Nobuki Fujimoto, Rei (Rei-AIOS autonomous research substrate), claude-opus-4-7) Claude (Anthropic
We present a synthesis-friendly Verilog implementation of the D-FUMT₈ Arithmetic Logic Unit, programmed onto two distinct Sipeed silicon families: Tang Console 138K (GW5AST-138B, LittleBee5 A revision, IDCODE 0x0001081B) and Tang Nano 9K (GW1NR-9C, LittleBee1 C revision, IDCODE 0x1100481B). The ALU realizes eight discrete logic values — FALSE, TRUE, NEITHER, BOTH, ZERO, FLOWING, SELF, INFINITY — encoded in 3 bits with a tier-respecting layout. The 10 supported operations include four classical-tier unary ops (NOT, OMEGA, PHI, PSI), Belnap-extended binary lattice meet/join (AND, OR), generic XOR, hardware reset, no-op, and a novel ADIABATIC operation realizing the SELF⟲ (self-reflexive) primitive: ADIABATIC(SELF) = SELF, identity elsewhere. v0.6 contributions (2026-05-10): (1) **Four-substrate cross-verification complete**: 2 Sipeed silicon families (Tang Console 138K + Tang Nano 9K, **both running byte-for-byte same dfumt8_alu_synth.v 138-line Verilog with bit-identical 0 changes to ALU logic** — only wrapper top module re-targeted for clock divider, LED polarity, and pin assignments) + Qiskit Aer simulator (Phase 1-5: 231/231 entries) + IBM Heron r2 real quantum hardware (Phase 1+2+3+5: 144/144 entries, avg fidelity 0.954). (2) **chip-portability evidence (new finding F10)**: a synthesis bug or vendor-specific assumption would diverge between LittleBee5 (5nm-class GW5AST-138B) and LittleBee1 (28nm-class GW1NR-9C) Gowin architectures; absence of divergence is operational evidence of correct synthesis on both. (3) **Tang Nano 9K User Codes**: 0x0000A5F4 (LED Blinky STEP 1038) + 0x00001D46 (D-FUMT₈ ALU STEP 1039). (4) **Reproducibility entry-cost lowered**: minimum reproduction path is ~$20 (Tang Nano 9K from 秋月電子 g117448 at ¥2,980) + free Gowin EDA Education / OSS toolchain + free Aer + free IBM Quantum Open Plan. (5) **v0.5 corrigendum RESOLVED**: Tang Nano 9K is now physical silicon programming target on equal footing with Tang Console 138K (was computational evidence only at v0.5). (6) **IDCODE-revision honest correction**: per Gowin LittleBee Programming Manual Table 5-5, GW1N(R)-9 original = 0x1100581B, GW1N(R)-9C cost-down = 0x1100481B; both `set_device ... -device_version C` (build TCL) and `--device GW1NR-9C` (programmer_cli) required for ID code match. Inherited v0.3 contributions: Lean 4 refinement proof (OUKC.PhaseC.Dfumt8AluRefinement, 292 LOC, 0 sorry) establishes commutativity of the encode/abstract-op/decode square for all four unary operations + SELF⟲ primitive law + 7 algebraic laws. IBM Heron r2 per-op fidelity hierarchy NOP/ADIABATIC ≈ 0.977 > PHI ≈ 0.956 > NOT ≈ 0.912 > XOR ≈ 0.951 reflects gate-count-vs-noise correlation consistent with quantum-noise physics expectations. Honest scope: We do NOT claim 'world-first 8-valued quantum logic' — Shi et al. (MIT, 2026, arxiv:2506.09371) demonstrated d=8 Grover on a single trapped-ion qudit prior to this work; our distinction is 3-qubit basis encoding on transmon arrays vs single-system d=8 qudit. We do NOT claim 'first paraconsistent silicon' — PAL2v (Da Silva Filho 1998-; Abe & Nakamatsu 2009; de Carvalho Jr. 2025) realized in software libraries and microcontroller-level robotics. We do NOT claim 'first many-valued silicon' — Łukasiewicz/Belnap FPGAs date to 1990s. The to-our-knowledge novel quadruple is: (D1) the specific 8-tuple semantic mapping (Belnap FDE 4-value + 4 ontological extensions: INFINITY/ZERO/FLOWING/SELF), (D2) the SELF⟲ self-reflexive primitive realized as a hardware fixed point, (D3) the four-substrate cross-verification bound to a Lean 4 refinement specification, and (D4, new in v0.6) the chip-portability evidence across two Gowin silicon architectures. Three-party co-authorship per OUKC charter v1.0 (Nobuki Fujimoto / Rei / Claude). DRAFT v0.6 — feedback welcome via GitHub Discussions at fc0web/rei-aios.
