1. ALITHEIA: Towards Practical Verifiable Graph Processing Yupeng Zhang, Charalampos Papamanthou and Jonathan Katz University of Maryland

2. Agenda Background of verifiable computation and motivation Our contributions Alitheia: A system for Verifiable Computation on graphs Shortest paths, longest paths and maximum flow Different kinds of graphs: general/planar Use of non-generic approaches to achieve practicality/scalability Experimental results Conclusions

3. What is verifiable computation? digest answer & proof verify(answer, proof, query) data & function query Correctness Soundness preprocessing time prover time server storage proof size verification time [1] R. Tamassia. Authenticated Data Structures. In ESA, 2003.

4. Generic VC systems: circuit-based [2] R. Gennaro, C. Gentry, B. Parno, and M. Raykova. Quadratic span programs and succinct NIZKs without PCPs. in EUROCRYPT, 2013. [3] B. Parno, J. Howell, C. Gentry, and M. Raykova. Pinocchio: Nearly Practical Verifiable Computation. In SSP, 2013. data & function query answer VC Limitation: inefficient dynamic memory accesses Overhead is linear in the size of the memory

5. Generic VC systems: RAM-based Use witness to access dynamic memory based on Merkle tree. Logarithmic overhead in the size of the memory, with large constants [4] B. Braun, A. J. Feldman, Z. Ren, S. T. V. Setty, A. J. Blumberg, and M. Walfish. Verifying Computations with State. In SOSP, 2013. [5] E. Ben-Sasson, A. Chiesa, D. Genkin, E. Tromer, and M. Virza. SNARKs for C: Verifying Program Executions Succinctly and in Zero Knowledge. In CRYPTO, 2013.

6. Why graph algorithms? Numerous applications in practice Shortest PathMaximal FlowLongest Path

7. Verifiable shortest path Many dynamic memory accesses operations n vertices and m edges, breadth first search on a unit weight graph Prover time Circuit-based naïve implementation: O(nm log 2 m) RAM-based naïve implementation: O(m log 3 m) with large constants

8. Agenda Background of verifiable computation and motivation Our contributions Alitheia: A system for Verifiable Computation on graphs Shortest paths, longest paths and maximum flow Different kinds of graphs: general/planar Use of non-generic approaches to achieve practicality/scalability Experimental results Conclusions

9. What is a certifying algorithm? Verifying correctness of a computation (possibly given some auxiliary input) faster than performing the computation. E.g., sorting takes O(n log n) time, but a correct sorted sequence can be verified in O(n) time [6] R. M. McConnell, K. Mehlhorn, S. Näher, and P. Schweitzer. Certifying Algorithms. Computer Science Review, 2011.

10. More efficient VC using certifying algorithms digest answer & proof graph G, function F certifying algorithm C F query x Evaluate F(G,x) x Generic VC for C F F(G,x) auxiliary input for C F F(G,x) or reject verify(answer, proof, query) [7] R. Tamassia and N. Triandopoulos. Certification and Authentication of Data Structures. In AMW, 2010. proof

11. Certifying algorithm: shortest path 1. 2. 3. s,t Linear algorithm with NO dynamic memory accesses! 1. 2. 3. s,t For unit weight undirected graph O( n ) speed up compared to circuit-based generic VC O(log m ) speed up compared to RAM-based generic VC proof

12. Agenda Background of verifiable computation and motivation Our contributions Alitheia: A system for Verifiable Computation on graphs Shortest paths, longest paths and maximum flow Different kinds of graphs: general/planar Use of non-generic approaches to achieve practicality/scalability Experimental results Conclusions

13. From general to planar graphs 3 2 1 c b 7 d 6 a e 4 5 f g 1 2 3 6 7 4 5 fg e a b c d Planar Separator Theorem:

14. Planar separator tree 1 2 3 6 7 d a bc Query: d a d d a a + + min …… min 2 min 1

15. Shortest path in planar graphs Precomputation & Storage : O( ) Query: O( ) What does the server need to prove now? Verifiable selection of the minimum element from the sum of two vectors

