International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

Field-Agnostic SNARKs from Expand-Accumulate Codes

Authors:
Alexander R. Block , Georgetown University and University of Maryland
Zhiyong Fang , Texas A&M University
Jonathan Katz , Google and University of Maryland
Justin Thaler , a16z crypto research and Georgetown University
Hendrik Waldner , University of Maryland
Yupeng Zhang , University of Illinois Urbana Champaign
Download:
DOI: 10.1007/978-3-031-68403-6_9 (login may be required)
Search ePrint
Search Google
Presentation: Slides
Conference: CRYPTO 2024
Abstract: Efficient realizations of succinct non-interactive arguments of knowledge (SNARK) have gained popularity due to their practical applications in various domains. Among existing schemes, those based on error-correcting codes are of particular interest because of their good concrete efficiency, transparent setup, and plausible post-quantum security. However, many existing code-based SNARKs suffer from the disadvantage that they only work over specific finite fields. In this work, we construct a code-based SNARK that does not rely on any specific underlying field; i.e., it is \emph{field-agnostic}. Our construction follows the framework of Brakedown and builds a polynomial commitment scheme (and hence a SNARK) based on recently introduced \emph{expand-accumulate codes}. Our work generalizes these codes to arbitrary finite fields; our main technical contribution is showing that, with high probability, these codes have constant rate and constant relative distance (crucial properties for building efficient SNARKs), solving an open problem from prior work. As a result of our work we obtain a SNARK where, for a statement of size $M$, the prover time is $O(M\log M)$ and the proof size is $O(\sqrt{M})$. We demonstrate the concrete efficiency of our scheme empirically via experiments. Proving ECDSA verification on the secp256k1 curve requires only 0.23s for proof generation, 2~orders of magnitude faster than SNARKs that are not field-agnostic. Compared to the original Brakedown result (which is also field-agnostic), we obtain proofs that are 1.9--2.8$\times$ smaller due to the good concrete distance of our underlying error-correcting code, while introducing only a small overhead of 1.2$\times$ in the prover time.
BibTeX
@inproceedings{crypto-2024-34283,
  title={Field-Agnostic SNARKs from Expand-Accumulate Codes},
  publisher={Springer-Verlag},
  doi={10.1007/978-3-031-68403-6_9},
  author={Alexander R. Block and Zhiyong Fang and Jonathan Katz and Justin Thaler and Hendrik Waldner and Yupeng Zhang},
  year=2024
}