Modern SNARK designs typically follow a frontend-backend paradigm: The frontend compiles a user’s program into some equivalent circuit representation, while the backend calls for a SNARK specifically made for proving circuit satisfiability. While these circuits are often defined over small fields, the backend prover always needs to lift the computation to much larger fields to ensure soundness. This gap introduces concrete overheads for ZK applications like zkRollups, where group-based SNARKs are used to provide constant-size proofs for Merkle tree openings. For a class of highly repetitive computations, we propose \(\textsf{FREPack}\) , an improved frontend that effectively bridges this gap. The larger the gap between circuit’s small field and backend’s large field, the more \(\textsf{FREPack}\) reduces the circuit size, making it particularly well-suited for group-based backends. Our implementation shows that, for proving \({\approx }300\) iterations of SHA-256, \(\textsf{FREPack}\) improves the performance of Groth16 by \(3.6{\times }\) , Nova by \(3.8{\times }\) , and Spartan by \(5.9{\times }\) .

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

\(\textsf{FREPack}\) : Improved SNARK Frontend for Highly Repetitive Computations

  • Sriram Sridhar,
  • Yi-Nuo Zhang

摘要

Modern SNARK designs typically follow a frontend-backend paradigm: The frontend compiles a user’s program into some equivalent circuit representation, while the backend calls for a SNARK specifically made for proving circuit satisfiability. While these circuits are often defined over small fields, the backend prover always needs to lift the computation to much larger fields to ensure soundness. This gap introduces concrete overheads for ZK applications like zkRollups, where group-based SNARKs are used to provide constant-size proofs for Merkle tree openings. For a class of highly repetitive computations, we propose \(\textsf{FREPack}\) , an improved frontend that effectively bridges this gap. The larger the gap between circuit’s small field and backend’s large field, the more \(\textsf{FREPack}\) reduces the circuit size, making it particularly well-suited for group-based backends. Our implementation shows that, for proving \({\approx }300\) iterations of SHA-256, \(\textsf{FREPack}\) improves the performance of Groth16 by \(3.6{\times }\) , Nova by \(3.8{\times }\) , and Spartan by \(5.9{\times }\) .