International Association
for Cryptologic Research

<jats:title>Abstract</jats:title><jats:p>Polynomial commitments schemes are a powerful tool that enables one party to commit to a polynomial <jats:italic>p</jats:italic> of degree <jats:italic>d</jats:italic>, and prove that the committed function evaluates to a certain value <jats:italic>z</jats:italic> at a specified point <jats:italic>u</jats:italic>, i.e. <jats:inline-formula><jats:alternatives><jats:tex-math>$$p(u) = z$$</jats:tex-math><mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>p</mml:mi> <mml:mo>(</mml:mo> <mml:mi>u</mml:mi> <mml:mo>)</mml:mo> <mml:mo>=</mml:mo> <mml:mi>z</mml:mi> </mml:mrow> </mml:math></jats:alternatives></jats:inline-formula>, without revealing any additional information about the polynomial. Recently, polynomial commitments have been extensively used as a cryptographic building block to transform polynomial interactive oracle proofs (PIOPs) into efficient succinct arguments. In this paper, we propose a lattice-based polynomial commitment that achieves succinct proof size and verification time in the degree <jats:italic>d</jats:italic> of the polynomial. Extractability of our scheme holds in the random oracle model under a natural ring version of the BASIS assumption introduced by Wee and Wu (EUROCRYPT 2023). Unlike recent constructions of polynomial commitments by Albrecht et al. (CRYPTO 2022), and by Wee and Wu, we do not require any expensive preprocessing steps, which makes our scheme particularly attractive as an ingredient of a PIOP compiler for succinct arguments. We further instantiate our polynomial commitment, together with the PIOP (EUROCRYPT 2020), to obtain a publicly-verifiable trusted-setup succinct argument for Rank-1 Constraint System (R1CS). Performance-wise, we achieve <jats:inline-formula><jats:alternatives><jats:tex-math>$$17$$</jats:tex-math><mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mn>17</mml:mn> </mml:mrow> </mml:math></jats:alternatives></jats:inline-formula>MB proof size for <jats:inline-formula><jats:alternatives><jats:tex-math>$$2^{20}$$</jats:tex-math><mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>20</mml:mn> </mml:msup> </mml:math></jats:alternatives></jats:inline-formula> constraints, which is <jats:inline-formula><jats:alternatives><jats:tex-math>$$15$$</jats:tex-math><mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mn>15</mml:mn> </mml:mrow> </mml:math></jats:alternatives></jats:inline-formula>X smaller than currently the only publicly-verifiable lattice-based SNARK proposed by Albrecht et al.</jats:p>