leanVM-b

Warning: highly experimental.

Benchmarks

Machine: Mac M4 Max

XMSS aggregation

Our XMSS is specified in XMSS.pdf.

cargo run --release -- aggregate --xmss 900 --log-inv-rate 1 --repeat 3

aggregation, 900 XMSS signatures
  cycles (VM steps)           : 1,542,871 = 2^20.557
    details                   : DEREF 2^18.988 (33.7%)  SET 2^18.402 (22.4%)  MUL 2^18.199 (19.5%)  BLAKE2S 2^16.995 (8.5%)  XOR 2^16.961 (8.3%)  JUMP 2^16.843 (7.6%)  MEMORY 2^21.724  TOTAL_COMMITTED 2^26.195
  proof size                  : 295.0 KiB
  proving time                : 0.815 s ± 2.7%      peak memory 9.071 GiB
  per signature               : 1,104.043 signatures/s
  verifying                   : 0.0141 s

SPHINCS aggregation

Our SPHINCS is specified in SPHINCS.pdf.

cargo run --release -- aggregate --sphincs 245 --log-inv-rate 1 --repeat 3

aggregation, 245 SPHINCS signatures
  cycles (VM steps)           : 2,677,883 = 2^21.353
    details                   : DEREF 2^19.45 (26.7%)  XOR 2^19.306 (24.2%)  MUL 2^19.212 (22.7%)  SET 2^18.866 (17.8%)  BLAKE2S 2^16.996 (4.9%)  JUMP 2^16.568 (3.6%)  MEMORY 2^22.089  TOTAL_COMMITTED 2^26.875
  proof size                  : 335.6 KiB
  proving time                : 1.194 s ± 4.9%      peak memory 14.653 GiB
  per signature               : 205.145 signatures/s
  verifying                   : 0.0171 s

Recursion

cargo run --release -- recursion --n 2 --xmss-per-leaf 900 --log-inv-rate 2 --repeat 3

recursion 2→1, over leaves of 900 XMSS signatures
  cycles (VM steps)           : 746,499 = 2^19.51
    details                   : DEREF 2^18.002 (35.2%)  MUL 2^17.779 (30.1%)  XOR 2^17.37 (22.7%)  SET 2^15.317 (5.5%)  JUMP 2^14.802 (3.8%)  BLAKE2S 2^14.309 (2.7%)  MEMORY 2^19.805  TOTAL_COMMITTED 2^24.856
  proof size                  : 211.6 KiB
  proving time                : 0.417 s ± 4.0%      peak memory 10.491 GiB
  verifying                   : 0.0153 s

Fibonacci

cargo run --release -- fibonacci --n 2000000 --log-inv-rate 1 --repeat 3

Fibonacci (in the exponent, i.e. modulo 2^64 - 1), N = 2,000,000
  cycles (VM steps)           : 2,127,880
    details                   : MUL 2^20.937 (98.7%)  DEREF 2^13.967 (0.8%)  SET 2^12.552 (0.3%)  JUMP 2^10.968 (0.1%)  XOR 2^10.966 (0.1%)  MEMORY 2^20.964  TOTAL_COMMITTED 2^25.263
  proof size                  : 285.4 KiB
  proving                     : 0.401 s ± 2.7%   5,303,239 cycles/s      peak memory 5.126 GiB
  verifying                   : 0.00281 s

Batch proving BLAKE2s

BENCH_REPEAT=3 BENCH_COOLDOWN=2 FLOCK_N_LOG=18 cargo test --release --package flock --test batch_proving_hashes -- hash_batch_prove_verify --exact --nocapture --include-ignored

Flock BLAKE2s batch proving, 262,144 compressions (2^18 slots)
  setup (preprocessing, excluded) :      0.0 ms
  witness-gen                     :     62.2 ms ± 29.8%  10.1%
  commit                          :    100.2 ms ± 1.2%   16.3%
  zerocheck                       :    234.8 ms ± 1.4%   38.3%
  lincheck                        :     20.5 ms ± 7.7%    3.3%
  pcs opening                     :    195.9 ms ± 3.4%   31.9%
  other                           :      0.0 ms           0.0%
  ------------------------------------------
  prove TOTAL (witness excluded)  :    551.4 ms ± 1.9%   89.9%
  verify                          :      2.0 ms
  throughput                      :        475,423 compressions/s ± 1.9%
  (~3256.3 XMSS/s equivalent at 146 compressions/signature)

Security

• 128-bit (LDR Johnson, no proximity gaps conjecture)

Snark machinery

• Binary field of 192 bits
• PCS: WHIR (aka Ligerito)
• Proving BLAKE2s by Flock
• RingSwitching, M3 arithmetisation, (and more) by Binius / Binius64 (see DP23 and DP24)