Cascudo and Liu proposed subring VOLE (srVOLE) over Galois rings, constructed maliciously secure protocols, and built publicly verifiable ZK proofs over rings with reduced communication.Cascudo和Liu提出子环VOLE(srVOLE)概念,构造了恶意安全协议,并在环上实现了公开可验证的ZK证明,显著降低通信量。CascudoとLiuはガロア環上の部分環VOLE(srVOLE)を提案し、悪意ある攻撃者に対しても安全なプロトコルを構築し、リング上の公開検証可能なZK証明を実現した。
NotesNotes要点
Proposed subring VOLE (srVOLE), generalizing subfield VOLE to Galois rings
Constructed two maliciously secure srVOLE protocols: one PCG-like with low amortized communication, one SoftSpoken-like compatible with VOLEitH
Can be used to build publicly verifiable VOLE-based ZK
Shown that MozZ2karella's VOLE correlation is a special case of srVOLE
Adapted QuickSilver protocol to any Galois ring
Circuit satisfiability: communication reduced to one subring element per multiplication gate
What aspects of existing ZK are improved?srVOLE能改进现有ZK的什么方面?既存のZKのどの側面が改善されますか?
It reduces communication and achieves public verifiability, especially for ZK over integer rings.降低通信量,并实现公开可验证性,尤其针对整数环上的ZK。通信量を削減し、特に整数環上のZKにおいて公開検証可能性を実現します。
Why can communication be halved for circuit satisfiability?电路可满足性协议通信量为何能减半?回路充足可能性で通信量を半減できる理由は何ですか?
Using srVOLE, each multiplication gate requires communicating just one subring element rather than a more expensive field element.借助srVOLE,每个乘法门仅需通信1个子环元素,而非更昂贵的域元素。srVOLEを用いることで、各乗算ゲートは高コストな体要素ではなく部分環の1要素の通信で済みます。
What restriction is overcome for polynomial satisfiability?多项式可满足性方面克服了什么限制?多項式充足可能性においてどのような制限が克服されましたか?
Prior schemes were mostly limited to degree-2 relations; this protocol supports arbitrary low-degree polynomials.现有方案多限制为二次关系,本文协议支持任意低阶多项式。既存方式は主に2次関係に制限されていましたが、本プロトコルは任意の低次多項式をサポートします。