Prover efficient public verification of dense or sparse/structured matrix-vector multiplication

TL;DR

This paper introduces efficient public verification protocols for matrix-vector multiplication that are secure against malicious servers, significantly reducing computational overhead and outperforming existing methods by over two orders of magnitude.

Contribution

The paper presents novel protocols for verifying matrix-vector multiplications that are both secure and highly efficient, especially for sparse or structured matrices, with minimal cryptographic overhead.

Findings

Over two orders of magnitude faster than existing protocols

Linear verification time in the dimension

Limited cryptographic operations for practicality

Abstract

With the emergence of cloud computing services, computationally weak devices (Clients) can delegate expensive tasks to more powerful entities (Servers). This raises the question of verifying a result at a lower cost than that of recomputing it. This verification can be private, between the Client and the Server, or public, when the result can be verified by any third party. We here present protocols for the verification of matrix-vector multiplications, that are secure against malicious Servers. The obtained algorithms are essentially optimal in the amortized model: the overhead for the Server is limited to a very small constant factor, even in the sparse or structured matrix case; and the computational time for the public Verifier is linear in the dimension. Our protocols combine probabilistic checks and cryptographic operations, but minimize the latter to preserve practical efficiency. Therefore our protocols are overall more than two orders of magnitude faster than existing ones.

Tables

Table 1. Table 1: Leading terms for the time and memory complexity bounds (exchange of A 𝐴 A , x 𝑥 x and y 𝑦 y excluded).

Scheme	[6]	[14]	[4]
Mode	Public verif.	Public deleg.	Public deleg.
Preparator (KeyGen)	$2mn\cdot ℱ+mn\cdot 𝒢$	$-$	$2mn\cdot ℱ+2mn\cdot 𝒢$
Trustee (ProbGen)	$2\left(m+n\right)\cdot ℱ+2m\cdot 𝒢$	$mn\cdot ℱ+\left(2m+n\right)\cdot 𝒢$	$n\cdot 𝒢$
Prover (Compute)	$\mu \left(A\right)\cdot ℱ+2mn\cdot 𝒢$	$\mu \left(A\right)\cdot ℱ+2mn\cdot 𝒢$	$\mu \left(A\right)\cdot ℱ+2mn\cdot 𝒢$
Verifier	$2m\cdot 𝒢$	$2m\cdot 𝒢$	$m\cdot 𝒢$
Extra storage	$𝒪\left(mn\right)$	$𝒪\left(mn\right)$	$𝒪\left(mn\right)$
Extra communications	$𝒪\left(m\right)$	$𝒪\left(m\right)$	$𝒪\left(1\right)$

Table 2. Table 2: Matrix-vector multiplication public verification over a 256-bit finite field with different protocols on a i7 @3.4GHz.

	$1000\times 1000$					$2000\times 2000$
	[12]	[6]	[14]	[4]	Fig. 4	[6]	[14]	[4]	Fig. 4
KeyGen	141.68s	152.62s	-	154.27s	0.80s	615.81s	-	612.72s	1.75s
ProbGen	-	1.25s	2.28s	2.30s	-	2.13s	4.98s	4.56s	-
$Ax=y$	20.14s	0.19s	0.19s	0.19s	0.19s	0.78s	0.78s	0.78s	0.78s
Compute	188.60s	273.06s	433.88s	271.03s	2.26s	1097.96s	1715.46s	1079.71s	5.37s
Verify	2.06s	26.62s	27.56s	0.33s	0.90s	52.60s	55.79s	0.62s	1.19s

Table 3. Table 3: Verification of a 8000 × 8000 8000 8000 8000{\times}8000 matrix-vector multiplication with different field sizes via the protocol in Figure  1 on a single core @3.4GHz.

Field size	$\left|𝔾\right|$	Security	KeyGen			Compute			Verify
			Total	$u^{T}A$	overhead	Total	$y=Ax$	overhead
256	256	128	13.65s	12.34s	1.22s	15.72s	13.46s	2.26s	0.03s
10	322	128	1.96s	0.05s	1.81s	0.22s	0.09s	0.13s	0.04s

Table 4. Table 4: Speed-up of our novel Protocol over a 256-bit finite field on a i7 @3.4GHz.

Size	100	200	500	1000	2000	3000	4000
[4]	2.77s	10.93s	67.93s	271.03s	1079.71s	2430.05s	4329.46s
Fig. 7	0.17s	0.34s	0.98s	2.26s	5.37s	9.16s	13.76s
Speed-up	17	32	69	120	201	265	315

Equations

$$U=\left[\begin{array}[]{ccc}u_{1}&\ldots&u_{\sqrt{m}}\\ u_{1+\sqrt{m}}&\ldots&u_{2\sqrt{m}}\\ \ldots&\ldots&\ldots\\ u_{1+m-\sqrt{m}}&\ldots&u_{m}\\ \end{array}\right]~{}~{}\text{and}~{}~{}Y=\left[\begin{array}[]{ccc}y_{1}&\ldots&y_{1+m-\sqrt{m}}\\ y_{2}&\ldots&y_{2+m-\sqrt{m}}\\ \ldots&\ldots&\ldots\\ y_{\sqrt{m}}&\ldots&y_{m}\\ \end{array}\right].$$

$$Trace(\mu \cdot {\eta }^T\cdot Y)={\eta }^T\cdot Y\cdot \mu$$

$$\textstyle{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}Prover}$$

$$H=\left(\prod e(z[i];g_1^{\mu [i]})\right)=e(g_1;g_2{)}^{ab{u}_0^{T}y},$$

$$D_j=\left(\prod e(s_j[i];g_2^{{\rho }_j[i]})\right)\text{for}j=1,2.$$

Full text

1 Introduction

With the emergence of cloud computing services, computationally weak devices (Clients, such as smart phones or tablets) can delegate expensive tasks to more powerful entities (Servers). Such heavy tasks can, e.g., be cryptographic operations, image manipulation or statistical analysis of large data-sets. This raises the question of verifying a result at a lower cost than that of recomputing it. This verification can be private, between the Client and the Server, or public, when the result can be verified by any third party.

For instance within computer graphics (image compression and geometric transformation), graph theory (studying properties of large networks), big data analysis, one deals with linear transformations of large amount of data, often arranged in large matrices with large dimensions that are in the order of thousands or millions in some applications. Since a linear transformation on a vector $x$ can be expressed by a matrix-vector multiplication (with a matrix of size $m{\times}n$), a weak client can use one of the protocols in the literature  [6, 14, 4] to outsource and verify this computation in the optimal time $O(m+n)$, i.e., linear in the input and the output size. However as these protocols use expensive cryptographic operations, such as pairings, the constants hidden in the asymptotic complexity are usually extremely large [13].

In this paper, we propose an alternative protocol, achieving the same optimal behavior, but which is also practical: the overhead for the Prover is now very close to the time required to compute the matrix-vector multiplication, thus gaining two orders of magnitude with respect to the literature. Our protocol not only does this for dense matrices, but is also sensitive to any structure or sparsity of the linear transformation. For this, we first remove any quadratic operation that is not a matrix-vector multiplication (that is we use projections and rank-1 updates) and second we separate operations in the base field from cryptographic operations so as to minimize the latter.

More precisely, we first combine rank-one updates of [6] and the projecting idea of [4] with Freivalds’ probabilistic check [7]. Second, we use a novel strategy of vectorization. For instance, with a security parameter $s$ (e.g., an $s=128$-bits equivalent security), exponentiations or pairings operations usually cost about $O(s^{3})$ arithmetic operations. To make the whole protocol work practical, we thus reduce its cost from ${\mathcal{O}}\left(s^{3}mn\right)$ to ${\mathcal{O}}\left(\mu(A)+s^{3}(m+n^{4/3})\right)$, where $\mu(A)<2mn$ is the cost of one, potentially structured, matrix-vector multiplication. We also similarly reduce the work of the Verifier. This allows us to gain two orders of magnitude on the Prover’s work and therefore on the overall costs of outsourcing, while preserving and sometimes even improving the practical efficiency of the Verifier.

