Geppetto: Versatile Verifiable Computation Craig Costello Cedric´ Fournet Jon Howell
[email protected] [email protected] [email protected] Microsoft Research Microsoft Research Microsoft Research Markulf Kohlweiss Benjamin Kreuter Michael Naehrig
[email protected] [email protected] [email protected] Microsoft Research University of Virginia∗ Microsoft Research Bryan Parno Samee Zahur
[email protected] [email protected] Microsoft Research University of Virginia∗ November 2014 Abstract work on verifying computation focused on narrow classes of computation [36, 57], relied on physical-security assump- Cloud computing sparked interest in Verifiable Computation tions [45, 52, 54], assumed uncorrelated failures [21, 22, 40], protocols, which allow a weak client to securely outsource com- or achieved good asymptotics [3, 32, 32, 34, 35, 37, 42, 48] but putations to remote parties. Recent work has dramatically re- impractical concrete performance [51, 56]. duced the client’s cost to verify the correctness of results, but Recently, several lines of work [10, 51, 55, 58] on veri- the overhead to produce proofs largely remains impractical. fiable computation [32] have combined theoretical and engi- Geppetto introduces complementary techniques for reducing neering innovations to build systems that can verify the re- prover overhead and increasing prover flexibility. With Multi- sults of general-purpose outsourced computations while mak- QAPs, Geppetto reduces the cost of sharing state between com- ing at most cryptographic assumptions. Currently, the best putations (e.g., for MapReduce) or within a single computa- performing, fully general-purpose verifiable computation pro- tion by up to two orders of magnitude. Via a careful instantia- tocols [51, 55] are based on Quadratic Arithmetic Programs tion of cryptographic primitives, Geppetto also brings down the (QAPs) [33].