The GKR Protocol Revisited

Abstract

The proof-of-work interactive protocol by Shafi Goldwasser, Yael T. Kalai and Guy N. Rothblum (GKR) [STOC 2008, JACM 2015 certifies the execution of an algorithm via the evaluation of a corresponding boolean or arithmetic circuit whose structure is known to the verifier by circuit wiring algorithms that define the uniformity of the circuit. Here we study protocols whose prover timeand space-complexities are within a poly-logarithmic factor of the time-and space-complexity of the algorithm; we call those protocols 'prover-nearly-optimal. ' We show that the uniformity assumptions can be relaxed from LOGSPACE to polynomial-time in the bitlengths of the labels which enumerate the nodes in the circuit. Our protocol applies GKR recursively to the arising sumcheck problems on each level of the circuit whose values are verified, and deploys any of the prover-nearly-optimal versions of GKR on the constructed sorting/prefix circuits with log-depth wiring functions.The verifier time-complexity of GKR grows linearly in the depth of the circuit. For deep circuits such as the Miller-Rabin integer primality test of an -bit integer, the large number of rounds may interfere with soundness guarantees after the application of the Fiat-Shamir heuristic. We re-arrange the circuit evaluation problem by the baby-steps/giant-steps method to achieve a depth of 1/2+ (1) , at prover cost 2+ (1) bit complexity and communication and verifier cost 3/2+ (1) . CCS CONCEPTS• Theory of computation → Cryptographic protocols.