Delegating Computation: Interactive Proofs for Muggles ¤ y z Shafi Goldwasser Yael Tauman Kalai Guy N. Rothblum MIT and Weizmann Institute Georgia Tech MIT shafi@theory.csail.mit.edu [email protected]. [email protected] ABSTRACT Using this theorem we make progress on several questions: In this work we study interactive proofs for tractable lan- ² We show how to construct short (polylog size) com- guages. The (honest) prover should be e±cient and run in putationally sound non-interactive certi¯cates of cor- polynomial time, or in other words a \muggle".1 The veri- rectness for any log-space uniform NC computation, in ¯er should be super-e±cient and run in nearly-linear time. the public-key model. The certi¯cates can be veri¯ed These proof systems can be used for delegating computation: in quasi-linear time and are for a designated veri¯er: a server can run a computation for a client and interactively each certi¯cate is tailored to the veri¯er's public key. prove the correctness of the result. The client can verify the This result uses a recent transformation of Kalai and result's correctness in nearly-linear time (instead of running Raz from public-coin interactive proofs to one-round the entire computation itself). arguments. The soundness of the certi¯cates is based Previously, related questions were considered in the Holo- on the existence of a PIR scheme with polylog com- graphic Proof setting by Babai, Fortnow, Levin and Szegedy, munication. in the argument setting under computational assumptions by Kilian, and in the random oracle model by Micali. Our ² Interactive proofs with public-coin, log-space, poly-time focus, however, is on the original interactive proof model veri¯ers for all of P. This settles an open question where no assumptions are made on the computational power regarding the expressive power of proof systems with or adaptiveness of dishonest provers. such veri¯ers. Our main technical theorem gives a public coin interactive proof for any language computable by a log-space uniform ² Zero-knowledge interactive proofs with communication boolean circuit with depth d and input length n. The veri¯er complexity that is quasi-linear in the witness length runs in time (n+d)¢polylog(n) and space O(log(n)), the com- for any NP language veri¯able in NC, based on the munication complexity is d ¢ polylog(n), and the prover runs existence of one-way functions. in time poly(n). In particular, for languages computable by log-space uniform NC (circuits of polylog(n) depth), the ² Probabilistically checkable arguments (a model due to prover is e±cient, the veri¯er runs in time n ¢ polylog(n) Kalai and Raz) of size polynomial in the witness length and space O(log(n)), and the communication complexity is (rather than the instance length) for any NP language polylog(n). veri¯able in NC, under computational assumptions. Categories and Subject Descriptors ¤ Supported by NSF Grants CCF-0514167, CCF-0635297, F.2.0 [Theory of Computation]: Analysis of Algorithms NSF-0729011, the RSA chair, and by the Weizmann Chais and problem complexity|General Fellows Program for New Scientists. yThis work was mainly done while the author was visiting Microsoft Research, Redmond. Supported in part by NSF General Terms grant CCF-0635297 Theory zSupported by NSF Grants CCF-0635297, NSF-0729011, CNS-0430336 and by a Symantec Graduate Fellowship. 1In the ¯ction of J. K. Rowling: a person who possesses no Keywords magical powers; from the Oxford English Dictionary. Proof Veri¯cation, Interactive Proofs, Delegating Computa- tion Permission to make digital or hard copies of all or part of this work for 1. INTRODUCTION personal or classroom use is granted without fee provided that copies are E±cient proof veri¯cation lies at the heart of complex- not made or distributed for profit or commercial advantage and that copies ity theory. Classically, this was captured by the idea of a bear this notice and the full citation on the first page. To copy otherwise, to deterministic polynomial time veri¯cation procedure which republish, to post on servers or to redistribute to lists, requires prior specific receives the proof, a certi¯cate of polynomial length, and permission and/or a fee. STOC’08, May 17–20, 2008, Victoria, British Columbia, Canada. veri¯es its validity. Extending classical proof systems, in- Copyright 2008 ACM 978-1-60558-047-0/08/05 ...