SPARKs: Succinct Parallelizable Arguments of Knowledge

Abstract

We introduce the notion of aSuccinct Parallelizable Argument of Knowledge(SPARK). This is an argument of knowledge with the following three efficiency properties for computing and proving a (non-deterministic, polynomial time) parallel RAM computation that can be computed in parallel timeTwith at mostpprocessors:—The prover’s (parallel) running time is\( T + \mathrm{poly}\hspace{-2.0pt}\log (T \cdot p) \). (In other words, the prover’s running time is essentiallyTfor large computation times!)—The prover uses at most\( p \cdot \mathrm{poly}\hspace{-2.0pt}\log (T \cdot p) \)processors.—The communication and verifier complexity are both\( \mathrm{poly}\hspace{-2.0pt}\log (T \cdot p) \).The combination of all three is desirable, as it gives a way to leverage a moderate increase in parallelism in favor of near-optimal running time. We emphasize that even a factor two overhead in the prover’s parallel running time is not allowed.Our main contribution is a generic construction of SPARKs from any succinct argument of knowledge where the prover’s parallel running time is\( T \cdot \mathrm{poly}\hspace{-2.0pt}\log (T \cdot p) \)when usingpprocessors, assuming collision-resistant hash functions. When suitably instantiating our construction, we achieve a four-round SPARK foranyparallel RAM computation assuming only collision resistance. Additionally assuming the existence of a succinctnon-interactiveargument of knowledge (SNARK), we construct a non-interactive SPARK that also preserves the space complexity of the underlying computation up to\( \mathrm{poly}\hspace{-2.0pt}\log (T\cdot p) \)factors.We also show the following applications of non-interactive SPARKs. First, they immediately imply delegation protocols with near optimal prover (parallel) running time. This, in turn, gives a way to construct verifiable delay functions (VDFs) from any sequential function. When the sequential function is also memory-hard, this yields the first construction of a memory-hard VDF.