How to delegate computations publicly

Fully-Succinct Publicly Verifiable Delegation from Constant-Size Assumptions

“…No-Signaling SSB Commitments and Succinct Pairing-based Quasi-Arguments. We follow and extend the ideas of Paneth and Rothblum [PR17] and Kalai et al [KPY19] for constructing delegation schemes for poly-time computations from what they called quasi-arguments of knowledge with no-signaling extractors. First, we formalize a similar notion for commitment schemes and show that the somewhere statistically binding (SSB) commitments of [GHR15b;FLPS20] are no-signaling when they also have what we call an "oblivious trapdoor generator".…”

“…AC stands for "Arithmetic Circuit" and RM for "RAM Machine". For [KPY19] we only consider the "base case" and not the "bootstrapped" constructions, because bootstrapping adds a considerable overhead and is thus incomparable in terms of group operations. We stress out, however, that the crs size of the bootstrapped construction is sublinear in the time of the computation.…”

“…An exception to this is a construction of Kalai et al [KPY19] of a delegation scheme for any poly-time computation based on a newly introduced 𝑞-size assumption in bilinear groups. The size of the assumption is 𝑞 = log 𝑇 and 𝑇 is the time needed to perform the computation.…”

Non-signaling proofs with o(√ log n) provers are in PSPACE

“…We next argue that despite this reduction in probability, Equations (13) and (14) hold. To this end, note that for every , ⊆ [ ] such that ⊂ and | | = | | − 1, and every ∈ Q and ∈ A, Note that Claim 3, together with the definition of {Sim (1) [ ], } and with Equation (19), implies that Equation (13) holds. Similarly, Claim 3, together with Equation (20), implies that Equation (14) holds, since…”

“…In [22], the same authors constructed an MIP that is secure against non-signaling attacks for every language in EXP, thus yielding the first one-round delegation scheme for all deterministic computations, under standard cryptographic assumptions. This application of non-signaling to computation delegation has proved to be very fruitful, and yielded numerous followup works (e.g., [2,5,18,19]). Moreover, all one-round delegation schemes in the literature that are based on standard cryptographic assumptions use the concept of non-signaling.…”