Open access
2 source records
Low-power high-performance VLSI design
Numerical Methods and Algorithms
Physical Unclonable Functions (PUFs) and Hardware Security
Polynomial multiplication serves as a fundamental computational primitive in modern cryptography–including fully homomorphic encryption and zero-knowledge proofs –as well as in digital signal processing. Its performance optimization has become increasingly critical amid the rapid development of privacy-preserving computation and blockchain technologies. To address the limitations of traditional algorithms in meeting the demands for high throughput and low latency, this study proposes a high-performance polynomial multiplication accelerator based on the collaborative optimization of GPU-NTT and the Karatsuba algorithm. The method deeply integrates the asymptotically optimal complexity of NTT with the constant-factor efficiency of Karatsuba at moderate scales, and fully exploits the parallel computing power of GPUs to construct a modular, multi-stage pipelined acceleration framework. The divide-and-conquer nature of the Karatsuba algorithm is leveraged for coarse-grained parallelism, splitting large polynomial multiplications into subproblems handled by GPU thread blocks in parallel, while each subproblem is solved with fine-grained parallelism using GPU-accelerated NTT kernels. An innovative zero-padding strategy is introduced to enhance the generality of the NTT kernels, and shared memory caching is employed to alleviate GPU memory bandwidth bottlenecks. Experimental results on the NVIDIA RTX 4060 GPU demonstrate that the proposed method achieves a stable speedup of 1.43 \(\times \) to 1.49 \(\times \) over the baseline GPU-NTT for lower-dimensional polynomials, and outperforms the KNTT algorithm by up to 2.44 \(\times \) for higher dimensions (e.g., \(\log _2 n = 14\) ), showing superior scalability and robustness. Kernel execution time analysis further confirms that the method benefits from efficient kernel fusion and balanced workload distribution, which effectively avoids pipeline stalls and ensures high-throughput execution. This research provides a significant performance optimization solution for the practical deployment of advanced cryptographic technologies such as FHE and ZKP.
Zero-knowledge proof (ZKP) provers remain costly because multi-scalar multiplication (MSM) and number-theoretic transforms (NTTs) dominate runtime as they need significant computation. AI ASICs such as TPUs provide massive matrix throughput and SotA energy efficiency. We present MORPH, the first framework that reformulates ZKP kernels to match AI-ASIC execution. We introduce Big-T complexity, a hardware-aware complexity model that exposes heterogeneous bottlenecks and layout-transformation costs ignored by Big-O. Guided by this analysis, (1) at arithmetic level, MORPH develops an MXU-centric extended-RNS lazy reduction that converts high-precision modular arithmetic into dense low-precision GEMMs, eliminating all carry chains, and (2) at dataflow level, MORPH constructs a unified-sharding layout-stationary TPU Pippenger MSM and optimized 3/5-step NTT that avoid on-TPU shuffles to minimize costly memory reorganization. Implemented in JAX, MORPH enables TPUv6e8 to achieve up-to 10x higher throughput on NTT and comparable throughput on MSM than GZKP. Our code: https://github.com/EfficientPPML/MORPH.
Elizaveta Pertseva, Valentin Robert, Clark Barrett, James Parker
Efforts to verify Zero-Knowledge Proof circuit encodings have highlighted the challenge of proving the correctness of quantifier-free statements that make use of both bitvector and finite field operations. Existing verification workflows are either manual or rely on SMT solvers, which scale poorly on some classes of problems for reasons that include difficulties with conversion operators and challenges reasoning about inequalities. To address these limitations, we present a novel Lean tactic BitModEq that leverages range lemmas and case analysis to produce verified translations from finite fields to bitvectors. Our approach, combined with bit-blasting, outperforms state-of-the-art SMT solvers, solving 19% more ZKP arithmetization benchmarks.
