FlexProofs: A Vector Commitment with Flexible Linear Time for Computing All Proofs

TL;DR

FlexProofs tackles efficient, scalable proof openings for vector inputs in multi-user zkSNARK settings by introducing a novel Functional Commitment (FC) for batch openings and embedding it into a two-layer Vector Commitment (VC) with a Polynomial Commitment (PC). This design yields OpenAll in $O(N)$ time with a tunable batch parameter $b$, while remaining directly compatible with zkSNARKs that encode inputs as multi-linear polynomials. The approach supports practical applications such as verifiable secret sharing (VSS) and verifiable robust aggregation (VRA) and demonstrates substantial real-world speedups over HydraProofs (up to ${6\times}$ for $N=2^{16}$ when $b= ext{log}^2 N$). Overall, FlexProofs provides a scalable, zkSNARK-friendly mechanism for batch openings in VC/FC frameworks with clear efficiency and security guarantees.

Abstract

In this paper, we introduce FlexProofs, a new vector commitment (VC) scheme that achieves two key properties: (1) the prover can generate all individual opening proofs for a vector of size $N$ in optimal time ${\cal O}(N)$, and there is a flexible batch size parameter $b$ that can be increased to further reduce the time to generate all proofs; and (2) the scheme is directly compatible with a family of zkSNARKs that encode their input as a multi-linear polynomial. As a critical building block, we propose the first functional commitment (FC) scheme for multi-exponentiations with batch opening. Compared with HydraProofs, the only existing VC scheme that computes all proofs in optimal time ${\cal O}(N)$ and is directly compatible with zkSNARKs, FlexProofs may speed up the process of generating all proofs, if the parameter $b$ is properly chosen. Our experiments show that for $N=2^{16}$ and $b=\log^2 N$, FlexProofs can be $6\times$ faster than HydraProofs. Moreover, when combined with suitable zkSNARKs, FlexProofs enable practical applications such as verifiable secret sharing and verifiable robust aggregation.

Figures (3)

• Figure 1: Efficient OpenAll. We assume a prover holding a vector ${\bf m}\in \mathbb{F}_p^N$, the commitment ${C}$ and an auxiliary information string ${\sf aux}(={\bf C})$. We assume $N$ verifiers $\{\mathcal{V}_{i}\}_{i\in [0, N)}$, where each verifier $\mathcal{V}_{i}$ holds the commitment ${C}$ and an element ${m}_{i}$ and wants to verify whether ${m}_{i}$ is the $i$-th element of ${\bf m}$.
• Figure 2: Opening time. Both axes use logarithmic scales.
• Figure 3: Verification time. Both axes use logarithmic scales.

Theorems & Definitions (17)

• definition thmcounterdefinition: Correctness
• definition thmcounterdefinition: Function binding
• definition thmcounterdefinition: Completeness
• definition thmcounterdefinition: Knowledge Soundness
• definition thmcounterdefinition: Correctness
• definition thmcounterdefinition: Position binding
• theorem thmcountertheorem
• proof
• definition thmcounterdefinition: Zero-Knowledge of Polynomial Commitment
• definition thmcounterdefinition: Position Hiding of Vector Commitment