International Association
for Cryptologic Research

A manufacturer of custom hardware (an ASIC) can undermine the intended execution of that hardware; high-assurance execution thus requires controlling the manufacturing chain. However, a trusted platform might be orders of magnitude worse in performance or price than an advanced, untrusted platform. This paper explores an alternative: using verifiable computation (VC), an untrusted ASIC computes proofs of correct execution, which are verified by a trusted processor or ASIC. Notably, in the present setting, the prover and verifier together must impose less overhead than the baseline alternative of running the given computation directly on the trusted platform. We respond to this challenge by designing and implementing physically realizable, area-efficient, high throughput ASICs (for a prover and verifier), in fully synthesizable Verilog. The system, called Zebra, is based on the CMT interactive proof protocol; instantiating Zebra required a blend of new observations about CMT, careful hardware design, and attention to architectural challenges. We measure and evaluate Zebra; for a class of real computations, it indeed poses less overhead than executing directly on the trusted platform.