Notus: Dynamic Proofs of Liabilities from Zero-knowledge RSA Accumulators

Proofs of Liabilities (PoL) allow an untrusted prover to commit to its liabilities towards a set of users and then prove independent users' amounts or the total sum of liabilities, upon queries by users or third-party auditors. This application setting is highly dynamic. User liabilities may increase/decrease arbitrarily and the prover needs to update proofs in epoch increments (e.g., once a day for a crypto-asset exchange platform). However, prior works mostly focus on the static case and trivial extensions to the dynamic setting open the system to windows of opportunity for the prover to under-report its liabilities and rectify its books in time for the next check, unless all users check their liabilities at all epochs. In this work, we develop Notus, the first dynamic PoL system for general liability updates that avoids this issue. Moreover, it achieves O(1) query proof size, verification time, and auditor overheadper-epoch. The core building blocks underlying Notus are a novel zero-knowledge (and SNARK-friendly) RSA accumulator and a corresponding zero-knowledge MultiSwap protocol, which may be of independent interest. We then propose optimizations to reduce the prover's update overhead and make Notus scale to large numbers of users (10 6 in our experiments). Our results are very encouraging, e.g., it takes less than 2ms to verify a user's liability and the proof size is 256 Bytes. On the prover side, deploying Notus on a cloud-based testbed with eight 32-core machines and exploiting parallelism, it takes ∼3 minutes to perform the complete epoch update, after which all proofs have already been computed. Dynamic Negative Updates Update Pattern Privacy Trusted Setup Prover Overhead Verifier Overhead for m epochs Auditor Overhead Proof of Sum size Cryptographic Techniques DAPOL+ [41] No N/A N/A No O(n log n) N/A N/A O(1) PedersenTree+RangeProof TAP [56] Yes No No No O(n ′ log n ′ ) O(m log n ′ ) O(n ′ ) O(m) PedersenTree+RangeProof OKX [52] No Yes N/A No O(n log 2 n) O(m log n) O(log 2 n)