End-to-end hardware acceleration for ZKP from witness generation to proof generation
A local buffer is integrated with a witness generator and a proof generator on a cryptographic processor and is separate from host memory accessed by a host processor operating with the cryptographic processor in a proving computing system. The witness generator: receives, from software program running on the host processor, compiled code of a zero-knowledge-proof (ZKP) program and specific input to the ZKP program; executes the ZKP program by way of executing the compiled code; records specific output generated from the ZKP program with the specific input, intermediate variable values, and the specific input, as a specific witness of executing the ZKP program; stores the specific witness in the local buffer. The proof generator: receives, from the software program running on the host processor, a proving key; accesses the specific witness in the local buffer; generates a specific zero-knowledge proof for executing the ZKP program with the specific input.
1 . A computer-implemented method comprising:
receiving, by a verification system, a verification key that was generated along with a proving key;
receiving, by the verification system, a specific proof generated by a proving system from an execution of a cryptographic program;
wherein the proving system comprises a host processor and a cryptographic engine on a semiconductor device, the cryptographic engine includes a witness generator, a proof generator and a local witness buffer; wherein the cryptographic engine is separate from the host processor; wherein the local witness buffer in the cryptographic engine is separate from host memory accessed by the host processor;
wherein the witness generator in the cryptographic engine (a) receives, from the host processor, compiled code of the cryptographic program and specific input to the cryptographic program, (b) executes the cryptographic program by way of executing the compiled code, (c) records specific output generated from the cryptographic program, intermediate variable values, and the specific input, as a specific witness of executing the cryptographic program, and (d) stores the specific witness in the local witness buffer in the cryptographic engine;
wherein the specific witness has a data size exceeding a maximum supported memory access bandwidth of the host memory for a single clock cycle;
wherein the proof generator in the cryptographic engine (e) receives, from the host processor, the proving key that was generated along with the verification key, (f) accesses the specific witness in the local witness buffer in the cryptographic engine, wherein the specific witness is accessed in its entirety by the proof generator over first clock cycles fewer than second clock cycles over which the host memory stored data of the same data size is accessed from the host memory and (g) generates the specific proof for executing the cryptographic program with a combination of the proving key, the specific witness and the specific input;
executing, by the verification system, a verification algorithm to verify whether the specific proof received is valid.
2 . The method of claim 1 , wherein the verification key is generated concurrently with the proving key in a trusted setup.
3 . The method of claim 1 , wherein the cryptographic program accesses private data not shared by the proving system with other computing systems including the verification system that validates the specific proof.
4 . The method of claim 1 , wherein the compiled code defines a circuit formed by a plurality of gates derived from the compiled code.
5 . The method of claim 1 , wherein the cryptographic engine comprises a plurality of computation logics for performing parallel computations relating to one or more of: fast Fourier transformation, number theoretic transformation, or multi-scalar multiplication.
6 . The method of claim 1 , wherein the cryptographic engine is implemented as one of: a single semiconductor device, a single integrated circuit, or a single semiconductor chip that includes one or more chiplets.
7 . The method of claim 1 , wherein the cryptographic engine is a zero-knowledge-proof (ZKP) program.
8 . A verification system comprising:
a processor; and
a memory, wherein the memory stored thereon executable instructions that when executed by the processor, cause the processor to:
receive a verification key that was generated along with a proving key;
receive a specific proof generated by a proving system from an execution of a cryptographic program;
wherein the proving system comprises a host processor and a cryptographic engine on a semiconductor device, the cryptographic engine includes a witness generator, a proof generator and a local witness buffer; wherein the cryptographic engine is separate from the host processor; wherein the local witness buffer in the cryptographic engine is separate from host memory accessed by the host processor;
wherein the witness generator in the cryptographic engine (a) receives, from the host processor, compiled code of the cryptographic program and specific input to the cryptographic program, (b) executes the cryptographic program by way of executing the compiled code, (c) records specific output generated from the cryptographic program, intermediate variable values, and the specific input, as a specific witness of executing the cryptographic program, and (d) stores the specific witness in the local witness buffer in the cryptographic engine;
wherein the specific witness has a data size exceeding a maximum supported memory access bandwidth of the host memory for a single clock cycle;
wherein the proof generator in the cryptographic engine (e) receives, from the host processor, the proving key that was generated along with the verification key, (f) accesses the specific witness in the local witness buffer in the cryptographic engine, wherein the specific witness is accessed in its entirety by the proof generator over first clock cycles fewer than second clock cycles over which the host memory stored data of the same data size is accessed from the host memory and (g) generates the specific proof for executing the cryptographic program with a combination of the proving key, the specific witness and the specific input;
execute a verification algorithm to verify whether the specific proof received is valid.
