What is the most efficient way to prove that a person computed $r$ rounds of some cryptographic hash function (ex. SHA256) on an input? Specifically, I'm trying to optimize (1) the running time of the verifier and (2) the size of the proof (in that order).
The trivial solution seems to be to show all $r$ hashes, where $v_i = hash(v_{i-1}), \space \forall i \leq r$, but this seems very space inefficient.
Though a formal proof eludes me at the moment. I believe I can make a compelling argument this can't be done.
If what you want is for a prover to supply the output and some extra evidence. And the verifier should be able to convince himself with high probability it is correct with effort orders of magnitude less then computing the hash himself.
Even if the prover provides the full chain, a forger will be able to swap just a singls hash and compute any additional stuff on the forged chain. Other then checking the single forged hash( 1 in r) there is no way for the verifier to catch this. If the verifier checks even half of the steps at random that still gives the forger a 50% chance of succeeding(going undetected). You presumbly want the verifier to check only a handfull of hashes but that would give the forgery excellent chances of going undetected.
In order to get high confidence the verifier would have to do almost all the work of computing the r hashes himself.