Thus, after some background in Section 2, our first improvement is given in a relaxed public verification setting in Section 3 via matrix projection and probabilistic checks. Our second improvement is given in Section 4 where the verification is bootstrapped efficiently by vectorization. We then show how to combine all improvements in Section 5 in order to obtain a complete and provably secure protocol. Finally, we show in Section 6 that our novel protocol indeed induces a global overhead factor lower than $3$ with respect to non verified computations. This is gaining several orders of magnitude on the Prover side with respect to previously known protocols, while keeping the Verification step an order of magnitude faster.

2 Background and definitions

In this paper, we want to be able to prove fast that a vector is a solution to a linear system, or equivalently that a vector is the product of another vector by a matrix. This is useful, e.g., to perform some statistical analysis on some medical data. We distinguish the matrix, a static data, from the vectors which are potentially diverse. In the following, $\mathbb{F}_{p}$ will denote a prime field and we consider:

• •

Data: matrix $A\in\mathbb{F}_{p}^{m{\times}n}$.

• •

Input: one or several vectors $x_{i}\in\mathbb{F}_{p}^{n}$, for $i=1..k$.

• •

Output: one or several vectors $y_{i}=Ax_{i}\in\mathbb{F}_{p}^{m}$, for $i=1..k$.

Then, we denote by $\star{}$ an operation performed in the exponents (for instance, for $u\in\mathbb{G}^{n}$ and $v\in\mathbb{Z}^{n}$, the operation $u^{T}\star{}v$ actually denotes $\prod_{j=1}^{n}u[j]^{v[j]}$).

Publicly Verifiable Computation

A publicly verifiable computation scheme, in the formal setting of [11], is in fact four algorithms (KeyGen, ProbGen, Compute, Verify), where KeyGen is some (amortized) preparation of the data, ProbGen is the preparation of the input, Compute is the work of the Prover and Verify is the work of the Verifier. Usually the Verifier also executes KeyGen and ProbGen but in a more general setting these can be performed by different entities (respectively called a Preparator and a Trustee). More formally we define these algorithms as follow:

• •

KeyGen$(1^{\lambda},f)\rightarrow(\texttt{param},EK_{f},VK_{f})$: a randomized algorithm run by a Preparator, it takes as input a security parameters $1^{\lambda}$ and the function $f$ to be outsourced. It outputs public parameters param which will be used by the three remaining algorithms, an evaluation key $EK_{f}$ and a verification key $VK_{f}$.

• •

ProbGen$(x)\rightarrow(\sigma_{x})$: a randomized algorithm run by a Trustee which takes as input an element $x$ in the domain of the outsourced function $f$. It returns $\sigma_{x}$, an encoded version of the input $x$.

• •

Compute$(\sigma_{x},EK_{f})\rightarrow(\sigma_{y})$: an algorithm run by the Prover to compute an encoded version $\sigma_{y}$ of the output $y=f(x)$ given the encoded input $\sigma_{x}$ and the evaluation key $EK_{x}$.

• •

Verify$(\sigma_{y},VK_{f})\rightarrow y\text{ or}\perp$: given the encoded output $\sigma_{y}$ and the verification key $VK_{f}$, the Verifier runs this algorithm to determine whether $y=f(x)$ or not. If the verification passes it returns $y$ otherwise it returns an error $\perp$.

Completeness

A publicly verifiable computation scheme for a family of function $\mathcal{F}$ is considered to be perfectly complete (or correct) if for every function belonging to $\mathcal{F}$ and for every input in the function domain, an honest Prover which runs faithfully the algorithm Compute will always (with probability 1) output an encoding $\sigma_{y}$ which will pass Verify.

Soundness

A publicly verifiable computation scheme for a family of function $\mathcal{F}$ is called sound when a prover cannot convince a verifier to accept a wrong result $y^{\prime}\neq y$ except with negligible probability. More formally we evaluate the capability of an adversary $\mathcal{A}$ to deceive the verifier through a soundness experiment. In this experiment, we assume that the adversary $\mathcal{A}$ accesses to the output of the algorithm KeyGen by calling an oracle $\mathcal{O}_{\text{\emph{KeyGen}}}$ with inputs $1^{\lambda}$ and the function to evaluate $f$. This oracle $\mathcal{O}_{\text{\emph{KeyGen}}}$ returns public parameters for the protocol param, an evaluation key $EK_{f}$ and a verification key $VK_{f}$. Afterwards the adversary $\mathcal{A}$ sends its challenge input $x$ to an oracle $\mathcal{O}_{\text{\emph{ProbGen}}}$ which returns $\sigma_{x}$. Finally $\mathcal{A}$ outputs an encoding $\sigma_{y^{*}}\neq\sigma_{y}$ and runs the Verify algorithm on inputs $\sigma_{y^{*}}$ and $VK_{f}$, whether it outputs $y$ or $\perp$ the experiment has either succeeded or failed.

Definition 1**.**

A publicly verifiable computation scheme for a family of function $\mathcal{F}$ is sound if and only if for any polynomially bounded adversary $\mathcal{A}$ and for any $f$ in $\mathcal{F}$ the probability that $\mathcal{A}$ succeeds in the soundness experiment is negligible in the security parameter.

Adversary model

The protocol in [6] (recalled for the sake of completeness in Appendix A) is secure against a malicious Server only. That is the Client must trust both the Preparator and the Trustee. We will stick to this model of attacker in the remaining of this paper. Otherwise some attacks can be mounted:

• •

Attack with a Malicious Preparator only: send $A^{\prime}$ and a correctly associated $W^{\prime}$ to the Server, but pretend that $A$ is used. Then, all verifications do pass, but for $y^{\prime}=A^{\prime}x$ and not $y=Ax$.

• •

Attack with a Malicious Trustee only: there, a malicious assistant can provide a wrong $\text{VK}_{x}$ making the verification fail even if the Server and Preparator are honest and correct.

• •

Attack with Malicious Server and Trustee: the Server sends any $y^{\prime}$ and any $z^{\prime}$ to the Trustee, who computes $\text{VK'}_{x}[i]=e(z^{\prime}[i];g_{2})/a^{y^{\prime}[i]}$, that will match the verification with $y^{\prime}$ and $z^{\prime}$.

Public delegatability

One can also further impose that there is not interaction between the Client and the Trustee after the Client has sent his input to the Server. Publicly verifiable protocols with this property are said to be publicly delegatable [4]. The protocol in [6] does not achieve this property, but some variants in [14, 4] already can.

Bilinear Pairings

The protocols we present in this paper use bilinear pairings and their security is based on the co-CDH assumption, for the sake of completeness we recall hereafter these definitions.

Definition 2** **(bilinear pairing).

Let $\mathbb{G}_{1}$, $\mathbb{G}_{2}$ and $\mathbb{G}_{T}$ be three groups of prime order $p$, a bilinear pairing is a map $e:\mathbb{G}_{1}\times\mathbb{G}_{2}\rightarrow\mathbb{G}_{T}$ with the following properties:

bilinearity*: $\forall{}a,b\in\mathbb{F}_{p},~{}\forall{}(g_{1},g_{2})\in\mathbb{G}_{1}\times\mathbb{G}_{2},~{}e(g_{1}^{a},g_{2}^{b})=e(g_{1},g_{2})^{ab}$;* 2. 2.

non-degeneracy*: if $g_{1}$ and $g_{2}$ are generators of $\mathbb{G}_{1}$ and $\mathbb{G}_{2}$ respectively then $e(g_{1},g_{2})$ is a generator of $\mathbb{G}_{T}$;* 3. 3.

computability*: $\forall(g_{1},g_{2})\in\mathbb{G}_{1}\times\mathbb{G}_{2}$, there exist an efficient algorithm to compute $e(g_{1},g_{2})$.*

Definition 3** **(co-CDH assumption).

