Paper 2026/843

Practical Fair Data Exchange without In-Circuit Public-Key Operations

Abstract

Fair data exchange (FDE) lets a seller receive payment if and only if the buyer obtains the committed data, and its most practical realizations reduce the task to verifiable encryption under committed key (VECK) over a Reed--Solomon-coded file with Fiat--Shamir sampling. In the state-of-the-art code-based scheme, however, proving is dominated not by the file but by a size-independent constant: in-circuit ElGamal operations tie the sampled ciphertexts to the commitment, and the resulting elliptic-curve gadgets both inflate the circuit and force the proving system onto a slow two-chain inner curve whose key verification is expensive to settle on-chain. We eliminate these ciphertexts---and with them every in-circuit public-key operation. In our construction the polynomial commitment itself certifies sample--file consistency: a KZG subset-consistency check and a single evaluation opening, exposed only as a group element, tie the sample to the committed file, while a lightweight commit-and-prove SNARK certifies only field-arithmetic masking and interpolation relations. We prove security in the algebraic group model and random oracle model under discrete-logarithm-type computational assumptions, dropping the DDH and DCR assumptions of prior VECK schemes. The circuit shrinks by about \(20\times\) and the prover runs directly on BLS12-381: for \(2^{17}\)-element files, cryptographic proof generation drops from \(21.1\) s to \(0.945\) s at sample size \(512\), while cryptographic verification depends only on that sample size. The key stays on a precompile-friendly curve, where its scalar multiplication costs \(12{,}000\) gas instead of \(0.9\)--\(5.9\) million for the non-precompiled alternatives.