-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
8cb66b3
commit 0652a06
Showing
3 changed files
with
97 additions
and
64 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,76 +1,107 @@ | ||
# Halo Accumulation Scheme Rust Implementation | ||
This repository accompanies the report *"Investigating IVC with Accumulation | ||
Schemes"*. It explores the theoretical foundation of accumulation schemes | ||
and their application in Incrementally Verifiable Computation (IVC). While | ||
the Rust implementation included here serves as a concrete demonstration of | ||
the theory, the focus remains on the mathematical and cryptographic insights | ||
behind the constructions and benchmarking, _not_ production-grade code. | ||
|
||
This repository contains a Rust implementation of the accumulation scheme | ||
from the described in the 2020 paper _"Proof-Carrying Data from Accumulation | ||
Schemes"_ by Benedikt Bünz, Alessandro Chiesa, Pratyush Mishra, and Nicholas | ||
Spooner. The implementation is mostly written to broaden my own understanding | ||
on the subject of IVC, and should be in no way considered secure or efficient. | ||
The theory and code is mostly based on the 2020 paper _"Proof-Carrying Data | ||
from Accumulation Schemes"_ by Benedikt Bünz, Alessandro Chiesa, Pratyush | ||
Mishra, and Nicholas Spooner. | ||
|
||
## Overview | ||
## Background | ||
|
||
An accumulation scheme is a cryptographic construct used to "aggregate" | ||
the verification of multiple proofs or statements into a single succinct | ||
proof. The idea is to replace repeated verification of individual proofs with a | ||
more efficient process, where the accumulated proof can be verified succinctly. | ||
### What Are Accumulation Schemes? | ||
|
||
Key Objects: | ||
- `Instance`: Generally a claim of some statement encoded in a polynomial commitment scheme. | ||
- `Accumulator`: The central object in the scheme that aggregates information about the verified proofs. | ||
Accumulation schemes are cryptographic primitives that allow for the | ||
incremental verification of multiple computations or proofs. They enable | ||
efficient proof systems by cheaply "accumulating" intermediate results, | ||
which can then be checked in a single, possibly expensive, verification step. | ||
|
||
Key Operations: | ||
- `prover`: A process that integrates a new proof or statement into the accumulator. | ||
- `verifier`: Verifies that the prover correctly accumulated the instance `q`, the old accumulator `acc` into the new accumulator `acc*`. | ||
- `decider`: Given that _all_ previous accumulators have been correctly checked using the `verifier`, perform an expensive check. | ||
These schemes are particularly relevant in IVC, where a sequence of | ||
computations or proofs needs to be verified succinctly. By using the | ||
accumulation scheme, benchmarking shows significant improvements over naive | ||
series of PCS checks. | ||
|
||
With the correct runtime bounds, we can construct PCD (Proof-Carrying Data) | ||
and IVC (Incrementally Verifiable Computation). | ||
### Motivation for This Work | ||
|
||
## Getting Started | ||
The `ASDL` allows for an efficient IVC construction despite the linear runtime | ||
of a full PCS check, by leveraging the succinct check in `PCDL`. This means | ||
you can have verification that does not scale linearly with the number of | ||
IVC steps, since the linear computation is only done at the end of the IVC | ||
chain, _not_ at each step. This means that, using a PCS based on Bulletproof's | ||
Inner Product Argument, we can create an IVC construction that does not | ||
depend on a trusted setup. | ||
|
||
### Installation | ||
## Theory Overview | ||
|
||
#### Rust | ||
The report included in this repository covers: | ||
|
||
1. Clone the repository: | ||
```bash | ||
git clone https://github.com/rasmus-kirk/halo-accumulation | ||
cd halo-accumulation | ||
``` | ||
1. **Prerequisites and Cryptographic Background** | ||
- Fiat-Shamir heuristic | ||
- SNARKs and Bulletproofs | ||
|
||
2. Build the project: | ||
```bash | ||
cargo build | ||
``` | ||
2. **Incrementally Verifiable Computation (IVC)** | ||
- Introduction to IVC and its applications | ||
- An IVC construction using traditional SNARKS with sublinear verification | ||
|
||
3. Run the tests to verify the implementation: | ||
```bash | ||
cargo test | ||
``` | ||
3. **Polynomial Commitment Schemes (PCS)** | ||
- Theory behind PCS and their role in succinct proofs | ||
|
||
3. Run the benchmarks: | ||
```bash | ||
cargo benchmark | ||
``` | ||
4. **Accumulation Schemes (AS)** | ||
- Construction of `ASDL` and its components | ||
- Theoretical guarantees (completeness, soundness) | ||
|
||
#### Nix | ||
5. **IVC Using Accumulation Schemes** | ||
- How accumulation schemes lead to new IVC constructions, without the need for a trusted setup | ||
|
||
This project has integration with [Nix](https://nixos.org/), if nix is | ||
installed with flake support, type `nix develop` to get a reproducible | ||
developement shell for this project. | ||
6. **The Implementation** | ||
- Implementation details for `PCDL`, with a completeness proof and a knowledge extractability discussion | ||
- Implementation details for `ASDL`, with soundness and completeness proofs. | ||
|
||
### Usage | ||
7. **Efficiency and Benchmarking** | ||
- Comparison between naive PCS and accumulation schemes | ||
- Preliminary benchmarking results showing promising results | ||
|
||
Although not recommended, you can import this module and work with it: | ||
## Rust Implementation | ||
|
||
#### Polynomial Commitment Scheme in the Discrete Log setting | ||
The Rust code provides a concrete implementation of the described accumulation | ||
scheme (`ASDL`) and polynomial commitment scheme (`PCDL`). While the | ||
implementation is not designed for production use, it is a useful tool for | ||
understanding the theory and experimenting with the concepts. | ||
|
||
```rust | ||
``` | ||
### Developement Environment using Nix | ||
|
||
#### Accumulation Scheme | ||
This project has nix support, as such, navigating to `/code` and typing | ||
`nix develop`, will install the necessary rust version, with the correct | ||
formatter and rust-analyzer included. | ||
|
||
```rust | ||
``` | ||
### Unit Tests | ||
|
||
Unit tests can be run with `cargo test` in the `/code` directory. | ||
|
||
### Benchmarks | ||
|
||
Benchmarks can be run with `cargo benchmark` in the `/code` directory. | ||
|
||
### Features | ||
- **Polynomial Commitment Scheme (`PCDL`)**: Implements commitment, opening, and succinct checking. | ||
- **Accumulation Scheme (`ASDL`)**: Demonstrates the efficiency of accumulation-based verification. | ||
- **Benchmarks**: Includes preliminary performance comparisons between naive PCS usage and accumulation schemes. | ||
|
||
## Report | ||
|
||
The full report, *["Investigating IVC with Accumulation | ||
Schemes"](https://halo-accumulation.rasmuskirk.com/report/report.pdf)*, | ||
is included in this repository and provides a detailed explanation of the | ||
theory, constructions, and benchmarks. | ||
|
||
## Contributions | ||
|
||
This work is primarily intended for those interested in understanding the | ||
theory behind accumulation schemes and their application to IVC. Contributions | ||
or suggestions for improving the theoretical explanations are welcome. | ||
|
||
## License | ||
|
||
## License | ||
This project is licensed under the MIT License. See the `LICENSE` file for details. |
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters