diff --git a/README.md b/README.md index 37a673859..20bbb1225 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ leanVM

-

Minimal hash-based zkVM, for a Post-Quantum Ethereum.

+

minimal hash-based zkVM, for post-quantum Ethereum

Documentation @@ -13,30 +13,59 @@ - - + + - - + + - - + + + +
XMSS aggregation1,200 XMSS/sleanXMSS aggregation1.2K/s
SPHINCS aggregation250 SPHINCS/sleanSPHINCS aggregation250/s
Recursion 2 → 10.29 sleanDA commitment2 MiB/s
+ + + + - - + + + + + +
2-to-1 recursion0.29s
Data availability16 blobs/shash compressions480K/s
cheap cycles5.4M/s
-Warning: not (yet) production ready. +## security + +leanVM is designed for security: + + * 128-bit ROM (64-bit QROM) soundness + * no proximity gap conjecture + * end-to-end formal verification + * a traditional hash function -leanVM was originally designed over the [KoalaBear prime](https://crates.io/crates/p3-koala-bear) and [Poseidon](https://eprint.iacr.org/2019/458), still available in the [koalabear](https://github.com/leanEthereum/leanVM/tree/koalabear) branch; it is now using binary fields and BLAKE2s. +**warning**: Formal verification is in progress. leanVM is not (yet) production ready. -# Benchmarks +## work in progress -Machine: Mac M4 Max +Expect leanVM to change significantly: + +* **hash**: BLAKE2s is a placeholder. SHA2, SHA3, BLAKE3 are actively considered. +* **ISA**: A migration from leanISA to RISC-V (rv64im) is planned. +* **zk**: Support for zero-knowledge is planned. + +**note**: Prior to binary fields leanVM used [KoalaBear](https://crates.io/crates/p3-koala-bear) and [Poseidon](https://eprint.iacr.org/2019/458). The historical design is in [this branch](https://github.com/leanEthereum/leanVM/tree/koalabear). + +## benchmarks + +**machine**: M4 Max MacBook Pro (12 performance cores, 4 efficiency cores, 48GB RAM) + +**note**: The Metal GPU was not used. ### XMSS aggregation @@ -74,24 +103,7 @@ aggregation, 245 SPHINCS signatures verifying : 3.969 ms ``` -### Recursion - - -```bash -cargo run --release -- recursion --n 2 --xmss-per-leaf 900 --log-inv-rate 2 --repeat 3 -``` - -``` -recursion 2→1, over leaves of 900 XMSS signatures - cycles (VM steps) : 570,113 = 2^19.121 - details : MUL 2^17.838 (41.1%) DEREF 2^16.988 (22.8%) XOR 2^16.747 (19.3%) SET 2^15.79 (9.9%) JUMP 2^14.488 (4.0%) BLAKE2S 2^13.978 (2.8%) MEMORY 2^19.507 TOTAL_COMMITTED 2^24.086 - proof size : 191.3 KiB - proving time : 0.287 s ± 15.9% peak memory 10.124 GiB - verifying : 4.121 ms -``` - -### Data Availability - +### data availability ```bash cargo run --release -- aggregate --blobs 16 --log-inv-rate 1 --repeat 3 @@ -107,23 +119,22 @@ aggregation, 16 blobs verifying : 6.659 ms ``` -### Fibonacci - +### recursion ```bash -cargo run --release -- fibonacci --n 2000000 --log-inv-rate 1 --repeat 3 +cargo run --release -- recursion --n 2 --xmss-per-leaf 900 --log-inv-rate 2 --repeat 3 ``` ``` -Fibonacci (in the exponent, i.e. modulo 2^64 - 1), N = 2,000,000 - cycles (VM steps) : 2,127,880 - details : MUL 2^20.944 (98.9%) SET 2^13.288 (0.5%) DEREF 2^12.967 (0.4%) JUMP 2^10.968 (0.1%) XOR2^10.966 (0.1%) MEMORY 2^20.96 TOTAL_COMMITTED 2^25.26 - proof size : 285.4 KiB - proving : 0.391 s ± 1.1% 5,442,734 cycles/s peak memory 5.203 GiB - verifying : 2.092 ms +recursion 2→1, over leaves of 900 XMSS signatures + cycles (VM steps) : 570,113 = 2^19.121 + details : MUL 2^17.838 (41.1%) DEREF 2^16.988 (22.8%) XOR 2^16.747 (19.3%) SET 2^15.79 (9.9%) JUMP 2^14.488 (4.0%) BLAKE2S 2^13.978 (2.8%) MEMORY 2^19.507 TOTAL_COMMITTED 2^24.086 + proof size : 191.3 KiB + proving time : 0.287 s ± 15.9% peak memory 10.124 GiB + verifying : 4.121 ms ``` -### Batch proving BLAKE2s +### hashing ```bash BENCH_REPEAT=3 BENCH_COOLDOWN=2 FLOCK_N_LOG=18 cargo test --release --package flock --test batch_proving_hashes -- hash_batch_prove_verify --exact --nocapture --include-ignored @@ -145,13 +156,24 @@ Flock BLAKE2s batch proving, 262,144 compressions (2^18 slots) (~3289.9 XMSS/s equivalent at 146 compressions/signature) ``` -## Security +### Fibonacci -- 128-bit (LDR Johnson, no proximity gaps conjecture) +```bash +cargo run --release -- fibonacci --n 2000000 --log-inv-rate 1 --repeat 3 +``` + +``` +Fibonacci (in the exponent, i.e. modulo 2^64 - 1), N = 2,000,000 + cycles (VM steps) : 2,127,880 + details : MUL 2^20.944 (98.9%) SET 2^13.288 (0.5%) DEREF 2^12.967 (0.4%) JUMP 2^10.968 (0.1%) XOR2^10.966 (0.1%) MEMORY 2^20.96 TOTAL_COMMITTED 2^25.26 + proof size : 285.4 KiB + proving : 0.391 s ± 1.1% 5,442,734 cycles/s peak memory 5.203 GiB + verifying : 2.092 ms +``` -## Snark machinery +## SNARK machinery -- Binary field of 192 bits (tower of degree 3 over the 64 bit field) -- PCS: [WHIR](https://eprint.iacr.org/2024/1586) (aka [Ligerito](https://eprint.iacr.org/2025/1187)) -- Proving BLAKE2s by [Flock](https://github.com/succinctlabs/flock/tree/main) -- RingSwitching, M3 arithmetisation, (and more) by [Binius](https://github.com/IrreducibleOSS/binius) / [Binius64](https://github.com/binius-zk/binius64) (see [DP23](https://eprint.iacr.org/2023/1784) and [DP24](https://eprint.iacr.org/2024/504)) +- 192-bit binary field (degree-3 tower over the 64-bit field) +- [WHIR](https://eprint.iacr.org/2024/1586) PCS, aka [Ligerito](https://eprint.iacr.org/2025/1187) +- [Flock](https://github.com/succinctlabs/flock/tree/main) hash proving +- [Binius](https://github.com/IrreducibleOSS/binius)/[Binius64](https://github.com/binius-zk/binius64) ring switching, M3 arithmetisation, and more (see [DP23](https://eprint.iacr.org/2023/1784) and [DP24](https://eprint.iacr.org/2024/504))