9 . The apparatus of claim 8 , wherein the verification key is generated concurrently with the proving key in a trusted setup.
10 . The apparatus of claim 8 , wherein the cryptographic program accesses private data not shared by the proving system with other computing systems including the verification system that validates the specific proof.
11 . The apparatus of claim 8 , wherein the compiled code defines a circuit formed by a plurality of gates derived from the compiled code.
12 . The apparatus of claim 8 , wherein the cryptographic engine comprises a plurality of computation logics for performing parallel computations relating to one or more of: fast Fourier transformation, number theoretic transformation, or multi-scalar multiplication.
13 . The apparatus of claim 8 , wherein the cryptographic engine is implemented as one of: a single semiconductor device, a single integrated circuit, or a single semiconductor chip that includes one or more chiplets.
14 . The apparatus of claim 8 , wherein the cryptographic engine is a zero-knowledge-proof (ZKP) program.
15 . A non-transitory computer readable medium, storing software instructions, which when executed by one or more processors cause the one or more processors to perform operations comprising:
receive, by a verification system, a verification key that was generated along with a proving key;
receive, by the verification system, a specific proof generated by a proving system from an execution of a cryptographic program;
wherein the proving system comprises a host processor and a cryptographic engine on a semiconductor device, the cryptographic engine includes a witness generator, a proof generator and a local witness buffer; wherein the cryptographic engine is separate from the host processor; wherein the local witness buffer in the cryptographic engine is separate from host memory accessed by the host processor;
wherein the witness generator in the cryptographic engine (a) receives, from the host processor, compiled code of the cryptographic program and specific input to the cryptographic program, (b) executes the cryptographic program by way of executing the compiled code, (c) records specific output generated from the cryptographic program, intermediate variable values, and the specific input, as a specific witness of executing the cryptographic program, and (d) stores the specific witness in the local witness buffer in the cryptographic engine;
wherein the specific witness has a data size exceeding a maximum supported memory access bandwidth of the host memory for a single clock cycle;
wherein the proof generator in the cryptographic engine (e) receives, from the host processor, the proving key that was generated along with the verification key, (f) accesses the specific witness in the local witness buffer in the cryptographic engine, wherein the specific witness is accessed in its entirety by the proof generator over first clock cycles fewer than second clock cycles over which the host memory stored data of the same data size is accessed from the host memory and (g) generates the specific proof for executing the cryptographic program with a combination of the proving key, the specific witness and the specific input;
executing, by the verification system, a verification algorithm to verify whether the specific proof received is valid.
16 . The non-transitory computer readable medium of claim 15 , wherein the verification key is generated concurrently with the proving key in a trusted setup.
17 . The non-transitory computer readable medium of claim 15 , wherein the cryptographic program accesses private data not shared by the proving system with other computing systems including the verification system that validates the specific proof.
18 . The non-transitory computer readable medium of claim 15 , wherein the compiled code defines a circuit formed by a plurality of gates derived from the compiled code.
19 . The non-transitory computer readable medium of claim 15 , wherein the cryptographic engine comprises a plurality of computation logics for performing parallel computations relating to one or more of: fast Fourier transformation, number theoretic transformation, or multi-scalar multiplication.
20 . The non-transitory computer readable medium of claim 15 , wherein the cryptographic engine is implemented as one of: a single semiconductor device, a single integrated circuit, or a single semiconductor chip that includes one or more chiplets.
21 . The non-transitory computer readable medium of claim 15 , wherein the cryptographic engine is a zero-knowledge-proof (ZKP) program.