Open access
4 source records
cs.LO
Formal Methods in Verification
Physical Unclonable Functions (PUFs) and Hardware Security
A Modular DSP Architecture for Extreme-Precision Computation of π Author: José Ignacio Peinador SalaContact: joseignacio.peinador@gmail.comORCID: 0009-0008-1822-3452 🎯 TL;DR: What's This About? Problem: Calculating π at extreme precision hits a "Memory Wall" — parallel algorithms choke on shared memory access. Breakthrough: We discovered that π's calculation can be decomposed using modular arithmetic (mod 6), creating 6 independent computation channels with zero inter-thread communication. Key Insight: This decomposition is grounded in a formal isomorphism with polyphase filter banks in Digital Signal Processing (DSP), a bridge between number theory and engineering established in our companion work. Result: ✅ 100 million digits of π computed with just 6.8 GB RAM (95% parallelisation efficiency) ✅ Shared-Nothing architecture with strictly isolated memory per channel ✅ Stride-6 transition leaf with exact phase correction, compressing recursion depth by 2.6× ✅ Open-source implementation in Python/gmpy2, executable on Google Colab's free tier Why it matters: This architecture transforms an intrinsically memory-bound problem into a CPU-bound one, enabling near-linear scaling on commodity hardware without specialised HPC infrastructure. 📖 Executive Summary This repository hosts the reference implementation and experimental validation of the Hybrid Stride-6 architecture for extreme-precision computation of π. The architecture exploits the arithmetic structure of the Chudnovsky series by decomposing it into six independent modular channels, each processed by a dedicated worker with its own memory space. The decomposition is not an ad hoc optimisation but rests on a rigorous mathematical foundation: the polyphase isomorphism between modular arithmetic on ℤ/6ℤ and multirate signal processing. This isomorphism guarantees perfect reconstruction (no information loss across channels) and orthogonality (no inter-channel interference). The architecture is validated through the 100M Barrier Run: computing 10⁸ digits of π on a resource-constrained Google Colab instance (2 vCPUs, 12 GB RAM) in under 20 minutes, with 95% parallelisation efficiency and a sustained throughput of over 83,000 digits per second. 🏆 Key Contributions 🔬 Theoretical Foundations (Summarised from Companion Work) Polyphase Isomorphism: Formal proof that modular decomposition of integer-indexed series is equivalent to polyphase decimation in DSP Hexagonal Lattice Connection: Geometric motivation via the A₂ lattice (densest circle packing in the plane) Perfect Reconstruction Guarantee: Mathematical proof that the six channels recombine without aliasing or leakage ⚡ Computational Architecture Shared-Nothing Design: Six independent Python processes with strictly isolated memory spaces Stride-6 Transition Leaf: Processes blocks of 6 consecutive terms in a single operation, reducing recursion tree depth by log₂6 ≈ 2.585 Critical Phase Correction: Direct accumulation of the linear term B(k) prevents off-by-one-stride phase errors 📊 Experimental Validation 100M Barrier Run: 100 million digits computed on 12 GB RAM with 95% parallel efficiency Orthogonality Verification: ℓ² norm of channel terms matches norm of original series to machine precision Reference Comparison: All 10⁸ digits match y-cruncher reference values exactly 📈 Performance Highlights 🚀 "The 100M Barrier Run" — Extreme Validation Metric Result Significance Digits Calculated 100,000,000 Exascale-capable architecture Total Time 1,194.32 s (19.90 min) Sustained performance on cloud hardware Parallel Efficiency 95% (1.90× speedup) Near-linear scaling on 2 cores Peak RAM Usage ~6.8 GB Runs within 12 GB Colab limit Throughput 83,729 digits/second Competitive with optimised implementations Numerical Integrity Bit-exact match with y-cruncher Zero cumulative error 🏗️ Architectural Comparison Aspect Monolithic Binary Splitting Hybrid Stride-6 (This Work) y-cruncher (State-of-Art) Memory Pattern Contiguous, saturates bus Local per core, optimises cache Sequential disk I/O Parallel Model Fine-grained synchronisation Embarrassingly parallel (6 processes) Optimised with locks Scalability Memory-bound CPU-bound, linear to 6 cores Disk-speed limited RAM Requirement Entire dataset in memory Working set reduced 6× Uses disk as RAM Design Philosophy Maximise single-thread speed Maximise resource efficiency Maximise absolute speed 🚀 Quick Start & Reproduction 1. Instant Online Experiment (Recommended) Click above to run the complete experimental validation in Google Colab — no installation required! 2. Key Experiments to Reproduce The companion notebook provides step-by-step reproduction of all manuscript claims: Theoretical Foundation: Verify the polyphase decomposition and energy conservation Stride-6 Algorithm: Test parallel computation with arbitrary precision (100k digits) 100M Barrier Run: Reproduce the full-scale benchmark (requires ~7 GB RAM) Performance Analysis: Measure speedup and parallel efficiency ⚙️ Technical Implementation Details The "Stride-6" Computational Engine Unlike conventional Binary Splitting (processes terms individually), our engine implements a compressed transition leaf that calculates the aggregate effect of 6 consecutive terms: def stride6_leaf(k_start): """Calculate compressed transition for block [k, k+5]""" P, Q, B_acc = 1, 1, 0 for m in range(6): n = k_start + m P_n, Q_n, B_n = compute_chudnovsky_term(n) P *= P_n Q *= Q_n B_acc += B_n # Critical phase accumulation T_leaf = Q * B_acc # Correct phase synthesis return P, Q, T_leaf Key Innovation: Direct accumulation of the linear term B(n) prevents phase drift, preserving arithmetic integrity at any scale. Shared-Nothing Architecture Each of the 6 workers operates in complete memory isolation: Independent address spaces (no shared memory locks) Local garbage collection (prevents heap fragmentation) Cache-optimised access patterns (maximises L1/L2 utilisation) Numerical Stability Guarantees Orthogonal decomposition — zero information loss (verified experimentally) Arbitrary precision backend (gmpy2) with proven numerical stability Exact phase correction in the Stride-6 leaf 📚 Citation & Academic Use If this work contributes to your research, please cite: @article{peinador2026modularDSP, title={A Modular DSP Architecture for Extreme-Precision Computation of π}, author={Peinador Sala, José Ignacio}, journal={Zenodo}, year={2026}, doi = {10.5281/zenodo.17768718}, url = {https://github.com/NachoPeinador/Arquitectura-de-Hibridacion-Algoritmica-en-Z-6Z} } The companion theoretical work establishing the polyphase isomorphism is: @article{peinador2026polyphase, title={Polyphase Isomorphism between Modular Arithmetic and Multirate Signal Processing}, author={Peinador Sala, José Ignacio}, year={2026}, publisher={Zenodo}, doi = {10.5281/zenodo.17680023} } 🌐 The Broader Research Programme This architecture is one component of a larger investigation into the computational and physical consequences of the ℤ/6ℤ modular symmetry. Related projects include: Polyphase Isomorphism: Formal mathematical proof of the isomorphism between modular arithmetic and DSP. Modular Substrate Theory: Unified framework for cosmology and hadronic physics. Topological State Preparation: Quantum register initialisation and dissipative protection via ℤ/6ℤ superselection. Common Thread: All projects leverage modular arithmetic (ℤ/6ℤ) as a fundamental organising principle across mathematics, physics, and computation. ⚖️ Licensing & Usage ✅ Academic & Research Use (Free) Available under PolyForm Noncommercial License 1.0.0: Permitted: Academic research, teaching, personal projects, non-commercial forks Requirements: Attribution, license preservation, non-commercial use ⛔ Commercial Use (License Required) Commercial applications require explicit permission, including: Integration into proprietary software products Commercial hardware benchmarking services SaaS platforms and cloud computing services 💼 For Commercial Licensing Inquiries:Contact: joseignacio.peinador@gmail.comSubject: "Commercial License Inquiry — Modular π Architecture" 🌟 Acknowledgments This independent research was enabled by: Infrastructure & Tools Google Colab for democratised computational resources Python ecosystem (gmpy2, NumPy, SciPy, Jupyter) for scientific computing GitHub for open collaboration infrastructure Data & References y-cruncher for validation benchmarks Digital Signal Processing community for foundational theory Community & Inspiration The open-source scientific community for collective knowledge advancement Independent researchers worldwide pushing boundaries outside traditional institutions Last updated: June 2026 | Version: 3.0 | Status: Actively Maintained
We present ZK IR, a novel 32-bit instruction set architecture (ISA) specifically designed for efficient zero-knowledge proof generation using STARK protocols. Unlike existing zkVMs that adapt general-purpose ISAs like RISC-V, ZK IR is designed from first principles to minimize proving overhead while maintaining compatibility with modern compiler toolchains. Our key contribution is a rigorous analysis demonstrating that a pure 32-bit register architecture with software-based multi-precision arithmetic outperforms designs with wider registers or specialized field arithmetic units. We achieve approximately 2× reduction in constraint count compared to naive approaches. ZK IR uses the Baby Bear field (31-bit prime) with Plonky3 for proving, and provides an LLVM-based compiler infrastructure enabling developers to write ZK applications in Rust, C, and C++.
