides
, () with
()
< deg   =
∑ deg
⋅ ∑

sequences
polynomials
• We sayThree
a square
spanofprogram
over  accepts an
() divides ∑ℓ   ⋅ ∑   − ∑  ()
input 1 , … , ℓ ∈ 0,1 if and only if there exists
ℓ+1 , … ,  ∈  such that
2

divides

=0
−1
using 0 = 1
• We say a square span program accepts a language
From affine map constraints to SSPs
• Earlier
1
2
3
4
∈ {0,2} over
• Pick distinct points 1 , … ,  ∈
• Define   = ∏( −  )
• Define 0′ (), 1  , … ,  () such that
0 ′ 1 … 0 ′( )
⋮
⋱
⋮
=
(1 ) …  ( )
and 0  = 0′  − 1
Why does the square span program work?
• We want for all columns  that  ∈ {0,2} or
equivalently that  − 1 ∈ {−1,1} (over  )
• By the choice of polynomials 0  , … ,  () we
have ∑   =  − 0 1 =  − 1
• This gives us the condition ∑
• So  ∈ 0,2

2
=1
if and only if all  are roots in the
polynomial ∑
2
−1
• I.e.,   = ∏( −  ) divides
∑
2
−1
Technical path
• Relation  for NP-language  given by circuit
1
2
3
4
• Characterize satisfiability of  as constraints
∈ {0,2}
• Rewrite constraints as square span program

divides
∑
2
−1
• Succinct NIZK argument for square span program
= (,  ,  , )
Prime order bilinear groups
• Gen(1 ) generates (, G, G, G  , )
• G, G, G  finite cyclic groups of prime order
• Pairing : G × G → G
–
,
=  ,

– G =  , G =  , G  = 〈 ,  〉
• Deciding group membership, group operations,
and bilinear pairing efficiently computable
16
• Statement: (1 , … , ℓ ) accepted by SSP
• Common reference string: ,  ←

(, , … ,  ,  , ℓ+1  , … ,   ,   , ,  )
• Argument: Pick  ←  and compute ℎ() such that
ℎ    = ∑

+
2
Compute  = (,  ,  , ) as
= (∑>ℓ    +  )  = ℎ
=  ∑>ℓ    +
=  ∑
−1
+
• Verification: Compute  =  ∑≤ℓ     and check
,  =  ,
,  =   ,

,
= (, ) ,
−1
Succinct NIZK argument
•
•
•
•
Pinocchio
Argument: 8 elements
Perfect correctness
Computation: Better
when statements involve
Perfect zero-knowledge
Computational soundness additions or
– Assuming d-PKE, d-PDH, and d-TSDH
assumptions
fan-in 2 gates
since it is
Succinct
– 4 group elements ≈ 160 bytes arithmetic programs
• Efficient
– Prover: ( log ) multiplications and 3 exponentiations
– Verifier: ℓ + 1 multiplications and 6 pairings ≈ 6ms
Summary
• Introduced square span programs
– Conceptually simple type of quadratic span programs
• Showed they are NP-complete
1
2
3
4
∈ {0,2}

divides
• Succinct NIZK argument
– 4 group elements  = (,  ,  , )
∑
2
−1
```