Let $\mathbb{G}_{1}$, $\mathbb{G}_{2}$ and $\mathbb{G}_{T}$ be three groups of prime order $p$, such that there exist a bilinear map $e:\mathbb{G}_{1}\times\mathbb{G}_{2}\rightarrow\mathbb{G}_{T}$. Let $g_{1}\in\mathbb{G}_{1}$, $g_{2}\in\mathbb{G}_{2}$ be generators and $a$, b\overset{\}{\leftarrow}\mathbb{F}{p}$be chosen randomly. We say that the co-computational Diffie-Hellman assumption (co-CDH) holds in$\mathbb{G}{1}$, if given$g_{1}$,$g_{2}$,$g_{1}^{a}$,$g_{2}^{b}$the probability to compute$g_{1}^{ab}$ is negligible.

Related work

The work of [6] introduced the idea of performing twice the computations, once in the classical setting and once on encrypted values. This enables the Client to only have to check consistency of both results. The protocol is sound under the Decision Linear and co-CDH hypothesis. Then [14] extended the part on matrix-vector multiplication to matrix-matrix while adding public delegatability. Finally, [4] introduced the idea of projecting the random additional matrix and the extra-computations of the server, which allows to reduce the cost of the Verify algorithm. It also decreases the size of the verification key by a factor $m$. For an $m{\times}n$ dense matrix, the protocol in [6] has a constant time overhead for the Prover, but this constant is on the order of cryptographic public-key operations like pairings. Similarly, the Verifier has ${\mathcal{O}}\left(mn\right)$ cryptographic public-key pre-computations and ${\mathcal{O}}\left(n\right)$ of these for the public verification. These cryptographic operations can then induce some $10^{6}$ slow-down [13] and do no improve even if the initial matrix is sparse or structured (as the rank one updates, $s\cdot t^{T}$ and $\sigma\cdot{}\tau^{T}$, are always dense).

3 A first step towards public verifiability

Freivalds’ probabilistic verification of matrix multiplications [7] allows for private verifiability of matrix-vector computations. This can be naturally extended in the random oracle model via Fiat-Shamir heuristic [5]. This however forces the vectors to be multiplied to be known in advance (the full details are given in Appendix B), whereas our goal is instead to obtain public verifiability with an unbounded number of vector inputs. As an upstart, we thus first present an improvement if the public verification model is slightly relaxed: in this Section, we allow the Trustee to perform some operations after the computations of the Server. We will see in next sections how to remove the need for the Trustee’s intervention. For this, we combine Freivalds projection (to check that $Ax_{i}=y_{i}$, one can first precompute $w^{T}=u^{T}A$ and check that $w^{T}x_{i}=u^{T}y_{i}$) with Fiore & Gennaro’s protocol, in order to improve the running time of both the Trustee and the Client: we let the Prover compute its projection in the group. That way most of the pairings computations of the Trustee and Client are transformed to classical operations: the improvement is from ${\mathcal{O}}\left(n\right)$ cryptographic operations to ${\mathcal{O}}\left(n\right)$ classical operations and a single cryptographic one. Further, the projection can be performed beforehand, during the precomputation phase. That way the preparation requires only one matrix-vector for the Freivalds projection and the dense part is reduced to a single vector. The cryptographic operations can still be delayed till the last check on pairings. This is shown in Figure 1.

Theorem 4**.**

The protocol of Figure 1 is perfectly complete and sound under the co-Computational Diffie-Hellman assumption.

The proof of Theorem 4 is given in Appendix C.

4 Verifying the dot-products by bootstrapping and

vectorization

To obtain public verifiability and public delegatability, the Client should perform both dot-products, $u^{T}\cdot{}y$ and $t^{T}\cdot{}x$ (from now on, for the sake of simplicity, we drop the indices on $x$ and $y$). But as $u$ and $t$ must remain secret, they will be encrypted beforehand. To speed-up the Client computation, the idea is then to let the Server perform the encrypted dot-products and to allow the Client to verify them mostly with classical operations.

For this trade-off, we use vectorization. That is, for the vectors $u$ and $y$, we form another representation as $\sqrt{m}{\times}\sqrt{m}$ matrices:

[TABLE]

Then $u^{T}\cdot{}y=Trace(UY)$. Computing with this representation is in general slower than with the direct dot-product, ${\mathcal{O}}\left(\sqrt{m}^{3}\right)$ instead of ${\mathcal{O}}\left(m\right)$. As shown next, this can be circumvented with well-chosen left-hand sides and at least mitigated, with unbalanced dimensions.

4.1 dot-product with rank 1 left-hand side

The first case is if $u$ is of rank $1$, that is if in matrix form, $u$ can be represented by a rank one update, $U=\mu\cdot\eta^{T}$ for $\mu,\eta\in\mathbb{F}_{p}^{\sqrt{m}}$. Then both representations require roughly the same number of operations to perform a dot-product since then:

[TABLE]

Therefore, we let the Prover compute $z^{T}=g_{1}^{\eta^{T}}\star{}Y$, where $z[i]=g_{1}^{\sum\eta[j]Y[j,i]}$, and then the Verifier can check this value via Freivalds with a random vector $v$: $g_{1}^{\eta^{T}}\star\left(Y\cdot{}v\right)\mathrel{\stackrel{{\scriptstyle?}}{{=\!=}}}{}z^{T}\star{}v$. The point is that the Verifier needs now ${\mathcal{O}}\left(m\right)$ operations to compute $\left(Y\cdot{}v\right)$, but these are just classical operations over the field. Then its remaining operations are cryptographic but there is only ${\mathcal{O}}\left(\sqrt{m}\right)$ of these. Finally, the Verifier concludes the computation of the dotproduct, still with cryptographic operations, but once again with only ${\mathcal{O}}\left(\sqrt{m}\right)$ of them. Indeed, the dot product $d=u^{T}y=Trace(UY)=Trace(\mu\cdot\eta^{T}\cdot{}Y)=\eta^{T}\cdot{}Y\cdot{}\mu$ is checked by $e(g_{1}^{d};g_{2})=e(g_{1};g_{2})^{d}=\prod_{i=1}^{\sqrt{m}}e(z[i];g_{2}^{\mu[i]})$ and the latter is $e(g_{1};g_{2})^{\sum\sum\mu[i]\eta[j]Y[j,i]}=e(g_{1};g_{2})^{\eta^{T}\cdot{}Y\cdot{}\mu}$.

In practice, operations in a group can be slightly faster than pairings. Moreover $\lceil\sqrt{m}\rceil^{2}$ can be quite far off $m$. Therefore it might be interesting to use a non square vectorization $b_{1}{\times}b_{2}$, as long as $b_{1}b_{2}\geq m$ and $b_{1}+b_{2}={\Theta}\left(\sqrt{m}\right)$ (and [math] padding if needed). Then we have $U\in\mathbb{F}_{p}^{b_{1}{\times}b_{2}}$, $\mu\in\mathbb{F}_{p}^{b_{1}}$, $\eta\in\mathbb{F}_{p}^{b_{2}}$, $Y\in\mathbb{F}_{p}^{b_{2}{\times}b_{1}}$ and $z\in\mathbb{G}_{2}^{b_{1}}$. The obtained protocol can compute $e(g_{1};g_{2})^{u^{T}\cdot{}y}$ with ${\mathcal{O}}\left(\sqrt{m}\right)$ cryptographic operations on the Verifier side and is given in Figure 2.