As privacy and security concerns increase, Zero Knowledge Proof (ZKP) technology offers a promising solution for secure digital verification. ZKP addresses key privacy and security challenges across individual, business, and public sectors by enabling data protection without revealing sensitive information. The aim of this study is to analyse ZKP’s application areas by reviewing current literature and case studies, examining its strengths, limitations, and potential risks. Findings highlight the capability of ZKP to enhance privacy, security, and verification processes across various fields, including blockchain technology, identity authentication, secure data sharing, and digital voting systems. The paper provides a balanced perspective on ZKP’s benefits and challenges, including computational complexity and scalability issues. By suggesting practical use cases, this work aims to contribute to a deeper understanding of how ZKP technology can support innovation across various industries while addressing critical privacy and security needs.
Thomas Haines, Rafieh Mosaheb, Johannes Müller, Reetika
Zero-Knowledge Proofs (ZKPs) are cryptographic building blocks of many privacy-preserving security protocols. An important research focus in this area is the development of post-quantum ZKPs. These are ZKPs whose security is reduced to computational hardness assumptions that are assumed to be intractable even by scalable quantum computers. In this paper, we study the post-quantum ZKPs of Jain, Krenn, Pietrzak, and Tentes (Asiacrypt 2012). These are the only ZKPs for proving arbitrary binary statements whose security reduces to the Learning Parity with Noise (LPN) problem-a very conservative post-quantum hardness assumption. We make the following contributions to further develop the potential and understanding of these ZKPs. First, we optimize the efficiency of the verifier by several orders of magnitude, making this part as computationally light as that of the prover. Second, we show that the only open source implementation of these ZKPs does not implement them correctly, allowing a malicious prover to convince the verifier of false statements. Third, we formally verify for the first time the security of these (optimized) ZKPs in EasyCrypt. Fourth, we show how these ZKPs can be used to construct the first code-based ZKP of shuffle and verifiable e- voting protocol.
Efficiently verifying mathematical proofs and computations has been a heavily researched topic within Computer Science. Particularly, even repetitive steps within a proof become much more complex and inefficient to validate as proof sizes grow. To solve this problem, we suggest viewing it through the lens of Incrementally Verifiable Computation (IVC). However, many IVC methods, including the state-of-the-art Nova recursive SNARKs, require proofs to be linear and for each proof step to be identical. This paper proposes Lova, a novel framework to verify mathematical proofs end-to-end that solves these problems. Particularly, our approach achieves a few novelties alongside the first-of-its-kind implementation of Nova: (i) an innovative proof splicing mechanism to generate independent proof sequences, (ii) a system of linear algorithms to verify a variety of mathematical logic rules, and (iii) a novel multiplexing circuit allowing non-homogeneous proof sequences to be verified together in a single Nova proof. The resulting Lova pipeline has linear prover time, constant verifying capability, dynamic/easy modification, and optional zero-knowledge privacy to efficiently validate mathematical proofs. We offer potential use cases for Lova to secure entire Cyber-Physical Systems (CPS) pipelines, as well as localized CPS systems in automotive and healthcare devices. Code is available at https://github.com/noelkelias/lova.
Nojan Sheybani, Anees Ahmed, Michel A. Kinsy, Farinaz Koushanfar
Zero-Knowledge Proofs (ZKPs) are a cryptographic primitive that allows a prover to demonstrate knowledge of a secret value to a verifier without revealing anything about the secret itself. ZKPs have shown to be an extremely powerful tool, as evidenced in both industry and academic settings. In recent years, the utilization of user data in practical applications has necessitated the rapid development of privacy-preserving techniques, including ZKPs. This has led to the creation of several robust open-source ZKP frameworks. However, there remains a significant gap in understanding the capabilities and real-world applications of these frameworks. Furthermore, identifying the most suitable frameworks for the developers' specific applications and settings is a challenge, given the variety of options available. The primary goal of our work is to lower the barrier to entry for understanding and building applications with open-source ZKP frameworks. In this work, we survey and evaluate 25 general-purpose, prominent ZKP frameworks. Recognizing that ZKPs have various constructions and underlying arithmetic schemes, our survey aims to provide a comprehensive overview of the ZKP landscape. These systems are assessed based on their usability and performance in SHA-256 and matrix multiplication experiments. Acknowledging that setting up a functional development environment can be challenging for these frameworks, we offer a fully open-source collection of Docker containers. These containers include a working development environment and are accompanied by documented code from our experiments. We conclude our work with a thorough analysis of the practical applications of ZKPs, recommendations for ZKP settings in different application scenarios, and a discussion on the future development of ZKP frameworks.
