Dory: Efficient, Transparent Arguments for Generalised Inner Products and Polynomial Commitments

Abstract

This paper presents Dory, a transparent setup, public-coin interactive argument for inner-pairing products between committed vectors of elements of two source groups. For a product of vectors of length n, proofs are $6 \log n$ target group elements and O(1) additional elements. Verifier work is dominated by an $O(\log n)$ multi-exponentiation in the target group and O(1) pairings. Security is reduced to the standard SXDH assumption in the standard model.

We apply Dory to build a multivariate polynomial commitment scheme via the Fiat-Shamir transform. For a dense polynomial with n coefficients, Prover work to compute a commitment is dominated by a multi-exponentiation in one source group of size n. Prover work to show that a commitment to an evaluation is correct is $O(n^{\log {8}/\log {25}})$ in general ($O(n^{1/2})$ for univariate or multilinear polynomials); communication complexity and Verifier work are both $O(\log n)$. These asymptotics previously required trusted setup or concretely inefficient groups of unknown order. Critically for applications, these arguments can be batched, saving large factors on the Prover and improving Verifier asymptotics: to validate $\ell$ polynomial evaluations for polynomials of size at most n requires $O(\ell + \log n)$ exponentiations and $O(\ell \log n)$ field operations.

Dory is also concretely efficient: Using one core and setting $n = 2^{20}$, commitments are 192 bytes. Evaluation proofs are $\sim$18 kB, requiring $\sim$3 s to generate and $\sim$25 ms to verify. For batches at $n=2^{20}$, the marginal cost per evaluation is <1 kB communication, $\sim$300 ms for the Prover and $\sim$1 ms for the Verifier.

Current Affiliation: Nanotronics Imaging; work done primarily at Microsoft Research.