Lemma 5**.**

The protocol of Figure 2 for publicly delegation of a size $m$ external group dot-product verification with rank-$1$ left hand side is sound, perfectly complete and requires the following number of operations where $b_{1}b_{2}\geq m$ and $b_{1}+b_{2}={\Theta}\left(\sqrt{m}\right)$:

• •

Preparation: ${\mathcal{O}}\left(b_{1}{+}b_{2}\right)$ in $\mathbb{G}_{i}$;

• •

Prover: ${\mathcal{O}}\left(m\right)$ in $\mathbb{G}_{i}$;

• •

Verifier: ${\mathcal{O}}\left(m\right)$ in $\mathbb{F}_{p}$, ${\mathcal{O}}\left(b_{1}{+}b_{2}\right)$ in $\mathbb{G}_{i}$ and ${\mathcal{O}}\left(b_{1}\right)$ pairings.

Proof.

Correctness is ensured by Equation (1). Soundness is given by Freivalds check. Complexity is as given in the Lemma: indeed, for the Verifier, we have: for $Y\cdot{}v$: ${\mathcal{O}}\left(b_{2}b_{1}\right)={\mathcal{O}}\left(m\right)$ classic operations; for $g_{1}^{\eta^{T}}\star(Yv)$: ${\mathcal{O}}\left(b_{2}\right)$ cryptographic (group) operations; for $z^{T}\star{}v$: ${\mathcal{O}}\left(b_{1}\right)$ cryptographic (group) operations; and for $\displaystyle\prod_{i=1}^{b_{1}}e(z[i];g_{2}^{\mu[i]})$: ${\mathcal{O}}\left(b_{1}\right)$ cryptographic (pairings) operations. Then the preparation requires to compute $g_{1}^{\eta}\in\mathbb{G}_{1}^{b_{2}}$ and $g_{2}^{\mu}\in\mathbb{G}_{1}^{b_{1}}$, while the Prover needs to compute $g_{1}^{\eta^{T}}\star{}Y$ for $Y\in\mathbb{F}_{p}^{b_{2}{\times}b_{1}}$ and $b_{1}b_{2}={\mathcal{O}}\left(m\right)$. ∎

4.2 Rectangular general dot-product

Now if $u$ is not given by a rank $1$ update, one can still verify a dot-product with only ${\mathcal{O}}\left(\sqrt{m}\right)$ pairings operations but as the price of slightly more group operations as given in Figure 3.

Lemma 6**.**

The protocol of Figure 3 is sound, perfectly complete and requires the following number of operations with $b_{1}b_{2}\geq m$:

• •

Preparation: ${\mathcal{O}}\left(m\right)$ in $\mathbb{F}_{p}$ and ${\mathcal{O}}\left(m\right)$ in $\mathbb{G}_{i}$;

• •

Prover: ${\mathcal{O}}\left(mb_{1}\right)$ in $\mathbb{G}_{1}$;

• •

Verifier: ${\mathcal{O}}\left(m\right)$ in $\mathbb{F}_{p}$, ${\mathcal{O}}\left(b_{1}^{2}{+}b_{2}\right)$ in $\mathbb{G}_{i}$ and ${\mathcal{O}}\left(b_{1}\right)$ pairings.

Proof.

Correctness is ensured by the vectorization in Equation (1). Soundness is given by the Freivalds check. Complexity is as given in the Lemma: indeed, for the Verifier, we have:

$Y\cdot{}v$: ${\mathcal{O}}\left(b_{2}b_{1}\right)={\mathcal{O}}\left(m\right)$ classic operations; 2. 2.

$g_{1}^{w^{T}U}\star(Yv)$: ${\mathcal{O}}\left(b_{2}\right)$ cryptographic (group) operations; 3. 3.

$z=C\star{}v$: ${\mathcal{O}}\left(b_{1}^{2}\right)$ cryptographic (group) operations; 4. 4.

$\displaystyle\prod_{i=1}^{b_{1}}e(z[i];g_{2}^{w[i]})$: ${\mathcal{O}}\left(b_{1}\right)$ cryptographic (pairings) operations;

Then the preparation requires to compute $w^{T}{\times}U$. This is ${\mathcal{O}}\left(b_{1}b_{2}=m\right)$ operations. Finally, the Prover needs to compute the matrix multiplication $g_{1}^{U}\star{}Y$ for $U\in\mathbb{F}_{p}^{b_{1}{\times}b_{2}}$ and $Y\in\mathbb{F}_{p}^{b_{2}{\times}b_{1}}$, in ${\mathcal{O}}\left(b_{1}^{2}b_{2}\right)={\mathcal{O}}\left(mb_{1}\right)$. ∎

Therefore, one can take $b_{1}={\mathcal{O}}\left(\sqrt[3]{m}\right)$ and $b_{2}={\mathcal{O}}\left(m^{2/3}\right)$ which gives only ${\mathcal{O}}\left(m^{2/3}\right)$ cryptographic operations for the Verifier, and ${\mathcal{O}}\left(m^{4/3}\right)$ cryptographic operations for the Prover. Now a dot-product can be cut in $\frac{n}{k}$ chunks of size $k$. Then Each chunk can be checked with the protocol of Figure 3 and the final dot-product obtained by adding the chunks. This gives the complexity of Corollary 7.

Corollary 7**.**

There exist a protocol for the dot-product using: ${\mathcal{O}}\left(n^{1-a/3}\right)$ cryptographic operations for the Verifier and ${\mathcal{O}}\left(n^{1+a/3}\right)$ cryptographic operations for the Prover, for any $0<a<1$.

Proof.

We let $k=n^{a}$ and use $n/k$ times the protocol of the previous point with $b_{1}=\sqrt[3]{k}$ and $b_{2}=k^{\frac{2}{3}}$. Overall this gives $n/k(k^{4/3})$ for the Prover and $n/k(k^{2/3})$ for the Verifier. ∎

5 Public delegatability via bootstrapping

To recover the public delegatability model, we use the protocol of Figure 1 but we trade back some cryptographic operations using the protocol of Figure 2 to the Verifier. With an initial matrix $A\in\mathbb{F}_{p}^{m{\times}n}$ we however trade back only on the order of ${\mathcal{O}}\left(\sqrt{m}+\sqrt{n}\right)$ cryptographic operations. This gives a slower verification in practice but interaction is not needed anymore. We present our full novel protocol for matrix vector product in Figure 4 (with the flow of exchanges shown in Figure 7, Appendix E).

Apart from Freivalds’s checks and vectorization, we need to use a masking of the form $u^{T}A+t^{T}$ (see Figure 1) indistinguishable from a random distribution, but:

We have to add an extra component $\gamma\delta v^{T}$ to $u^{T}A+t^{T}$ so that it is possible, when proving the reduction to co-CDH, to make up a random vector $\omega^{T}=g^{u^{T}A+t}$ where the components of $u^{T}A+t^{T}$ are canceled out. This component cannot be revealed to the Prover nor the Verifier, otherwise its special structure could have been taken into account by the reduction. Also this component cannot have the rank-$1$ update structure as its has to be a multiple of $u^{T}A+t^{T}$. Therefore only the protocol of Figure 3 can be used to check the dotproduct with $g^{v^{T}}$. 2. 2.

To be able to apply the analysis of [6, Theorem 3] while allowing fast computations with $t$, we use a special form for $t$, namely: $t^{T}=\rho_{1}\tau_{\mathstrut 1}^{T}+\rho_{2}\tau_{2}^{T}$.

With these modifications we are able to prove the soundness of the protocol in Figure 4.

Theorem 8**.**

Let $A\in\mathbb{F}_{p}^{m{\times}n}$ whose matrix-vector products costs $\mu(A)$ arithmetic operations. Protocol 4 is sound under the co-CDH assumption, perfectly complete and its number of performed operations is bounded as follows:

[TABLE]

The proof of Theorem 8 is given in Appendix E.