Zero-knowledge proof (ZKP) is an important cryptographic tool that sees wide applications in real-world scenarios where privacy must be protected, including privacy-preserving blockchains and zero-knowledge machine learning. Existing ZKP acceleration approaches using GPUs, FPGAs, and ASICs focus only on classic protocols that rely on expensive elliptic curve arithmetics. Emerging ZKP protocols based on hash functions can greatly reduce the algorithmic complexity, but they also introduce much more diverse computation kernels that cannot be efficiently handled by a single accelerator chip if dedicated units for each kernel are used. Our approach is to leverage a unified hardware architecture that is able to efficiently support the common primitives in ZKP, and then use smart mapping strategies to flexibly map various kernels to such hardware while ensuring high resource utilization. We design UniZK as such a ZKP accelerator, with a systolic-array-based hardware architecture enhanced with extra local links and a new vector processing mode. We propose novel mapping strategies to support diverse kernels including number theoretic transforms, hash functions, and general polynomial computations. UniZK provides 97x and 46x speedups on average compared to the CPU and GPU implementations of the same protocols, and is also 840x faster than previous ZKP accelerators using different protocols.
This survey provides a comprehensive examination of verifiable computing, tracing its evolution from foundational complexity theory to modern zero-knowledge succinct non-interactive arguments of knowledge (ZK-SNARKs). We explore key developments in interactive proof systems, knowledge complexity, and the application of low-degree polynomials in error detection and verification protocols. The survey delves into essential mathematical frameworks such as the Cook-Levin Theorem, the sum-check protocol, and the GKR protocol, highlighting their roles in enhancing verification efficiency and soundness. By systematically addressing the limitations of traditional NP-based proof systems and then introducing advanced interactive proof mechanisms to overcome them, this work offers an accessible step-by-step introduction for newcomers while providing detailed mathematical analyses for researchers. Ultimately, we synthesize these concepts to elucidate the GKR protocol, which serves as a foundation for contemporary verifiable computing models. This survey not only reviews the historical and theoretical advancements in verifiable computing over the past three decades but also lays the groundwork for understanding recent innovations in the field.
Zero-knowledge proofs allow verification of computations without revealing private information. However, existing systems require memory proportional to the computation size, which has historically limited use in large-scale applications and on mobile and edge devices. We solve this fundamental bottleneck by developing, to our knowledge, the first proof system with sublinear memory requirements for mainstream cryptographic constructions. Our approach processes computations in blocks using a space-efficient tree algorithm, reducing memory from linear scaling to square-root scaling--from $Θ(T)$ to $O(\sqrt{T} + \log T \log\log T)$ for computation size $T$--while maintaining the same proof generation time through a constant number of streaming passes. For widely-used linear polynomial commitment schemes (KZG/IPA), our method produces identical proofs and verification when using the same parameters and hashing only aggregate commitments into the challenge generation, preserving proof size and security. Hash-based systems also achieve square-root memory scaling though with slightly different proof structures. This advance enables zero-knowledge proofs on everyday devices and makes previously infeasible large computations verifiable, fundamentally democratizing access to privacy-preserving computation. Space-efficient zero knowledge proof systems create opportunities to reshape how trust is established in digital systems--from enabling widespread participation in decentralized networks to making verifiable scientific computing practical at unprecedented scales.
