+ All Categories
Home > Documents > Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot...

Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot...

Date post: 03-Apr-2018
Category:
Upload: lyxuyen
View: 214 times
Download: 0 times
Share this document with a friend
57
1 ZØ: An Optimizing Distributing Zero-Knowledge Compiler Matt Fredrikson University of Wisconsin Ben Livshits Microsoft Research
Transcript
Page 1: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

1

ZØ: An Optimizing Distributing

Zero-Knowledge Compiler

Matt Fredrikson

University of Wisconsin

Ben Livshits

Microsoft Research

Page 2: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

2 2

Automatic Optimization

Cost modeling enables huge optimization opportunities

Distributed Environments

ZØ automatically places code on different computational tiers

“Zero-Knowledge for the Masses”

Users write ZK code in C#, as one part of a larger project

This talk: at a glance

Page 3: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

3 3

This talk: at a glance

Personal Fitness Rewards Retail Loyalty Card

Human Subjects StudiesCollaborative Recommender

SystemCollaborative NIDS

Crowd-sourced traffic maps

Page 4: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

4 4

Crowd-sourced traffic maps

Page 5: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

5 5

Page 6: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

6

Location

data

Traffic

Information

6

Privacy concern:

server knows all my locations

Integrity concern:

users send false data

to protect their location

Page 7: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

7

Location

data

Traffic

Information

7

Privacy concern:

server knows all my locations

Integrity concern:

users send false data

to protect their locationZero-knowledge proofs offer a solution to

this fundamental tension

Page 8: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

8

Traffic

Information

“Opaque”

Location

dataLocation

data

Aggregate

Traffic Data

8

+

zero-knowledge

proof

Page 9: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

9 9

Partition roads

into segments

Use Shamir shares

on segment IDs

Page 10: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

10

Initial Experiments

We implemented this core

functionality in zero-knowledge

ZQL[Fournet et al.,

Usenix Security 2013]

Pinocchio[Parno et al., Oakland 2013]

0

20

40

60

80

100

120

140

Client

Ex

ec

uti

on

Tim

e (

s)

Client Time to Process a

GPS Reading

ZQL Pinocchio Hybrid

Page 11: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

11

Why Such a Contrast?

These zero-knowledge “back-ends” have

significantly different execution models

Compiles C to a fixed

circuit representation

ZQL

Compiles specialized

language to F#, then CIL

11

Pinocchio

Page 12: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

12

ZØ: An Optimizing Compiler for ZK

12

ZØ uses the best of both back-ends as appropriate for the

application at hand

Automatic Optimization Distributed Environments“Zero-Knowledge for the Masses”

Page 13: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

13

ZØ: An Optimizing Compiler for ZK

Input Performance Analysis

ZK Translation Tier Splitting

13

Users write code in C#

Page 14: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

14

ZØ: An Optimizing Compiler for ZK

Input Performance Analysis

ZK Translation Tier Splitting

14

Build detailed cost models that characterize how

expensive C# will be when translated to zero-knowledge

Cost Model

System

Timings

Program Structure

Page 15: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

15

ZØ: An Optimizing Compiler for ZK

Input Performance Analysis

ZK Translation Tier Splitting

15

Use cost models to find optimal translation,

then convert to ZK-producing IL

.NET IL

Cost Models

Performance Profile

Global Optimization

Page 16: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

16

ZØ: An Optimizing Compiler for ZK

Input Performance Analysis

ZK Translation Tier Splitting

16

Use location annotations to split IL between tiers,

insert automatic data transfer and synchronization

Final Output

Pinocchio ZQL

Tie

r

1

ZQL ZQL ZQL

Tie

r

2

Compiled

IL

Location Annotations

Automatic Marshaling

Page 17: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

17

ZERO-KNOWLEDGE IN C#

17

Page 18: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

18

Zero-Knowledge in C#

Programmers specify ZK regions

ZK operations given by LINQ

expressions

Specify ZK input sizes to help optimization

Location annotations drive tier-splitting

Page 19: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

19

COST MODELING

19

Page 20: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

20

Cost Models for Optimization

20

Cost Model

Size of Input

Micro-op timings

C# Source

Runtime

size of input micro-op timings

F(inputListSize) = eqOp * inputListSize + addOp + 12*expOp + 3 * extendOp + 14*mltOp

