Paper 2021/599

Hyperproofs: Aggregating and Maintaining Proofs in Vector Commitments

Abstract

We present Hyperproofs, the first vector commitment (VC) scheme that is efficiently maintainable and aggregatable. Similar to Merkle proofs, our proofs form a tree that can be efficiently maintained: updating all $$ proofs in the tree after a single leaf change only requires $$ time. Importantly, unlike Merkle proofs, Hyperproofs are efficiently aggregatable, anywhere from $$ to $$ faster than SNARK-based aggregation of Merkle proofs. At the same time, an individual Hyperproof consists of only $$ algebraic hashes (e.g., 32-byte elliptic curve points) and an aggregation of $$ such proofs is only $$-sized. Hyperproofs are also reasonably fast to update when compared to Merkle trees with SNARK-friendly hash functions. As another benefit over Merkle trees, Hyperproofs are homomorphic: digests (and proofs) for two vectors can be homomorphically combined into a digest (and proofs) for their sum. Homomorphism is very useful in emerging applications such as stateless cryptocurrencies. First, it enables unstealability, a novel property that incentivizes proof computation. Second, it makes digests and proofs much more convenient to update. Finally, Hyperproofs have certain limitations: they are not transparent, have linear-sized public parameters, are slower to verify, and have larger aggregated proofs and slower verification than SNARK-based approaches. Nonetheless, end-to-end, aggregation and verification in Hyperproofs is $$ to $$ faster than in SNARK-based Merkle trees.