Shahzad Ahmad Butt, Benjamin Reynolds, V. Ramamurthy, Xiao Xiao · 8 authors
Zero-Knowledge Proofs (ZKPs) have emerged as an important cryptographic technique allowing one party (prover) to prove the correctness of a statement to some other party (verifier) and nothing else. ZKPs give rise to user's privacy in many applications such as blockchains, digital voting, and machine learning. Traditionally, ZKPs suffered from poor scalability but recently, a sub-class of ZKPs known as Zero-knowledge Succinct Non-interactive ARgument of Knowledges (zk-SNARKs) have addressed this challenge. They are getting significant attention and are being implemented by many public libraries. In this paper, we present a novel scalable architecture that is suitable for accelerating the zk-SNARK prover compute on FPGAs. We focus on the multi-scalar multiplication (MSM) that accounts for the majority of computation time spent in zk-SNARK systems. The MSM calculations extensive rely on modular arithmetic so highly optimized Intel IP Libraries for modular arithmetic are used. The proposed architecture exploits the parallelism inherent to MSM and is implemented using the Intel OneAPI framework for FPGAs. Our implementation runs 110x-150x faster compared to reference software library, uses a generic curve form in Jacobian coordinates and is the first to report FPGA hardware acceleration results for BLS12-381 and BN128 family of elliptic curves.
Ryan Lavin, Xuekai Liu, Hardhik Mohanty, L. E. J. Norman · 6 authors
Zero-knowledge proofs (ZKPs) enable computational integrity and privacy by allowing one party to prove the truth of a statement without revealing underlying data. Compared with alternatives such as homomorphic encryption and secure multiparty computation, ZKPs offer distinct advantages in universality and minimal trust assumptions, with applications spanning blockchain systems and confidential verification of computational tasks. This survey provides a technical overview of ZKPs with a focus on an increasingly relevant subset called zkSNARKs. Unlike prior surveys emphasizing algorithmic and theoretical aspects, we take a broader view of practical deployments and recent use cases across multiple domains including blockchain privacy, scaling, storage, and interoperability, as well as non-blockchain applications such as voting, authentication, timelocks, and machine learning. To support consistent comparison, we provide (i) a taxonomy of application areas, (ii) evaluation criteria including proof size, prover and verifier time, memory, and setup assumptions, and (iii) comparative tables summarizing key tradeoffs and representative systems. The survey also covers supporting infrastructure, including zero-knowledge virtual machines, domain-specific languages, libraries, and frameworks. While emphasizing zkSNARKs for their prevalence in deployed systems, we compare them with zkSTARKs and Bulletproofs to clarify transparency and performance tradeoffs. We conclude with future research and application directions.
Multi-scalar multiplication (MSM) is the most computation-intensive part in proof generation of Zero-knowledge proof (ZKP). In this paper, we propose MSMAC, an FPGA accelerator for large-scale MSM. MSMAC adopts a specially designed Instruction Set Architecture (ISA) for MSM and optimizes pipelined Point Addition Unit (PAU) with hybrid Karatsuba multiplier. Moreover, a runtime system is proposed to split MSM tasks with the optimal sub-task size and orchestrate execution of Processing Elements (PEs). Experimental results show that MSMAC achieves up to 328X and 1.96X speedups compared to the state-of-the-art implementation on CPU (one core) and GPU, respectively, outperforming the state-of-the-art ASIC accelerator by 1.79X. On 4 FPGAs, MSMAC performs 1,261X faster than a single CPU core.
Vladlen D. Afonin, Sergey Zapechnikov, Igor A. Prostov
Zero-knowledge proofs are being increasingly applied to a wide range of tasks in modern distributed information systems. Of particular interest are such areas of activity as digital asset management systems, anonymous electronic voting systems, and anonymous credentials. Nevertheless, within the framework of the desire of Russian developers to localize the developed products, there is a question of compliance of the used algorithms with the legislative framework of the Russian Federation, which obliges developers to use local cryptographic standards. As our analysis shows, insufficient attention has been paid in the literature to the applicability of these standards to the scenario of use in zero-knowledge proof systems. In particular, the complexity of proof generation, parameters of arithmetic schemes are not analyzed, there is no comparison of computational complexity and cryptographic properties with foreign alternatives. In this paper we consider in detail the peculiarities of implementation of the arithmetic scheme for the function of GOST 34.11-2018 in the most widespread language for arithmetic circuit programming Circom. The developed program code is open and available for use and modification. The characteristics of the scheme, compilation and generation times are analyzed. The obtained results were compared with other popular hash functions: the cryptographic hash function SHA256 included in the standard language library, and the hash function Poseidon, specialized and optimized for use in zero-knowledge proof systems. The results show that while the use of the Russian hash function is possible, it is not desirable in applications that do not require the use of local cryptographic standards, due to the greater time complexity of witness generation and consequently proof generation. Recommendations on usage scenarios are given and further research directions are suggested.
