DEEP-FRI: Sampling outside the box improves soundness (1903.12243v1)

Abstract: Motivated by the quest for scalable and succinct zero knowledge arguments, we revisit worst-case-to-average-case reductions for linear spaces, raised by [Rothblum, Vadhan, Wigderson, STOC 2013]. We first show a sharp quantitative form of a theorem which says that if an affine space $U$ is $\delta$-far in relative Hamming distance from a linear code $V$ - this is the worst-case assumption - then most elements of $U$ are almost $\delta$-far from $V$ - this is the average case. This leads to an optimal analysis of the soundness of the FRI protocol of [Ben-Sasson, et.al., eprint 2018] for proving proximity to Reed-Solomon codes. To further improve soundness, we sample outside the box. We suggest a new protocol which asks a prover for values of a polynomial at points outside the domain of evaluation of the Reed-Solomon code. We call this technique Domain Extending for Eliminating Pretenders (DEEP). We use the DEEP technique to devise two new protocols: (1) An Interactive Oracle Proof of Proximity (IOPP) for RS codes, called DEEP-FRI. This soundness of the protocol improves upon that of the FRI protocol while retaining linear arithmetic proving complexity and logarithmic verifier arithmetic complexity. (2) An Interactive Oracle Proof (IOP) for the Algebraic Linking IOP (ALI) protocol used to construct zero knowledge scalable transparent arguments of knowledge (ZK-STARKs) in [Ben-Sasson et al., eprint 2018]. The new protocol, called DEEP-ALI, improves soundness of this crucial step from a small constant $< 1/8$ to a constant arbitrarily close to $1$.

• The paper introduces a novel DEEP technique that refines soundness bounds for Reed-Solomon codes by tightening worst-to-average-case reductions.
• The DEEP-FRI protocol significantly reduces verifier complexity while enhancing security in interactive oracle proofs.
• Applicability to arbitrary linear codes and potential integration with STARKs underscore its impact on scalable cryptographic proofs.

Overview of "DEEP-FRI: Sampling Outside the Box Improves Soundness"

The paper "DEEP-FRI: Sampling Outside the Box Improves Soundness" presents advancements in the field of zero-knowledge arguments, specifically focusing on improving soundness in proximity testing for linear codes, notably Reed-Solomon (RS) codes. This work builds on previous efforts by Rothblum, Vadhan, and Wigderson, and extends the understanding of worst-case-to-average-case reductions in the context of linear algebraic codes.

Main Contributions

1. Improved Soundness Bound:
   • The paper introduces a refined soundness bound for linear codes, increasing it from the "double Johnson" to the "one-and-a-half Johnson" function of the code's relative distance, showing tightness for certain Reed-Solomon codes. This indicates that the new bound reflects an improved approximation between worst-case and average-case distance assumptions.
2. DEEP Technique (Domain Extending for Eliminating Pretenders):
   • A novel methodology, termed DEEP, is introduced to enhance soundness further by extending the domain and strategically querying the code. This method is applied to RS codes, where a verifier samples a location outside of the traditional evaluation set and challenges the prover to commit to specific polynomial values. This approach aids in narrowing down the list of potential polynomial encodings, effectively reducing "pretenders."
3. DEEP-FRI Protocol:
   • The implementation of the DEEP method in the context of the FRI protocol yields DEEP-FRI, an interactive oracle proof system. DEEP-FRI demonstrates superior soundness compared to its predecessors by extending soundness to match the list-decoding radius predicted by the Johnson bound.
4. Generality to Linear Codes:
   • The paper also explores the applicability of the DEEP technique to arbitrary linear codes, discussing potential improvements in worst-to-average-case reductions for near-capacity list-decodable codes.
5. Application to Interactive Oracle Proofs:
   • The DEEP method is employed to create enhanced protocols like DEEP-ALI, improving the soundness of zero-knowledge scalable transparent arguments of knowledge (STARKs).

Implications and Future Directions

• Theoretical Implications:

The findings refine the theoretical underpinnings of soundness in zero-knowledge proofs, particularly in proximity testing frameworks using linear codes. By establishing tighter bounds and demonstrating their tightness, this work provides a clearer boundary for theoretical exploration in high-error regimes.

• Practical Implications:

The advancements can potentially reduce the computational overhead in systems employing STARKs. The reduction in verifier complexity through DEEP-FRI enhances scalability and efficiency, making zero-knowledge proofs more viable for larger instance sizes and real-world applications.

• Speculative Developments:

Further research could explore extending the DEEP technique to other algebraic structures or integrating it with new cryptographic primitives. Understanding the behavior of list-decodable codes beyond the Johnson bound may yield additional efficiency gains.

In conclusion, the paper significantly contributes to the field of efficient zero-knowledge proofs. Its novel DEEP methodology and the formulation of DEEP-FRI provide robust theoretical insights and practical advancements for real-world cryptographic applications. Future work that leverages DEEP could continue to push the boundaries of transparency and efficiency in cryptographic protocols.