Quadratic span programs

The CRS size and prover computation are quasi-linear, making our scheme seemingly quite practical, a result supported by our implementation. Indeed, our NIZK argument attains the shortest proof, most efficient prover, and most efficient verifier of any known technique.

Finally, we show how QSPs and QAPs can be used to efficiently and publicly verify outsourced computations, where a client asks a server to compute F x for a given function F and must verify the result provided by the server in considerably less time than it would take to compute F from scratch. The resulting schemes are the most efficient, general-purpose publicly verifiable computation schemes. Please adjust your question! Add a comment. Active Oldest Votes.

Sign up or log in Sign up using Google. Sign up using Facebook. Sign up using Email and Password. Post as a guest Name. Email Required, but never shown. The Overflow Blog. Stack Gives Back But his scheme has some disadvantages — namely, the CRS size and prover computation are both quadratic in the circuit size.

In , Lipmaa reduced the CRS size to quasi-linear, but with prover computation still quadratic. The CRS size is linear in the circuit size, and prover computation is quasi-linear, making our scheme seemingly quite practical.