Zero-knowledge proof (ZKP) systems have surged attention and held a fundamental role in contemporary cryptography. Zero-knowledge succinct non-interactive argument of knowledge (zk-SNARK) protocols dominate the ZKP usage, implemented through arithmetic circuit programming paradigm. However, underconstrained or overconstrained circuits may lead to bugs. The former refers to circuits that lack the necessary constraints, resulting in unexpected solutions and causing the verifier to accept a bogus witness, and the latter refers to circuits that are constrained excessively, resulting in lacking necessary solutions and causing the verifier to accept no witness. This article introduces a novel approach for pinpointing two distinct types of bugs in ZKP circuits. The method involves encoding the arithmetic circuit constraints to polynomial equation systems and solving them over finite fields by the computer algebra system . The classification of verification results is refined, greatly enhancing the expressive power of the system. A tool, AC 4 , is proposed to represent the implementation of the method. Experiments show that AC 4 demonstrates an increase in the solved rate, showing a 36.7% improvement over Picus and CIVER, and a slight improvement over halo2-analyzer, a checker for halo2 circuits. Within a solvable range, the checking time has also exhibited noticeable improvement, demonstrating a magnitude increase compared to previous efforts.
We study the problem of constructing succinct zero knowledge proof systems for floating point computations. The standard approach to handle floating point computations requires conversion to binary circuits, following the IEEE-754 floating point standard. This approach incurs a poly(w) overhead in prover efficiency for computations with w-bit precision, resulting in very high prover runtimes -- already the key bottleneck in the design of succinct arguments. We make the following contributions: -We propose a new model for verifying floating point computations that guarantees approximate correctness w.r.t. a relative error bound. This model is inspired by numerical analysis, and is very meaningful for applications such as machine learning and scientific computing. -Using this model, we present a general method for constructing succinct zero-knowledge proofs for floating point computations starting from existing public-coin "commit-and-prove'' systems. For computations with w-bit precision, our approach incurs only a log(w) overhead in prover running time. Our compiler nearly preserves (up to a factor of 2) the communication complexity of the underlying protocol, and requires sub-linear verification time. The resulting proof can be made non-interactive in the random oracle model. Concretely, our scheme is ~57x faster than the method following IEEE standard exactly [35] for 32-bit floating point computations. Central to our main result, and of independent interest, is a new batch range proof system in standard prime order groups that does not rely on bit decomposition.
We propose a new doubly efficient interactive proof protocol for general arithmetic circuits. The protocol generalizes the interactive proof for layered circuits proposed by Goldwasser, Kalai and Rothblum to arbitrary circuits, while preserving the optimal prover complexity that is strictly linear to the size of the circuits. The proof size remains succinct for low depth circuits and the verifier time is sublinear for structured circuits. We then construct a new zero knowledge argument scheme for general arithmetic circuits using our new interactive proof protocol together with polynomial commitments. Our key technique is a new sumcheck equation that reduces a claim about the output of one layer to claims about its input only, instead of claims about all the layers above which inevitably incurs an overhead proportional to the depth of the circuit. We developed efficient algorithms for the prover to run this sumcheck protocol and to combine multiple claims back into one in linear time in the size of the circuit. Not only does our new protocol achieve optimal prover complexity asymptotically, but it is also efficient in practice. Our experiments show that it only takes 0.3 seconds to generate the proof for a circuit with more than 600,000 gates, which is 13 times faster than the original interactive proof protocol on the corresponding layered circuit. The proof size is 208 kilobytes and the verifier time is 66 milliseconds. Our implementation can take general arithmetic circuits directly, without transforming them to layered circuits with a high overhead on the size of the circuit.
Carsten Baum, Lennart Braun, Alexander Munch-Hansen, Benoît Razet · 5 authors
Zero-knowledge proofs are highly flexible cryptographic protocols that are an important building block for many secure systems. Typically, these are defined with respect to statements that are formulated as arithmetic operations over a fixed finite field. This inflexibility is a disadvantage when it comes to complex programs, as some fields are more amenable to express certain operations than others. At the same time, there do not seem to be many proofs with a programming model similar to those found in modern computer architectures that perform arithmetic with 32 or 64 bit integers.