An End-to-End Prototype for Optimizing Zero-Knowledge Image Provenance: Field-Element Packing and Off-Circuit Signature Verification

Abstract

Zero-knowledge proofs enable a prover to convince a verifier that a statement is true, without revealing the underlying witness data. This primitive naturally lends itself to privacypreserving systems, where hiding the witness prevents the verifier from learning sensitive information. That said, zero-knowledge proofs can also be used in systems where the witness is not necessarily confidential but is not readily available to the verifier. One such use case is image provenance, where signed images are transformed before being distributed. Since the original image is not available to the user, the digital signature cannot be verified without a zero-knowledge proof. In this use case, zeroknowledge proofs enable verification of the authenticity of the image’s source, the integrity of the image contents, and that only permitted transformations were applied. In this work we present an end-to-end prototype system that implements this provenance framework and several optimizations. One of our key optimizations is a packing scheme for reducing the number of Poseidon sponge absorb and permutation operations by ≈31×. We also show that this packing scheme reduces the median prover runtime by ≈40× and the median verifier runtime by ≈22×. We also introduce a chain of trust that removes digital signature verification from the circuit. Finally, we introduce custom PNG chunks that embed the required information in the captured images.