Streaming Authenticated Data Structures

Abstract

Abstract. We consider the problem of streaming verifiable computation, where both a verifier and a prover observe a stream of n elements x1, x2, . . . , xn and the verifier can later delegate some computation over the stream to the prover. The prover must return the output of the computation, along with a cryptographic proof to be used for verifying the correctness of the output. Due to the nature of the streaming setting, the verifier can only keep small local state (e.g., logarithmic) which must be updatable in a streaming manner and with no interaction with the prover. Such constraints make the problem particularly challenging and rule out applying existing verifiable computation schemes.We propose streaming authenticated data structures, a model that enables efficient verification of data structure queries on a stream. Compared to previous work, we achieve an exponential improvement in the prover's running time: While previous solutions have linear prover complexity (in the size of the stream), even for queries executing in sublinear time (e.g., set membership), we propose a scheme with O(log M log n) prover complexity, where n is the size of the stream and M is the size of the universe of elements. Our schemes support a series of expressive queries, such as (non-)membership, successor, range search and frequency queries, over an ordered universe and even in higher dimensions. The central idea of our construction is a new authentication tree, called generalized hash tree. We instantiate our generalized hash tree with a hash function based on lattices assumptions, showing that it enjoys suitable algebraic properties that traditional Merkle trees lack. We exploit such properties to achieve our results.

Practical dynamic proofs of retrievability

“…The reason for that is that our homomorphic checksum construction is designed for performance. In comparison, publicly verifiable homomorphic checksums (e.g., lattice-based ones [19] or RSA-based ones [5]) are not as efficient practice.…”

Efficient Verifiable Range and Closest Point Queries in Zero-Knowledge

“…We note that range query is not to be confused with range proof [8] where the goal is to prove that the committed value lies in a specified integer range without revealing it. Authenticated data structures (ADS) [14,21,35,36,38,42] are often set in the three party model with a trusted owner, a trusted client and a malicious server; the owner outsources the data to the server and later the client interacts with the server to run queries on the data. The security requirement of such constructions is data authenticity for the client against the server.…”

Authenticated Hash Tables Based on Cryptographic Accumulators

“…As shown in [52], these bounds are optimal for hash-based methods. Variations of this approach and extensions to other types of queries have also been investigated (e.g., [9,13,21,25,28,42,53]). Solutions for authenticated membership queries using one-way accumulators were introduced by Benaloh and de Mare [5].…”

“…Developing secure protocols for hash tables that authenticate (non-)membership queries in constant time has been a long-standing open problem [36]. Using collisionresistant hashing and Merkle's tree construction [33] to produce the set digest, (non-)membership queries in sets can be authenticated with logarithmic costs (e.g., [6,23,36,42,43,53]). One can achieve complexities better than logarithmic by using alternative cryptographic primitives.…”