Remark 9**.**

Fast matrix multiplication can be used for the computation of $C$ in the protocol of Figure 4. This decreases the ${\mathcal{O}}\left(n^{4/3}\right)$ factor of the Prover to ${\mathcal{O}}\left(n^{(1+\omega)/3}\right)$ where $\omega$ is the exponent of matrix-matrix multiplication. The currently best known exponent, given in [8], is $\omega\leq{}2.3728639$. This immediately yields a reduced bound for the Prover of $\mu(A)+{\mathcal{O}}\left(m+n^{1.12428797}\right)$. This together with Corollary 7 can produce a protocol with Prover complexity bounded by $\mu(A)+{\mathcal{O}}\left(m+n^{1+0.12428797a}\right)$, for any $0<a<1$, while the Verifier complexity is ${\mathcal{O}}\left(n\right)$ classical operations and $o(n)$ cryptographic operations.

6 Conclusion and experiments

We first recall in Table 1 the leading terms of the complexity bounds for our protocols and those of [6, 14, 4] (that is each value $x$ in a cell is such that the actual cost is bounded by $x+o(x)$).

There, we denote the base field operations by ${}\cdot{\mathcal{F}}$, the cryptographic group exponentiations or pairing operations by ${}\cdot{\mathcal{G}}$, and the cost of a product of the matrix $A\in\mathbb{F}_{p}^{m{\times}n}$ by a vector is $\mu(A)$.

We see that our protocols are suitable to sparse or structured matrix-vector multiplication as they never require ${\mathcal{O}}\left(mn\right)$ operations but rather $\mu(A)$. Moreover, we see that most of the Verifier’s work is now in base field operations were it was cryptographic operations for previously known protocols.

As shown in Table 2 and in Figure 5, this is very useful in practice, even for dense matrices. For these experiments we compare with our own implementations of the protocols of [6, 14, 4] over the PBC library111https://crypto.stanford.edu/pbc, version 0.5.14 [9] for the pairings and the FFLAS-FFPACK library222http://linbox-team.github.io/fflas-ffpack, version 2.2.2 [3] for the exact linear algebra over finite fields (C++ source files are available on request via the PC and will be publicly posted on our web site if the paper is accepted).

We used randomly generated dense matrices and vectors and to optimize the costs (pairings are more expensive than exponentiations), we also chose the following parameters for the vectorizations: $b_{1}=\lceil\sqrt{m}/10\rceil{}$; $b_{2}=\lceil{}10\sqrt{m}\rceil{}$; $c_{1}=\lceil{}\sqrt{n}/10\rceil{}$; $c_{2}=\lceil{}10\sqrt{n}\rceil{}$; $d_{1}=\lceil{}n^{1/3}/3\rceil{}$; $d_{2}=\lceil{}3n^{2/3}\rceil{}$. We indeed chose a type 3 pairing over a Barreto-Naehrig curve [1] based on a 256-bits prime field, which should guarantee 128 bits of security. First, with $\mathbb{F}_{p}$ the $256$-bits prime field333$p=57896044618658115533954196422662521694340972374557265300857239534749215487669$, $\mathbb{G}_{1}$ is the group of $\mathbb{F}_{p}$-rational points $E(\mathbb{F}_{p})$ with parameters: $\mathbb{G}_{1}~{}(E):y^{2}=x^{3}+6$, modulo $p$. Second, $\mathbb{G}_{2}$ is a subgroup of a sextic twist of $E$ defined over $\mathbb{F}_{p^{2}}$ denoted $E^{\prime}(\mathbb{F}_{p^{2}})$ with parameters444$a_{0}{=}52725052272451289818299123952167568817548215037303638731097808561703910178375$, $a_{1}{=}39030262586549355304602811636399374839758981514400742761920075403736570919488$: $\mathbb{G}_{2}~{}(E^{\prime}):y^{2}=x^{3}+6e$, $\mathbb{F}_{p^{2}}\cong\mathbb{F}_{p}[X]/(X^{2}-2)$, $e=a_{0}+a_{1}X\in\mathbb{F}_{p^{2}}$. The third group $\mathbb{G}_{T}$ is then a subgroup of the multiplicative group of the field $\mathbb{F}_{p^{12}}$. This curve is reasonably well-suited to our needs and is supported by the PBC library. We used it for our own implementation of the three protocols [6, 14, 4] as well as for ours, Section 5 and Figure 7.

In the first set of timings of Table 2, we also compare the latter protocols with a compiled verifiable version obtained via the Pepper software555https://github.com/pepper-project/pepper, git: fe3bf04 [12]. This software uses a completely different strategy, namely that of compiling a C program into a verifiable one. We added the timings for $n=1000$ as a comparison, but the Pepper compilation thrashed on our 64 GB machine for $n\geq{}2000$.

In terms of Prover time, we see that our protocols are between two to three orders of magnitude faster than existing ones (further evidence is given in Table 4, Appendix E). Moreover, overall we see that with the new protocol, the data preparation (KeyGen) is now very close to a single non-verified computation and that the work of the Prover can be less than three times that of a non-verified computation (note first, that in both Table 2 and Figure 5, the “Compute” fields include the computation of $y=Ax$, and, second, that the Prover overhead being asymptotically faster than the compute time, this latter overhead is rapidly amortized). Finally, only the protocol of [4] did exhibit a verification step faster than the computation itself for size $2000{\times}2000$ whereas, as shown in Figure 5, our protocol achieves this only from size $3000{\times}3000$. However, we see that we are competitive for larger matrices. Moreover, as shown by the asymptotics of Theorem 8, our overall performance outperforms all previously known protocols also in practice, while keeping an order of magnitude faster Verification time.

Appendix A Fiore and Gennaro’s protocol

For the sake of completeness, we present here the original protocol for matrix-vector verification in [6], but with our rank-one update view. It stems from the fact that if $s,t,\rho,\tau$ are randomly generated vectors then the function $g^{M[i,j]}$, where $M=s\cdot{}t^{T}+\rho\cdot\tau^{T}$, is a pseudorandom function [6, Theorem 3], provided that the Decision Linear assumption [6, Definition 3] holds (a generalization of the External Diffie-Hellman assumption for pairings).

• •

KeyGen: for $A\in\mathbb{F}_{p}^{m{\times}n}$, generate 3 multiplicative groups $(\mathbb{G}_{1},\mathbb{G}_{2},\mathbb{G}_{T})$ of prime order $p$, with $g_{1}$ generating $\mathbb{G}_{1}$ (resp. $g_{2}$ generating $\mathbb{G}_{2}$), and a bilinear map $e:\mathbb{G}_{1}{\times}\mathbb{G}_{2}\rightarrow\mathbb{G}_{T}$. Generate $2(m+n)$ secret random values $s\in\mathbb{F}_{p}^{m}$, $t\in\mathbb{F}_{p}^{n}$, $\rho\in\mathbb{F}_{p}^{m}$, $\tau\in\mathbb{F}_{p}^{n}$. Compute $W[i,j]=g_{1}^{\alpha A[i,j]+s[i]t[j]+\rho[i]\tau[j]}\in\mathbb{G}_{1}$, give $W$ to the server and publish $a=e(g_{1}^{\alpha},g_{2})\in\mathbb{G}_{T}$.

Let $x\in\mathbb{F}_{p}^{n}$ be a query vector

• •

ProbGen: compute $\text{VK}_{x}\in\mathbb{G}_{T}^{m}$, such that $d=t^{T}\cdot{}x\in\mathbb{F}_{p}$, $\delta=\tau^{T}\cdot{}x\in\mathbb{F}_{p}$, and $\text{VK}_{x}[i]=e(g_{1}^{s[i]d+\rho[i]\delta};g_{2})\in\mathbb{G}_{T}$.

• •

Compute: compute $y=Ax$ and $z=W\star{}x\in\mathbb{G}_{1}^{m}$ (that is $z[i]=\prod_{j=1}^{n}W[i,j]^{x[j]}$).

