Skip to content

Repository files navigation

leanVM

Minimal hash-based zkVM, for a Post-Quantum Ethereum.

DocumentationzkDSL referencePython verifier

Proving System

The VM design is inspired by the famous Cairo paper.

Benchmarks

Machine: M4 Max 48GB (CPU only)

Expect incoming perf improvements.

XMSS aggregation

cargo run --release -- xmss --n-signatures 1550 --log-inv-rate 1
WHIR rateProven RegimeProximity Gaps Conjecture
1/21426 XMSS/s - 327 KiB1481 XMSS/s - 171 KiB
1/41027 XMSS/s - 220 KiB1049 XMSS/s - 122 KiB

(Proving throughput - proof size)

Recursion

Aggregating together n previously aggregated signatures, each containing 700 XMSS.

cargo run --release -- recursion --n 2 --log-inv-rate 2
nWHIR rateProven RegimeProximity Gaps Conjecture
11/20.22s = 1 x 0.22s - 268 KiB0.16s = 1 x 0.16s - 136 KiB
11/40.25s = 1 x 0.25s - 179 KiB0.18s = 1 x 0.18s - 93 KiB
21/20.53s = 2 x 0.26s - 265 KiB0.33s = 2 x 0.16s - 152 KiB
21/40.47s = 2 x 0.24s - 187 KiB0.34s = 2 x 0.17s - 98 KiB
31/20.7s = 3 x 0.23s - 299 KiB0.48s = 3 x 0.16s - 144 KiB
31/40.67s = 3 x 0.22s - 183 KiB0.44s = 3 x 0.15s - 107 KiB
41/21.04s = 4 x 0.26s - 293 KiB0.62s = 4 x 0.15s - 160 KiB
41/40.87s = 4 x 0.22s - 199 KiB0.64s = 4 x 0.16s - 105 KiB

(time for n->1 recursive aggregation - proof size)

Bonus: unbounded recursive aggregation

cargo run --release -- fancy-aggregation

Recursive aggregation

(Proven regime)

Security

snark

≈ 124 bits of provable security, given by Johnson bound + degree 5 extension of koala-bear. (128 bits requires bigger hash digests (8 koalabears ≈ 248 bits) -> TODO). In the benchmarks, we also display performance with conjectured security, even though leanVM targets the proven regime by default.

XMSS

Currently, we use an XMSS with hash digests of 4 field elements ≈ 124 bits. Tweaks and public parameters ensure domain separation. An analysis in the ROM (resp. QROM), inspired by the section 3.1 of Tight adaptive reprogramming in the QROM would lead to ≈ 124 (resp. 62) bits of classical (resp. quantum) security. Going to 128 / 64 bits of classical / quantum security, i.e. NIST level 1 (in the ROM/QROM), is an ongoing effort. It requires either:

  • hash digests of 5 field elements (drawback: we need to double the hash chain length from 8 to 16 if we want to stay below one IPv6 MTU = 1280 bytes)
  • a new prime, close to 32 bits (typically p = 125.2^25 + 1) or 64 bits (goldilocks, p = 2^64 - 2^32 + 1). The goldilocks branch is actively maintained, the only blocker is performance degradation.

It's important to mention that a security analysis in the ROM / QROM is not the most conservative. In particular, eprint 2025/055's security proof holds in the standard model (at the cost of bigger hash digests): the implementation is available in the leanSig repository. A compatible version of leanVM can be found in the devnet5 branch.

Credits

  • Plonky3 for its various performant crates
  • whir-p3: a Plonky3-compatible WHIR implementation
  • Whirlaway: Multilinear snark for AIR + minimal zkVM

About

Minimal zkVM for Ethereum.

Resources

Security policy

Stars

157 stars

Watchers

9 watching

Forks

Releases

Packages

Contributors

Languages