Formal Verification of Zero-Knowledge Circuits (2311.08858v1)

Abstract: Zero-knowledge circuits are sets of equality constraints over arithmetic expressions interpreted in a prime field; they are used to encode computations in cryptographic zero-knowledge proofs. We make the following contributions to the problem of ensuring that a circuit correctly encodes a computation: a formal framework for circuit correctness; an ACL2 library for prime fields; an ACL2 model of the existing R1CS (Rank-1 Constraint Systems) formalism to represent circuits, along with ACL2 and Axe tools to verify circuits of this form; a novel PFCS (Prime Field Constraint Systems) formalism to represent hierarchically structured circuits, along with an ACL2 model of it and ACL2 tools to verify circuits of this form in a compositional and scalable way; verification of circuits, ranging from simple to complex; and discovery of bugs and optimizations in existing zero-knowledge systems.

• The paper introduces a formal ACL2 framework that proves high- and low-level representation equivalence in zero-knowledge circuits.
• It develops both R1CS and a novel PFCS approach to enable hierarchical verification and effectively catch practical circuit bugs.
• Experimental results confirm snarkVM gadget correctness, highlighting the framework’s potential for secure blockchain and privacy technologies.

Formal Verification of Zero-Knowledge Circuits

The paper focuses on the formal verification of zero-knowledge circuits within cryptographic protocols, utilizing the ACL2 theorem prover. Zero-knowledge proofs allow a prover to assert knowledge of a secret without revealing it, relying on the predicate being expressed as a zero-knowledge circuit. The authors present several contributions aimed at ensuring these circuits effectively encode computations as intended.

Contributions and Framework

Firstly, a general formal framework for zero-knowledge circuit correctness is introduced, making a distinction between high-level representations of computations and their low-level circuit equivalents. This framework emphasizes proving the equivalence between the high-level representation $H$ and the low-level encoding $L$, expressed as $L \Longleftrightarrow H$.

The authors develop an ACL2 library for reasoning about prime fields, the arithmetic basis for zero-knowledge circuits, involving operations such as addition and multiplication over a modular field. They also construct an ACL2 model for the Rank-1 Constraint Systems (R1CS) formalism, a standard method for representing such circuits. To address limitations in R1CS, the authors advance a new formalism, Prime Field Constraint Systems (PFCS), which accommodates hierarchies and offers a structure conducive to compositional verification.

Verification Techniques

Verification efforts use ACL2 along with its extension, Axe, to manage the complexity of proving circuit correctness. The verification strategies consist of running tools to lift deeply embedded constraints into shallowly embedded forms, followed by proofs that leverage ACL2’s rewriting and simplification capabilities.

The novel PFCS approach permits hierarchically structured circuits, maintaining modularity as circuits grow in complexity. The authors emphasize that PFCS allows representing each circuit as a named relation, facilitating parameterization over inputs and existential quantification over internal variables.

Numerical Results and Claims

Throughout their work, the authors verify a range of zero-knowledge circuits from relatively simple sub-gadgets to more complex systems. Notably, the correctness of snarkVM gadgets was confirmed, uncovering practical bugs and optimizations. The authors report two significant bugs that were corrected, among which was a failure to constrain integer values appropriately, leading to incorrect circuit behavior.

Implications and Future Directions

This research holds practical implications for blockchain and privacy technologies, offering cryptographic assurance without complexity compromising correctness or performance. The authors plan further development in making the verification approach robust enough for compiling high-level language specifications down to zero-knowledge circuits. Their future work is poised to cover an extensive verification of snarkVM’s entire compilation process, leveraging ACL2’s ability to check proof correctness efficiently.

The exploration into zero-knowledge circuit verification highlights the necessity for hierarchical approaches in scalable verification, effectively navigating the inherent complexity challenges. This work underscores the delicate balance between automation and manual verification, striving for verification processes that enhance both efficiency and rigor.

In sum, this paper advances the field’s understanding of zero-knowledge circuits, providing a foundation for future development of privacy-preserving technologies through formal verification methodologies.