• •

Verify: check that $e(z[i];g_{2})=a^{y[i]}\text{VK}_{x}[i]$, for all $i=1,\ldots,m$.

In this protocol, the flow of communications is as follows:

Preparator: secret random $\alpha\in\mathbb{F}_{p}$, $s\in\mathbb{F}_{p}^{m}$, $t\in\mathbb{F}_{p}^{n}$, $\rho\in\mathbb{F}_{p}^{m}$, $\tau\in\mathbb{F}_{p}^{n}$. then $W=g_{1}^{\alpha A+s\cdot{}t^{T}+\rho\cdot{}\tau^{T}}$ 2. 2.

Preparator to Prover: $A\in\mathbb{F}_{p}^{m{\times}n}$, $W\in\mathbb{G}_{1}^{m{\times}n}$. 3. 3.

Preparator to Trustee: $s$, $\rho$, $t$, $\tau$, in a secure channel. 4. 4.

Preparator publishes and signs $a=e(g_{1};g_{2})^{\alpha}\in\mathbb{G}_{T}$. 5. 5.

Verifier to both Prover and Trustee: $x\in\mathbb{F}_{p}^{n}$. 6. 6.

Trustee publishes and signs $\text{VK}_{x}\in\mathbb{G}_{T}^{m}$ such that : $\text{VK}_{x}=e(g_{1};g_{2})^{s\cdot{}(t^{T}\cdot{}x)+\rho\cdot{}(\tau^{T}\cdot{}x)}$. 7. 7.

Prover to Verifier: $y\in\mathbb{F}_{p}^{m}$, $z\in\mathbb{G}_{1}^{m}$. 8. 8.

Verifier public verification: $e(z;g_{2})\mathrel{\stackrel{{\scriptstyle?}}{{=\!=}}}{}a^{y}\text{VK}_{x}$ (component-wise in $\mathbb{G}_{T}^{m}$).

This protocol is sound, complete and publicly verifiable. It however uses many costly exponentiations and pairings operations that renders it inefficient in practice: even though the Client and Trustee number of operations is linear in the vector size, it takes still way longer time that just computing the matrix-vector product in itself, as shown in the experiment Section 6.

In this paper, our aim was first to adapt this protocol to the sparse/structured case, and, second, to reduce the number of cryptographic operations in order to obtain a protocol efficient in practice.

Appendix B Probabilistic verification and the random oracle model

First we recall that private verification is very fast and does not require any cryptographic routines. Then we show that this allows to obtain a very efficient protocol in the random oracle model, but for a fixed number of inputs.

B.1 Private verification

Without any recourse to cryptography, it is well known how to privately verify a matrix-vector multiplication. The idea is to use Freivalds test [7], on the left, provided that multiplication by the transpose matrix is possible:

•

Verifier to Prover: $A$, $x_{i}\in\mathbb{F}_{p}^{n}$, for $i=1,\ldots,k$.

•

Prover to Verifier: $y_{i}\in\mathbb{F}_{p}^{m}$, for $i=1,\ldots,k$.

•

Verifier verification: random $u\in\mathbb{F}_{p}^{m}$, then $w^{T}=u^{T}\cdot{}A$, and finally check, for $i=1,\ldots,k$, that $w^{T}\cdot{}x_{i}\mathrel{\stackrel{{\scriptstyle?}}{{=\!=}}}{}u^{T}\cdot{}y_{i}$ in $\mathbb{F}_{p}$.

On the one hand, this protocol uses only classical arithmetic and is adaptable to sparse matrices, that is when a matrix vector product costs $\mu(A)$ operations with $\mu(A)<2mn$ (this is the case for instance if the matrix is not structured but is sparse with $\mu(A)/2<mn$ non-zero elements). Indeed, in the latter case, the cost for the Prover is $k\mu(A)$, where the cost for the Verifier is $\mu(A)+4kn$.

On the other hand, the protocol has now Freivalds probability of revealing an error in any of the $y_{i}$: $1-1/p$, if $\mathbb{F}_{p}$ is of cardinality $p$ (or $1-1/p^{\ell}$ if $u$ is chosen in an extension of degree $\ell$ of $\mathbb{F}_{p}$).

B.2 Public verification in the random oracle model

Using Fiat-Shamir heuristic [5], the privately verifiable certificate of Section B.1 can be simulated non-interactively: uniformly sampled random values produced by the Verifier are replaced by cryptographic hashes (to prove security in the random oracle model) of the input and of previous messages in the protocol. Complexities are preserved, as producing cryptographically strong pseudo-random bits by a cryptographic hash function (e.g., like the extendable output functions of the SHA-3 family defined in [2, 10]), is linear in the size of both its input and output (with atomic operations often even faster than finite field ones):

•

Preparator to Prover: $A\in\mathbb{F}_{p}^{m{\times}n}$.

•

Verifier to Prover: $x_{i}\in\mathbb{F}_{p}^{n}$, for $i=1,\ldots,k$.

•

Prover to Verifier: $y_{i}\in\mathbb{F}_{p}^{m}$, for $i=1,\ldots,k$.

•

Verifier to Trustee: all the $x_{i}$ and $y_{i}$.

•

Trustee publishes and signs both $u\in\mathbb{F}_{p}^{m}$ and $w\in\mathbb{F}_{p}^{n}$ such that: $u=Hash(A,x_{1},\ldots,x_{k},y_{1},\ldots,y_{k})\in\mathbb{F}_{p}^{m}$, then $w^{T}=u^{T}\cdot{}A\in\mathbb{F}_{p}^{n}$.

•

Verifier public verification: $w^{T}\cdot{}x_{i}\mathrel{\stackrel{{\scriptstyle?}}{{=\!=}}}{}u^{T}\cdot{}y_{i}$ in $\mathbb{F}_{p}$.

There is absolutely no overhead for the Prover; the cost for the Trustee is a single matrix-vector product for any $k$ plus a cost linear in the input size; and the cost for the Verifier is ${\mathcal{O}}\left(nk\right)$. Using Fiat-Shamir heuristic this gives a possibility for an afterwards public verification (that is after the computations), but this not possible to test new vectors once $u$ has been revealed.

Appendix C Proof of Theorem 4

We here give the proof of Theorem 4, page 4, recalled hereafter.

Theorem 0**.**

The protocol of Figure 1 is perfectly complete and sound under the co-Computational Diffie-Hellman Problem assumption.

Proof.

For the correctness, we have that: $\zeta_{i}=g_{1}^{(u^{T}A+t^{T})\cdot{}x_{i}}=g_{1}^{u^{T}\cdot{}y_{i}+t^{T}\cdot{}x_{i}}=g_{1}^{h_{i}}g_{1}^{d_{i}}=g_{1}^{h_{i}+d_{i}}$. Then, by bilinearity, $e(\zeta_{i};g_{2})=e(g_{1};g_{2})^{h_{i}+d_{i}}=\eta_{i}$.

For the soundness, a malicious Prover can guess the correct output values, but this happens once in the number of elements of $\mathbb{G}_{T}$. Otherwise he could try to guess some matching $h_{i}$ and $d_{i}$, but that happens less than one in the number of elements of $\mathbb{F}_{p}$. Finally, the Prover could produce directly $\zeta_{i}$. Suppose then it is possible to pass our verification scheme for some $A$, $x$ and $y^{\prime}\neq{}y=Ax$. Then without loss of generality, we can suppose that the first coefficients of both vectors are different, $y^{\prime}[1]\neq{}y[1]$ (via row permutations) and that $y^{\prime}[1]-y[1]=1$ (via a scaling).

