Succinct Non-Interactive Zero-Knowledge Proofs with Preprocessing for LOGSNP

Let Λ : {0, 1}n ×{0, 1}m → {0, 1} be a Boolean formula of size d, or more generally, an arithmetic circuit of degree d, known to both Alice and Bob, and let y ∈ {0, 1}m be an input known only to Alice. Assume that Alice and Bob interacted in the past in a preamble phase (that is, applied a preamble protocol that depends only on the parameters, and not on Λ, y). We show that Alice can (non-interactively) commit to y, by a message of size poly(m, log d), and later on prove to Bob any N statements of the form Λ(x1, y) = z1, . . . , Λ(xN , y) = zN by a (computationally sound) non-interactive zero-knowledge proof of size poly(d, log N). (Note the logarithmic dependence on N). We give many applications and motivations for this result. In particular, assuming that Alice and Bob applied in the past the (poly-logarithmic size) preamble protocol:

• Type: Conference
• Year: 2006
• Where: FOCS
• Authors: Yael Tauman Kalai, Ran Raz
• Keywords: Boolean Formula, FOCS 2006, Preamble Protocol, Size D, Theoretical Computer Science