leanVM-b

Warning: highly experimental.

Benchmarks

Machine: Mac M4 Max

XMSS aggregation

Our XMSS is specified in XMSS.pdf.

cargo run --release -- xmss --n-signatures 900 --log-inv-rate 1 --repeat 3

XMSS aggregation, 900 signatures
  cycles (VM steps)           : 1,542,617 = 2^20.557
    proven rows               : 1,967,104 = 2^20.908  (filled to powers of two)
    details                   : DEREF 2^18.988 (33.7%)  SET 2^18.402 (22.4%)  MUL 2^18.198 (19.5%)  BLAKE2S 2^16.995 (8.5%)  XOR 2^16.96 (8.3%)  JUMP 2^16.831 (7.6%)  PACK64X2 2^9.938 (0.1%)  MEMORY 2^21.725  TOTAL_COMMITTED 2^26.195
  signers                     : 900
  proof size                  : 304.3 KiB
  aggregating                 : 1.01 s ± 5.1%      peak memory 15.994 GiB
  per signature               : 890.86 XMSS/s
  verifying                   : 0.0122 s

Recursion

cargo run --release -- recursion --n 2 --log-inv-rate 2 --repeat 3

recursion 2→1, over leaves of 900 signatures
  cycles (VM steps)           : 798,657 = 2^19.607
    proven rows               : 1,196,032 = 2^20.19  (filled to powers of two)
    details                   : DEREF 2^18.168 (36.9%)  MUL 2^17.825 (29.1%)  XOR 2^17.383 (21.4%)  SET 2^15.55 (6.0%)  BLAKE2S 2^14.44 (2.8%)  PACK64X2 2^14.349 (2.6%) JUMP 2^13.272 (1.2%)  MEMORY 2^19.938  TOTAL_COMMITTED 2^24.863
  signers                     : 1,800
  proof size                  : 214.7 KiB
  aggregating                 : 0.588 s ± 6.2%      peak memory 20.775 GiB
  verifying                   : 0.0142 s

Fibonacci

cargo run --release -- fibonacci --n 2000000 --log-inv-rate 1 --repeat 3

Fibonacci (in the exponent, i.e. modulo 2^64 - 1), N = 2,000,000
  cycles (VM steps)           : 2,127,881
    details                   : MUL 2^20.937 (98.7%)  DEREF 2^13.967 (0.8%)  SET 2^12.552 (0.3%)  JUMP 2^10.968 (0.1%)  XOR 2^10.966 (0.1%)  MEMORY 2^20.964  TOTAL_COMMITTED 2^25.263
  proof size                  : 284.6 KiB
  proving                     : 0.571 s ± 2.0%   3,726,189 cycles/s      peak memory 9.896 GiB
  verifying                   : 0.00294 s

Batch proving BLAKE2s

BENCH_REPEAT=3 BENCH_COOLDOWN=2 FLOCK_N_LOG=18 cargo test --release -p flock --test blake2s_batch -- --ignored --nocapture

Flock BLAKE2s batch proving, 262,144 compressions (2^18 slots)
  setup (preprocessing, excluded) :   2178.2 ms
  witness-gen                     :     52.7 ms ± 41.5%   8.0%
  commit                          :    104.4 ms ± 19.3%  15.9%
  zerocheck                       :    242.5 ms ± 4.2%   36.9%
  lincheck                        :     24.5 ms ± 13.8%   3.7%
  pcs opening                     :    232.4 ms ± 8.1%   35.4%
  other                           :      0.0 ms           0.0%
  ------------------------------------------
  prove TOTAL (witness excluded)  :    603.8 ms ± 1.8%   92.0%
  verify                          :      2.2 ms
  throughput                      :        434,176 compressions/s ± 1.8%

Security

• 128-bit (LDR Johnson, no proximity gaps conjecture)

Snark machinery

• Binary field of 192 bits
• PCS: WHIR (aka Ligerito)
• Proving BLAKE2s by Flock
• RingSwitching, M3 arithmetisation, (and more) by Binius / Binius64 (see DP23 and DP24)