Take a co-computational Diffie-Hellman problem $(g_{1}^{c},g_{2}^{d})$, where $g_{1}^{cd}$ is unknown. Then denote by $a=e(g_{1}^{c};g_{2}^{d})=e(g_{1}^{cd};g_{2})$ and consider the vector $z^{T}=[a,e(1;1),\ldots,e(1;1)]$. Compute $\chi^{T}=z^{T}\star{}A$. The latter correspond to $\chi^{T}=e(g_{1}^{u^{T}A};g_{2})$ for (a not computed) $u^{T}=[cd,0,\ldots,0]$. Now randomly choose $\psi^{T}=[\psi_{1},\ldots,\psi_{n}]$ and compute $\omega^{T}=g_{1}^{\psi^{T}}$. Compute also the vector $\phi^{T}=e(\omega^{T};g_{2})/\chi^{T}$ coefficient-wise. The latter correspond to $\phi^{T}=e(g_{1}^{t^{T}};g_{2})$ for $t^{T}=\psi^{T}-u^{T}A$. Finally, compute $\zeta=g_{1}^{\psi^{T}\cdot{}x}$ (indeed, then $\mu=e(\zeta;g_{2})=e(g_{1}^{\psi^{T}\cdot{}x};g_{2})=\eta=e(g_{1}^{u^{T}\cdot{}y};g_{2})e(g_{1}^{t^{T}\cdot{}x};g_{2})$, that is $\eta=(\chi^{T}\star{}x)(\phi^{T}\star{}x)$ is actually $\eta=(z^{T}\star{}y)(\phi^{T}\star{}x)$). Now, if it is possible to break the scheme, then it is possible to compute $\zeta^{\prime}$ that will pass the verification for $y^{\prime}$ as $Ax$, that is $e(\zeta^{\prime};g_{2})=(z^{T}\star{}y^{\prime})(\phi^{T}\star{}x)$. Let $h=u^{T}y$, $d=t^{T}x$ and $h^{\prime}=u^{T}y^{\prime}$. Then $e(\zeta;g_{2})=e(g_{1}^{h};g_{2})e(g_{1}^{d};g_{2})$ and $e(\zeta^{\prime};g_{2})=e(g_{1}^{h^{\prime}};g_{2})e(g_{1}^{d};g_{2})$. But $h^{\prime}-h=u^{T}(y^{\prime}-y)=cd(y^{\prime}[1]-y[1])=cd$ by construction. Therefore $\zeta^{\prime}/\zeta=g_{1}^{cd}$, as $e$ is non-degenerate, and the co-CDH is solved. ∎

Appendix D Small fields

The protocol of Figure 1 is quite efficient. We have made experiments with randomly generated dense matrices and vectors with the PBC library11footnotemark: 1 for the pairings and the FFLAS-FFPACK library22footnotemark: 2 for the exact linear algebra over finite fields. For instance, it is shown in Table 3, that for a $8000{\times}8000$ matrix over a field of size $256$ bits, the protocol is highly practical: first, if the base field and the group orders are of similar sizes, the verification phase is very efficient; second, the overhead of computing $\zeta$ for the server is quite negligible and third, the key generation is dominated by the computation of one matrix-vector product.

Differently, if the base field is small, say machine word-size, then having to use cryptographic sizes for the group orders can be penalizing for the Key Generation: multiplying a small field matrix $A$ with a large field vector $u^{T}$ is much slower than $y=Ax$ with $x$ and $A$ small. First of all, the computations must be compatible. For this, one possibility is to ask and verify instead for $y=Ax$ over $\mathbb{Z}$ and then to let the Verifier compute $y\mod{}p$ for himself. There, to reduce the overhead of computing $u^{T}A$, one can instead select the $m$ values of the vector $u$ as $u_{\ell}=\alpha r_{i}s_{j}$ with $\ell=i\lceil\sqrt{m}\rceil{}+j$ for $\alpha$ a randomly chosen large value and $r_{i},s_{j}$ some randomly chosen small values. Indeed then $u^{T}A$ can be computed by first performing $(rs^{T})A$ via ${\mathcal{O}}\left(\sqrt{m}\right)$ matrix-vector computations with $s$ (or a $\sqrt{m}{\times}n\sqrt{m}$ matrix-vector multiplication) followed by ${\mathcal{O}}\left(n\sqrt{m}\right)$ multiplications by $r$ (or a $n{\times}\sqrt{m}$ matrix-vector multiplication) where $s_{j}$ and $r_{i}$ are small values. Then it remains only to multiply a vector of small values by $\alpha$. We have traded ${\mathcal{O}}\left(mn\right)$ operations with large values for ${\mathcal{O}}\left(\sqrt{m}n\sqrt{m}+n\sqrt{m}\right)$ operations with small values and ${\mathcal{O}}\left(n\right)$ with large values.

Now, in order for the values to remain correct over $\mathbb{Z}$, the value of $(u^{T}A+t^{T})x$ must not overflow. For this, one must choose a group order larger than $mnp^{4}$ (for $(rs^{T})Ax$). Now the security is not anymore half the size of the group order but potentially half the size of the set from which $t^{T}$ is selected, that is at most the group order size minus that of $np$ (for $t^{T}x$). To be conservative we even propose, as an estimated security of the obtained protocol, to consider only half the size of $\alpha$ (that is the size of the group order minus that of $mnp^{4}$). In terms of efficiency, the improvement is shown in Table 1, last row. On the one hand, the key generation is now dominant and can be amortized only after about $10$ matrix-vector multiplications. On the other hand, the verification time starts to be faster than the computation time. This is also shown in Figure 6 where the equivalent of the last row in Table 3 is shown for different matrix dimensions.

Appendix E Proven publicly delegatable protocol with negligible

cryptographic operations

We first give the proof of Theorem 8, page 8, recalled hereafter, for the correctness, soundness and complexity of the protocol in Figures 4 and 7. The flow of exchanges within our protocol is also illustrated in Figure 7.

Theorem 0**.**

Let $A\in\mathbb{F}_{p}^{m{\times}n}$ whose matrix-vector products costs $\mu(A)$ arithmetic operations. Protocol 4 is sound under the co-CDH assumption. It is also perfectly complete and its number of performed operations is bounded as follows:

[TABLE]

Proof.

Completeness stems again directly from Equation (1).

For the complexity bounds, we fix $b_{1}b_{2}\geq{}m$ and $b_{1}+b_{2}={\Theta}\left(\sqrt{m}\right)$ (usually, pairing operations are costlier than group operations, therefore a good practice could be to take $b_{1}<b_{2}$ and we, for instance, often have used $b_{2}=100b_{1}$ with $b_{1}b_{2}\approx{}m$ which gave us a speed-up by a factor of $5$), $c_{1}c_{2}\geq{}n$ and $c_{1}+c_{2}={\Theta}\left(\sqrt{n}\right)$, and finally $d_{1}={\mathcal{O}}\left(m^{1/3}\right)$ and $d_{2}={\mathcal{O}}\left(m^{2/3}\right)$. For the Prover, we then have that $y$ obtained in $\mu(A)$ operations; $\zeta$ in ${\mathcal{O}}\left(n\right)$; $s_{1}$, $s_{2}$ and $z$ computations are bounded by ${\mathcal{O}}\left(n+m\right)$ where $C$ thus requires ${\mathcal{O}}\left(n^{4/3}\right)$ operations. The cost for the preparation is ${\mathcal{O}}\left(m+n\right)$ for $U$, $T$ and $\varpi^{T}V$. $\omega$ requires $\mu(A)+2m$ classical operations and ${\mathcal{O}}\left(m\right)$ group operations. $(g_{1}^{\delta})^{V^{T}}$ requires ${\mathcal{O}}\left(n\right)$ group operations while $g_{1}^{\tau_{i}}$, $g_{1}^{\eta_{i}}$, $g_{2}^{\rho_{i}}$, and $g_{2}^{\mu_{i}}$, require ${\Theta}\left(\sqrt{m}+\sqrt{n}\right)$ operations, more than for $(g_{2}^{\gamma})^{\varpi^{T}}$ and $(g_{1}^{\delta})^{\varpi^{T}V}$. The complexity for the Verifier is then dominated by ${\mathcal{O}}\left(n^{2/3}\right)$ operations to check $C$, ${\mathcal{O}}\left(n\right)$ classical operations for $Y\cdot{}v_{3}$ and ${\mathcal{O}}\left(\sqrt{n}\right)$ pairing operations.

