| leanXMSS aggregation | 1,2K/s |
| leanSPHINCS aggregation | 440/s |
| leanDA commitment | 2,5 MiB/s |
| 2-to-1 recursion | 0.30s |
| proving KECCAK | 560K/s |
| cheap cycles | 6,2M/s |
leanVM is designed for security:
- 128-bit ROM (64-bit QROM) soundness
- no proximity gap conjecture
- end-to-end formal verification
- a traditional hash function
warning: Formal verification is in progress. leanVM is not (yet) production ready.
Expect leanVM to change significantly:
- hash: Keccak-256 is a placeholder: SHA2, BLAKE2s and BLAKE3 are actively considered.
- ISA: A migration from leanISA to RISC-V (rv64im) is planned.
- zk: Support for zero-knowledge is planned.
note: Prior to binary fields leanVM used KoalaBear and Poseidon. The historical design is in this branch.
machine: M4 Max MacBook Pro (12 performance cores, 4 efficiency cores, 48GB RAM)
note: The Metal GPU was not used.
The leanXMSS parameters are specified in leanXMSS.pdf, with a (ROM) security proof in Lean 4. This is not the definitive parameter set.
cargo leanvm aggregate --xmss 1400 --log-inv-rate 1 --repeat 3aggregation, 1,400 leanXMSS signatures
cycles (VM steps) : 1,569,346 = 2^20.582
details : XOR 2^18.675 (26.7%) SET 2^18.179 (18.9%) MUL 2^18.13 (18.3%) KECCAK 2^17.994 (16.6%) DEREF 2^17.559 (12.3%) JUMP2^16.788 (7.2%) MEMORY 2^23.109 BYTECODE 2^18.467 TOTAL_COMMITTED 2^26.801
proof size : 359.5 KiB
proving time : 1.15 s ± 0.5% peak memory 8.633 GiB
per signature : 1,216.937 signatures/s
verifying : 7.449 ms
The leanSPHINCS parameters are specified in leanSPHINCS.pdf, with a (ROM) security proof in Lean 4. This is not the definitive parameter set.
cargo leanvm aggregate --sphincs 530 --log-inv-rate 1 --repeat 3aggregation, 530 leanSPHINCS signatures
cycles (VM steps) : 2,619,077 = 2^21.321
details : XOR 2^19.934 (38.2%) MUL 2^19.394 (26.3%) SET 2^18.74 (16.7%) KECCAK 2^17.994 (10.0%) DEREF 2^17.262 (6.0%) JUMP 2^16.143 (2.8%) MEMORY 2^23.178 BYTECODE 2^18.153 TOTAL_COMMITTED 2^26.983
proof size : 373.6 KiB
proving time : 1.197 s ± 4.0% peak memory 8.991 GiB
per signature : 442.623 signatures/s
verifying : 7.101 ms
cargo leanvm aggregate --blobs 16 --log-inv-rate 1 --repeat 3aggregation, 16 blobs
cycles (VM steps) : 3,006,800 = 2^21.52
details : XOR 2^20.098 (37.3%) MUL 2^19.811 (30.6%) DEREF 2^19.201 (20.0%) JUMP 2^18.052 (9.0%) SET 2^15.761 (1.8%) KECCAK 2^15.088 (1.2%) MEMORY 2^21.814 BYTECODE 2^18.153 TOTAL_COMMITTED 2^26.486
proof size : 337.2 KiB
proving time : 0.796 s ± 3.6% peak memory 6.158 GiB
blob throughput : 20.09 blobs/s, 2.511 MiB/s
verifying : 7.166 ms
cargo leanvm recursion --n 2 --xmss-per-leaf 900 --log-inv-rate 2 --repeat 3recursion 2→1, over leaves of 900 leanXMSS signatures
cycles (VM steps) : 542,049 = 2^19.048
details : MUL 2^17.622 (37.2%) XOR 2^17.183 (27.5%) DEREF 2^16.839 (21.6%) SET 2^15.214 (7.0%) JUMP 2^14.526 (4.4%) KECCAK 2^13.63 (2.3%) MEMORY 2^19.78 BYTECODE 2^18.467 TOTAL_COMMITTED 2^24.02
proof size : 216.9 KiB
proving time : 0.309 s ± 1.6% peak memory 2.315 GiB
verifying : 9.176 ms
cargo leanvm hash --log-n 17 --repeat 3Keccak GKR batch proving, 131,072 permutations, a state committed every 12 rounds
witness : 14.8 ms ± 87.7% 6.3%
commit : 17.7 ms ± 34.5% 7.5%
output claim : 2.1 ms ± 20.4% 0.9%
layers and openings : 177.0 ms ± 4.1% 75.4%
pcs opening : 23.2 ms ± 7.0% 9.9%
------------------------------------------
prove TOTAL (witness included) : 234.8 ms ± 10.4%
verify : 4.2 ms
throughput : 558,291 permutations/s ± 10.4%
proof size : 290.2 KiB (1562 scalars, 253.6 KiB of Merkle openings)
cargo leanvm fibonacci --n 2000000 --log-inv-rate 1 --repeat 3Fibonacci (in the exponent, i.e. modulo 2^64 - 1), N = 2,000,000
cycles (VM steps) : 2,040,016
details : MUL 2^20.944 (98.9%) SET 2^13.288 (0.5%) DEREF 2^12.967 (0.4%) JUMP 2^10.968 (0.1%) XOR 2^10.966 (0.1%) MEMORY 2^20.959 BYTECODE 2^10.017 TOTAL_COMMITTED 2^25.261
proof size : 311.2 KiB
proving : 0.326 s ± 7.1% 6,257,419 cycles/s peak memory 2.46 GiB
verifying : 5.963 ms