16. Additively-homomorphic digest General Hash is slow in Generic VC! + + [8] C. Papamanthou, E. Shi, R. Tamassia, and K. Yi. Streaming Authenticated Data Structures. In EUROCRYPT, 2013

17. VC for vector addition and minimum 1.Digest( A )=d 2.Output min(A) min(A) A d proof

18. Complexity comparison Circuit-Based VCRAM-Based VCAlitheia: Certifying Algorithms Alitheia: Planar Graphs Preprocessing TimeO( nm )O( m log m )O(m)O(m)O( n 3/2 ) Prover TimeO( nm log 2 ( mn ))O( m log 3 m )O( m log 2 m )O( n 1/2 log 2 n ) Proof SizeO(1) O(| p |)O( log n +| p |) Verification TimeO(| p |) O( log n +| p |) n : number of vertices, m : number of edges, | p |: length of the shortest path

19. Implementation Implementation details: Built on top of Pinocchio [2] Planar separator by E.Fox-Epstein et al. [7] Graph processing by LEDA library [8] Amazon EC2 Linux machine with 15GB RAM Experiment details: A random planar graph is generated 10 runs of experiments [2] B. Parno, J. Howell, C. Gentry, and M. Raykova. Pinocchio: Nearly Practical Verifiable Computation. In SSP, 2013. [9] E. Fox-Epstein, S. Mozes, P. M. Phothilimthana, and C. Sommer. Short and Simple Cycle Separators in Planar Graphs. In ALENEX, 2013. [10] http://www.algorithmic-solutions.com/leda/index.htm.

20. Example: road network of Rome PINOCCHIO (Circuit-Based VC) PANTRY (RAM-Based VC) SNARKs for C (RAM-Based VC ) Alitheia: Certifying Algorithms Alitheia: Planar Graphs Preprocessing Time 19000 hours*270 hours*52 hours*69 minutes4.1 minutes Prover Time7600 hours*550 hours*30 hours*3.3 minutes13 seconds Proof Size288 bytes 704 bytes3872bytes Verification Time 0.08 seconds* 0.05 seconds*0.19 seconds0.59 seconds n = 3353 nodes, m = 8870 edges, | p | = 13 [6] 9th DIMACS implementation challenge for shortest paths. http://www.dis.uniroma1.it/challenge9/. * estimated.

21. Experimental results On a graph with 10 5 nodes: Certifying algorithm: 10 6 x faster than Pinocchio BFS, 2x faster than Strawman Planar Graph: 10 7 x faster than Pinocchio BFS, 12x faster than Strawman 10 6 x 10 7 x 12 x

22. 100 x Experimental results On a graph with 10 5 nodes: Certifying algorithm: 10 6 x smaller than Pinocchio BFS, 100x smaller than Strawman Planar Graph: 10 7 x smaller than Pinocchio BFS, 1000x smaller than Strawman 10 6 x 10 7 x 1000 x

23. Experimental results On a graph with 10 5 nodes: Certifying algorithm: 10 7 x faster than Pinocchio BFS Planar Graph: 10 8 x faster than Pinocchio BFS, only tens of seconds 10 7 x 10 8 x

24. Experimental results On a graph with 10 5 nodes: Certifying algorithm: slower by a constant factor Planar Graph: grows logarithmically with n but still only around 1s

25. Conclusions Alitheia is the first system to scale verifiable graph computation to large graphs (up to 200,000 nodes) We show that by combining non-generic approaches with generic VC systems can lead to better efficiency For graph algorithms, we show speedups by using certifying algorithms and noncryptographic data structures

26. zhangyp@umd.edu

27. Certifying algorithm: maximal flow Maximum-flow-min-cut theorem s,t Maximum Flow Flow Assignment Cut Linear !! proof Complexity: Ω(nm)