Finally for the soundness, assume that there is an adversary $\mathcal{A}$ that breaks the soundness of our protocol with non-negligible advantage $\epsilon$ for a matrix $A\in\mathbb{F}_{p}^{m\times n}$. In the following we will prove how an adversary $\mathcal{B}$ can use adversary $\mathcal{A}$ to break the co-CDH assumption with non-negligible advantage $\epsilon^{\prime}\simeq\epsilon$. Let assume that $\mathcal{B}$ was given a co-CDH sample $(L=g_{1}^{a},R=g_{2}^{b})$. First $\mathcal{B}$ simulates the soundness experiment to adversary $\mathcal{A}$ in the following manner: when $\mathcal{A}$ calls the oracle $\mathcal{O}_{KeyGen}$, adversary $\mathcal{B}$ first chooses integers, $b_{1}$, $b_{2}$, $c_{1}$, $c_{2}$, $d_{1}$, and $d_{2}$ such that $m=b_{1}b_{2}$ and $n=b_{1}b_{2}=d_{1}d_{2}$. Then it generates random vectors $\mu_{0}\in\mathbb{F}_{p}^{b_{1}},\eta_{0}\in\mathbb{F}_{p}^{b_{2}},\rho_{01}\in\mathbb{F}_{p}^{c_{1}},\tau_{01}\in\mathbb{F}_{p}^{c_{2}},\rho_{02}\in\mathbb{F}_{p}^{c_{1}},\tau_{02}\in\mathbb{F}_{p}^{c_{2}}$, $\varpi\in\mathbb{F}_{p}^{d_{1}}$ and a value $r\in\mathbb{F}_{p}$. We let $u_{0}$ be the vector representation of $\mu_{0}\cdot{}\eta_{0}^{T}$ and $t_{0}$ that of $\rho_{01}\cdot{}\tau_{01}^{T}+\rho_{02}\cdot{}\tau_{02}^{T}$. We also let $v=-(A^{T}u_{0}+t_{0})\in\mathbb{F}_{p}^{n}$. Finally, $\mathcal{B}$ forms $\omega^{T}=L^{r\cdot{}v^{T}}$; $g_{1}^{\eta}=L^{\eta_{0}}$, $g_{2}^{\mu}=R^{\mu_{0}}$; $g_{1}^{\tau_{1}}=L^{\tau_{01}}$, $g_{2}^{\rho_{1}}=R^{\rho_{01}}$; $g_{1}^{\tau_{2}}=L^{\tau_{02}}$, $g_{2}^{\rho_{2}}=R^{\rho_{02}}$; $g_{1}^{\delta}=L$, $g_{2}^{\gamma}=g_{2}^{r}$; $g_{1}^{\delta V}=L^{V}$, $(g_{2}^{r})^{\varpi^{T}}=(g_{2}^{\gamma})^{\varpi^{T}}$ and $(g_{1}^{\delta})^{\varpi^{T}*V}=(g_{1}^{\gamma})^{\varpi^{T}V}$ and outputs:

$\texttt{param}=(m,n,b_{1},b_{2},c_{1},c_{2},d_{1},d_{2},p,e,\mathbb{G}_{1},\mathbb{G}_{2},\mathbb{G}_{T},g_{1},g_{2},g_{T})$.

$EK_{f}=\{A,\omega^{T},(g_{1}^{\tau_{1}^{T}}),(g_{1}^{\tau_{2}^{T}}),(g_{1}^{\eta^{T}}),(g_{1}^{\delta\cdot V})\}$

$VK_{f}=\{(g_{1}^{\tau_{1}^{T}}),(g_{1}^{\tau_{2}^{T}}),(g_{2}^{\rho_{1}}),(g_{2}^{\rho_{2}}),(g_{1}^{\eta^{T}}),(g_{2}^{\mu}),(g_{1}^{\delta\varpi^{T}\cdot V}),(g_{2}^{\gamma\varpi}),g_{2}^{\gamma}\}$.

Thanks to the randomness and the decisional Diffie-Hellman assumption (DDH) in each group $G_{i}$, as well as [6, Theorem 3] for $\omega^{T}=(L^{r})^{v^{T}}$, these public values are indistinguishable from randomly generated inputs. Further, we have $\omega^{T}=g_{1}^{arv^{T}}=g_{1}^{ab(u_{0}^{T}A+t_{0}^{T}+v^{T})+arv^{T}}=g_{1}^{abu_{0}^{T}A+abt_{0}^{T}+a(b+r)v^{T}}$.

When adversary $\mathcal{A}$ calls the oracle $\mathcal{O}_{ProbGen}$ on input $x$, adversary $\mathcal{B}$ returns $\sigma_{x}=x$. Therefore, if $y=Ax$ and $\zeta=\omega^{T}\star{}x$, then the verification will pass: indeed the first two checks will ensure that $s_{1}^{T}=g_{1}^{\tau_{1}^{T}}\star{}X$ and $s_{2}^{T}=g_{1}^{\tau_{2}^{T}}\star{}X$ when the third check ensures that $z^{T}=g_{1}^{\eta^{T}}\star{}Y$. This shows that:

[TABLE]

and that:

[TABLE]

Finally, the last check is that these two parts, as well as the last one, which is $e(g_{1}^{\delta};g_{2}^{\gamma})^{v^{T}\cdot{}x}=e(g_{1};g_{2})^{a(b+r)v^{T}\cdot{}x}=e(Trace(g_{1}^{\delta\cdot{}VX});g_{2}^{\gamma})$, are coherent with the definitions of $\omega$ and $\zeta$ above. Now, with a non-negligible probability $\epsilon$, adversary $\mathcal{A}$ can pass the check for another $y^{\prime}\neq{}y$, by providing an adequate $\zeta^{\prime}$. First, $z^{T}$, $s_{1}^{T}$, $s_{2}^{T}$ and $C$ must be correct, as they are checked directly and independently by the Freivalds first four checks. Second, we have that $e(\zeta^{\prime};g_{2})=e(g_{1};g_{2})^{abu_{0}^{T}y^{\prime}+abt_{0}^{T}x}e(g_{1}^{\delta};g_{2}^{\gamma})^{v^{T}\cdot{}x}$ and therefore, we must also have $e(\zeta(\zeta^{\prime})^{-1};g_{2})=e(g_{1};g_{2})^{abu_{0}^{T}(y-y^{\prime})}$. As $u_{0}$ is a secret unknown to adversary $\mathcal{A}$, for a random $y^{\prime}$ the probability that $u_{0}^{T}(y-y^{\prime})=0$ is bounded by $1/|\mathbb{G}_{1}|$ and thus negligible. Thus adversary $\mathcal{B}$ can compute $c\equiv\left(u_{0}^{T}(y^{\prime}-y)\right)^{-1}\mod|\mathbb{G}_{1}|$ and $(\zeta/\zeta^{\prime})^{c}=g_{1}^{ab}$. Therefore it breaks the co-CDH assumption with non-negligible probability $\epsilon^{\prime}\simeq\epsilon$. The only other possibility is that adversary $\mathcal{A}$ was able to recover $u_{0}^{T}$. But that would directly implies that it has an advantage in the co-CDH: $g_{1}^{\eta}=L^{\eta_{0}}$, $g_{2}^{\mu}=R^{\mu_{0}}$. ∎

In Table 4, we present more timings for the comparison between our protocol and, to our knowledge and according to Table 2, the best previously known from [4]. The associated speed-ups supports our claim of a Prover efficient protocol with a gain of two orders of magnitude.