Cost models characterize the ZK runtime of C# code

Page 21: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

21

Building a Cost Model

Given a circuit, we can

determine evaluation

and proof generation

time

map, fold, find

expressions: we can

always bound the

number of ops in each

expression

21

ZQL Pinocchio

Symbolic evaluation

over polynomial domain

Static circuit evaluation

polynomials

Page 22: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

22

TRANSLATION &

TIER SPLITTING

22

Page 23: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

23

Translating C# to Zero-Knowledge

Cost Models

f(inputListSize) = eqOp * inputListSize + addOp + …

f(numPeers) = addOp * numPeers + multOp + …

f(numItems) = multOp * numItems + eqOp + …

Performance Profile

Tier Compute Cost Transfer Cost

Mobile 2 3

Server 0.5 1

… … …

Global Optimization

.NET IL

Pinocchio ZQL ZQL Pinocchio ZQL

Page 24: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

24

Traffic

Information

Aggregate

Traffic Data

24

Insert code for marshaling

and synchronization

Page 25: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

25

Translating C# To Zero-Knowledge

25

Page 26: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

26

EVALUATION

26

Page 27: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

27

ExperimentsWe ran each application in three

configurations

27

ZQL Pinocchio ZØ

Personal Fitness Rewards

Retail Loyalty Card

Human Subjects Studies

Collaborative Recommender

Collaborative NIDS

Crowd-sourced traffic maps

Page 28: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

28

ExperimentsWe ran each application in three

configurations

28

ZQL Pinocchio Hybrid

Page 29: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

29 29

Loyalty Application, Client’s Time to Process Transaction

Expensive operation on

a hot pathMore gradual

linear scaling

ZQL times out on longer

transactions

ZØ’s cost models identified expensive operation, used

correct back-end

Page 30: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

30 30

NIDS Application, Server’s Throughput

Pinocchio’s throughput is

much higher!

Client configuration

times out

Global optimization traded server performance on small

inputs for greater scalability on both tiers

Page 31: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

31

ExperimentsWe ran each application in three

configurations

31

Scales up to 10x larger data

Up to 40x improvement in runtime

Up to 10-100x smaller than ZQL

Scaling

Performance

Proof Size

ZQL Pinocchio ZØ

Page 32: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

32

Conclusions

Cost modeling enables aggressive optimizations

High-level input language brings ZK “to the masses”

Automatic tier splitting simplifies distributed apps

Illustrated benefits with six applications

Page 33: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

33 33

Page 34: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

34 34

This talk: at a glance

Personal Fitness Rewards Retail Loyalty Card

Human Subjects StudiesCollaborative Recommender

SystemCollaborative NIDS

Personal Fitness Rewards Retail Loyalty Card

Human Subjects StudiesCollaborative Recommender

SystemCollaborative NIDS

Crowd-sourced traffic mapsCrowd-sourced traffic maps

Page 35: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

35

Thanks!

• ZØ is a new zero-knowledge compiler

– Detailed cost modeling enable aggressive

optimizations

– High-level language brings ZK “to the masses”

– Automatic tier splitting simplifies distributed

apps

• Illustrated benefits with six interesting apps

– ZØ’s optimizations make these feasible

35

Conclusions

Page 36: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

36

Modern apps demand

personal data

Pressure to address privacy

concerns is widespread

36

Often the need for data is

legitimate

In many applications, this

creates a tension between

privacy and integrity

Page 37: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

37

Zero-Knowledge: A Promising Solution

Privacy

Integrity

Lots of theory…

?

But very little practice…

37

Prove that a computation was performed

correctly without revealing inputs

Page 38: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

38• The map is broken into regions, and

the desired statistic is the number of clients in each region at time t.

• At regular intervals, the server requests density stats from the clients.

• On receiving a request, each client:1. Takes a GPS reading

2. Computes its map region

3. Encodes its region as a vector, zero everywhere but the column for its region

4. Creates shares of its vector, sends them to other clients

5. On receiving the other clients’ shares, each client sums all received shares and sends the result to the server

• On receiving the summed shares from the clients, the server reconstructs the sum to obtain the density map

38

Page 39: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

39

Privacy Concern: Merchant tracks all of

my purchases

Integrity Concern: Customer might target

specific discounts by faking history

Our Solution: Implement “discounter” as

transducer over purchase history, only send

transducer output to merchant.

Customer Loyalty App• Scan at checkout to receive discounts

• Discounts are based on customer’s

previous transactions

• Examples: Walgreens’ iPhone app,

Safeway “just for U”

39

167.53187.89

375.29

8.7230.38

0

50

100

150

200

250

300

350

400

Client Server

Ex

ec

uti

on

Tim

e (

s)

Time to Apply Discount

ZQL Pinocchio Hybrid

Pinocchio Verifier

Crashed

Page 40: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

40

Personal Fitness Rewards• Reads workout data from personal

training device (FitBit, Garmin, …)

• Users receive points for each mile

walked, run, biked…

• Points can be applied to charities,

or redeemed for discounts and

rewards

Privacy Concern: Sending my location

data to a third party

Integrity Concern: Users lie about

their exercise to receive free goods

Our Solution: Compute distance from

GPS coordinates on the user’s

computer, send final result to third

party

40

36.92

387.29

562.71

15.9239.15

0

100

200

300

400

500

600

Client Server

Ex

ec

uti

on

Tim

e (

s)

Time to Redeem Workout

ZQL Pinocchio Hybrid

Page 41: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

41

Cost Model Accuracy

41

0.1 seconds on average

(14%)

Different stages of a single ZK

computation

0.32 seconds on average

(9%)

Page 42: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

42

ZQL

• Translated code mimics structure of original program, does additional cryptographic work for each primitive operation

