We introduce the notion of aSuccinct Parallelizable Argument of Knowledge(SPARK). This is an argument of knowledge with the following three efficiency properties for computing and proving a (non-deterministic, polynomial time) parallel RAM computation that can be computed in parallel timeTwith at mostpprocessors:—The prover’s (parallel) running time is\( T + \mathrm{poly}\hspace{-2.0pt}\log (T \cdot p) \). (In other words, the prover’s running time is essentiallyTfor large computation times!)—The prover uses at most\( p \cdot \mathrm{poly}\hspace{-2.0pt}\log (T \cdot p) \)processors.—The communication and verifier complexity are both\( \mathrm{poly}\hspace{-2.0pt}\log (T \cdot p) \).The combination of all three is desirable, as it gives a way to leverage a moderate increase in parallelism in favor of near-optimal running time. We emphasize that even a factor two overhead in the prover’s parallel running time is not allowed.Our main contribution is a generic construction of SPARKs from any succinct argument of knowledge where the prover’s parallel running time is\( T \cdot \mathrm{poly}\hspace{-2.0pt}\log (T \cdot p) \)when usingpprocessors, assuming collision-resistant hash functions. When suitably instantiating our construction, we achieve a four-round SPARK foranyparallel RAM computation assuming only collision resistance. Additionally assuming the existence of a succinctnon-interactiveargument of knowledge (SNARK), we construct a non-interactive SPARK that also preserves the space complexity of the underlying computation up to\( \mathrm{poly}\hspace{-2.0pt}\log (T\cdot p) \)factors.We also show the following applications of non-interactive SPARKs. First, they immediately imply delegation protocols with near optimal prover (parallel) running time. This, in turn, gives a way to construct verifiable delay functions (VDFs) from any sequential function. When the sequential function is also memory-hard, this yields the first construction of a memory-hard VDF.
Read full abstract