Public-coin zero-knowledge arguments with (almost) minimal time and space overheads

Zero-knowledge protocols enable the truth of a mathematical statement to be certified by a verifier without revealing any other information. Such protocols are a cornerstone of modern cryptography and recently are becoming more and more practical. However, a major bottleneck in deployment is the efficiency of the prover and, in particular, the space-efficiency of the protocol. For every NP relation that can be verified in time T and space S, we construct a public-coin zero-knowledge argument in which the prover runs in time T· polylog (T) and space S· polylog (T). Our proofs have length polylog (T) and the verifier runs in time T· polylog (T) (and space polylog (T)). Our scheme is in the random oracle model and relies on the hardness of discrete log in prime-order groups. Our main technical contribution is a new space efficient polynomial commitment scheme for multi-linear polynomials. Recall that in such a scheme, a sender commits to a given multi-linear polynomial P: Fⁿ→ F so that later on it can prove to a receiver statements of the form “ P(x) = y ”. In our scheme, which builds on commitments schemes of Bootle et al. (Eurocrypt 2016) and Bünz et al. (S&P 2018), we assume that the sender is given multi-pass streaming access to the evaluations of P on the Boolean hypercube and we show how to implement both the sender and receiver in roughly time 2ⁿ and space n and with communication complexity roughly n.