$5.00. teractive proof systems [37, 9] provide a model in which the polynomial time veri¯cation procedure (the veri¯er) is ran- ² Communication complexity that is polylogarithmic in domized and can interact with a prover that may employ an the size of the computation. adaptive strategy. Delegating Computation. Beyond its complexity theoretic in- Much of the complexity-theoretic research on interactive terest, the question of interactive proofs for e±cient players proofs has focused on studying their expressive power while is motivated by real-world applications. The main appli- improving the veri¯er's complexity in terms of various re- cation we consider is delegating polynomial time computa- source measures (e.g. time, space, depth, rounds or ran- tions to an untrusted party. The general setting is of several domness). The complexity of proving has received less at- computational devices of di®ering computational abilities in- tention. Indeed, since research focused on proofs for in- teracting with each other over a network. Some of these tractable languages, the honest prover is often2 assumed to devices are computationally weak due to various resource be able to perform intractable computations in the interest constraints. As a consequence there are tasks, which poten- of e±cient veri¯ability. In Arthur-Merlin games, the honest tially could enlarge a device's range of application, that are prover is accordingly named after Merlin, a computationally beyond its reach. A natural solution is to delegate computa- unbounded magician. tions that are too expensive for one device, to other devices Even in cryptographic contexts, where parties in interac- which are more powerful or numerous and connected to the tive proof systems must run in polynomial time, the main same network. This approach comes up naturally in today's focus of research remains on intractable languages such as and tomorrow's computing reality as illustrated in the fol- deciding quadratic-residuosity modulo a composite number. lowing two examples. To allow the honest prover to perform computations oth- 1. Large Scale Distributed Computing. The idea of Vol- erwise impossible in polynomial time, he can use auxiliary unteer Computing is for a server to split large computations secrets, e.g. the factorization of the input modulos in the into small units, send these units to volunteers for process- quadratic residuosity example. This model is reasonable in ing, and reassemble the result (via a much easier computa- protocol settings where the input is generated by the prover tion). The Berkeley Open Infrastructure for Network Com- himself. The prover can generate the input along with an puting (BOINC) [5, 6] is such a platform whose intent is auxiliary secret which enables him prove non-BPP proper- to make it possible for researchers in ¯elds as diverse as ties. However, in settings where the input is generated by physics, biology and mathematics to tap into the enormous an external source, an e±cient prover does not have access processing power of personal computers around the world. to auxiliary information about the input. A famous project using the BOINC platform is SETI@home Our Setting and Goal. In this paper, we embark on the study [3, 1], where large chunks of radio transmission data are of interactive proofs in the real world, where both the veri¯er scanned for signs of extraterrestrial intelligence. Anyone and the prover are e±cient. Thus, we replace the unbounded can participate by running a free program that downloads magical Merlin with a\Muggle"prover who is limited to run- and analyzes radio telescope data. Thus, getting many com- ning probabilistic polynomial-time computations. We think puters to pitch into the larger task of scanning space for the of the input to the interactive proof as dictated by an out- existence of extraterrestrial intelligence, and getting people side source, possibly even by the veri¯er. Thus, the prover interested in science at the same time. Another example of a has no auxiliary information to help him in the proving task. similar flavor is the Great Internet Mersenne Prime Search Clearly, if both the prover and the veri¯er are e±cient, [2], where volunteers search for Mersenne prime numbers then the language is tractable (in BPP). This may seem and communicate puzzling at ¯rst glance, since usually one allows the veri¯er 2. Weak Peripheral Devices. More and more, small or to run arbitrary polynomial-time computations, and thus it cheap computational devices with limited computational ca- could compute on its own whether or not the input is in the pabilities, such as cell-phones, printers, cameras, security language! This obviously is not very interesting. Indeed, we access-cards, music players, and sensors, are connected via want veri¯cation to be considerably faster than computing. networks to stronger remote computers whose help they can The question we ask in this work is which polynomial-time use. Consider, for example, a sensor that is presented with computable languages have interactive proofs with a super- an access-card, sends it a random challenge, and receives a e±cient veri¯er and an e±cient prover. We emphasize that digital signature of the random challenge. The computation although we aim for the honest prover to be e±cient, we still required to verify the signature involves public-key opera- require the soundness of the proof system to hold uncondi- tions which are too expensive both in time and space for tionally.