• Relies heavily on a few primitive operations: map, fold, find

• Lambdas allowed only in limited contexts

• Translated code is highly parallelizable, esp. for the prover

• Runtime available for WP 7 and 8

Target code is purely-functional, operates on F# lists

42

Page 43: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

43

Pinocchio

• Input language is C with static loops,

constant dereferences, no recursion

• Everything is in-lined

• Values are broken into constituent

bits, Boolean operations used

• Circuit evaluator/prover is optimized

native code

• Requires polynomial interpolation

and division

• No support for parallel execution

43

Target code is a fixed-length arithmetic circuit

Page 44: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

44

Goals for ZØ

Performance

• Neither back-end is one-

size-fits-all

• Understanding

performance requires

specialized knowledge

• Bring zero-knowledge to

“the masses”

Usability

• Users should never write

their own crypto

• Seamless integration

with existing code

– LINQ is our bridge to

zero-knowledge

– Can integrate ZK with

large amounts of UI,

Libraries, arbitrary logic

• Automates tier-splitting

44

Page 45: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

45

ZØ: An Optimizing Compiler for ZK

Input

C# Source

Performance Analysis

Cost Polynomial

ZK Translation

• Arithmetic Circuit

• .NET IL

Tier Splitting

• Client IL

• Server IL

• Resource IL

Implemented in C# and F#

• 9995 LoC

• Uses CCI for processing and analysis, operates on IL

• Uses Solver Foundation to resolve constraints

Still a work in progress

• Integrate cost model generator

• Tune cost model primitive coefficients

45

Page 46: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

46

total 203

input 0 # input

input 1 # input

input 2 # input

input 3 # input

input 4 # input

input 5 # input

input 6 # input

input 7 # input

input 8 # input

Translation in Action

ZQL Pinocchio

1 Multiplication

100 Additions

101 I/O Wires

46

Page 47: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

47

Performance Comparison

Tables

Requires fixed input size

All operations execute over every element

Uses functional lists

Find operations complete when predicate matched

Comparisons

Built-in support for “standard” ops

Supports conditional expressions

Built-in support for equality*

Other comparisons must be implemented in query

Arithmetic

Fixed-width operations

Infinite-precision

Multiplication increases data size

Pinocchio

ZQL

47

Good for

“Big Data”

Good for

complex

comparisonsGood for

fixed

arithmetic

Page 48: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

48

ZQL Performance

eqOp*regionListSize + addOP + 12*expOp + 3 * extendOp + 14*mltOp + …

Cryptographic

Overhead

Terms represent

input sizeTracks iterations

of current

expressionExecute nested

operationAccumulate cost

of nested op.

48

Symbolically execute code generated by ZQL compiler

Page 49: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

49

Pinocchio Performance

# Multiplication Gates d

# Input Wires N

Proof Gen & Computation (7(d + N) – 2N + d)ExpMulB + … + O(d log2 d)(mul + add)

Verification N(mul + add) + 7Pair

Interpolation

Cost

O(6002 log2 6002)(add+mul) + 6507 ExpT + 44034 ExpB + 50541 ExpMulB + …

Source: Bryan Parno

49

Static polynomial based on circuit characteristics

Page 50: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

50

Compiling to Zero-Knowledge

Core LINQ

expressionsCombinations of

list-structured data

50

Page 51: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

51

LINQ -> Pinocchio

1. Infer input sizes and list bounds

Linear ProgramSize attributes

2. Create and assign types to expressions

3. Encapsulate each sub-expression in a distinct function

bounds → Tuple5

regions → Tuple5100

51

Page 52: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

52

LINQ -> ZQL

1. Mostly straightforward translation from LINQ to F#

2. Generate output check

Descend on the structure of the output type, apply map and check

Caveat: ZQL queries cannot

output structured data

Pass result of LINQ operation

to ZQL query

Fail proof checking when false

squared.Select

sqrtTable.First

52

Page 53: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

53 53

< Demo >

Page 54: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

54 54

Back to our example…

Look up region in a large table of coordinatesZ

Show that GPS coordinates match resultP

Encode region as a vectorP

Creates shares of vectorZP

Sums other clients’ sharesZP

Page 55: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

55

Distributing Across Tiers

Minimize the role of the compiler:

1. Infer dependencies between tiers

2. Insert calls to runtime API whenever cross-tier

dependencies existFunctions called from main

always return Enumerable

Only the main function can

call code on multiple tiers

Each element inherits from

“relocatable” type

55

Core Principle: Rely on runtime whenever possible

Page 56: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

56

ZØ: An Optimizing Compiler for ZK

Input

C# Source

Performance Analysis

Cost Model

ZK Translation

• Arithmetic Circuit

• .NET IL

Tier Splitting

• Client IL

• Server IL

• Resource IL

56

ZØ uses the best of both back-ends as appropriate for the

application at hand

Page 57: Z0: An Optimizing Distributed Zero-Knowledge Compilerlivshits/papers/ppt/usenixsecurity14.pdfa hot path More gradual linear scaling ZQL times out on longer transactions ZØ’s cost

57

Translating C# To Zero-Knowledge

57

Programmers specify ZK regions

ZK operations given by LINQ

expressions

Specify ZK input sizes to help optimization


Recommended