\(\textsf{Justvengers}\) : Batched VOLE ZK Disjunctions in \({\mathcal {O}}(R{+}B{+}C)\) Communication
摘要
Recent progress on zero-knowledge proofs (ZKPs) based on vector oblivious linear evaluation (VOLE) offers a promising paradigm for scaling ZKPs over extremely large statements. In particular, VOLE-based ZK is currently the best choice in terms of end-to-end execution time. However, VOLE-based ZK incurs high communication overhead—it usually scales linearly with the circuit size. To mitigate this, existing literature considers VOLE-based ZK over structured statements. In this work, we focus on the batched disjunctive statement— \(\mathcal {P}\) and \(\mathcal {V}\) agree on B fan-in 2 circuits \(\mathcal {C} _1, \ldots , \mathcal {C} _{B}\) over a field \(\mathbb {F}\) ; each circuit is of size C with \(n_{ in }\) inputs. \(\mathcal {P}\) ’s goal is to demonstrate the knowledge of R witnesses \(( id _j \in [B]\) , \(\boldsymbol{w}_j \in \mathbb {F}^{n_{ in }})\) for each \(j \in [R]\) s.t. \(\forall j \in [R], \mathcal {C} _{ id _j}(\boldsymbol{w}_j) = 0\) where neither \(\boldsymbol{w}_j\) nor \( id _j\) is revealed. Batched disjunctive statements are effective, e.g., in emulating the CPU execution inside ZK. Note, the naïve solution results in a circuit of size \({\mathcal {O}}(RBC)\) . To prove such a statement using VOLE-based ZK, the prior state-of-the-art protocol \(\textsf{Antman}\) (Weng et al., CCS’22) incurred \({\mathcal {O}}(BC + R)\) communication by additionally relying on AHE, whereas \(\textsf{Batchman}\) (Yang et al., CCS’23) achieved \({\mathcal {O}}(RC + B)\) communication using only VOLE. In this work, we combine these two protocols non-trivially and present a novel protocol \(\textsf{Justvengers}\) —targeting the batched disjunctive statement—that incurs only \({\mathcal {O}}(R + B + C)\) communication and \({\mathcal {O}}(BC + (B + C)R\log R)\) computation for prover, using AHE and VOLE. As in \(\textsf{Antman}\) , \(\textsf{Justvengers}\) requires an AHE scheme that achieves linear targeted malleability, which is a non-falsifiable assumption.