Repository navigation
Conversation
tcoratger
added this pull request to stack #625
October 11, 2026 22:45
This was referenced Oct 11, 2026
Benchmarks: base against this PR, on one runnered77f84 merged into its base, against the base d2fc75c: each benchmark run in turns on one runner, base and PR 5 times each. A size is shown when it changed; a time or a peak memory when it moved the same way in every round and its median by at least 1% (the change is the median ratio, with the rounds' range). Threads shows the named configuration; PCS
leanXMSS
Prover stages
Every resultBLAKE2s
Prover stages
Fibonacci
Prover stages
Field and transpose kernels
Flock
PCS
leanSPHINCS
Prover stages
leanXMSS
Prover stages
|
tcoratger
force-pushed
the
zk-stack/4-outer-proof
branch
from
October 11, 2026 23:18
beedf45 to
f116135
Compare
A new crate for zero knowledge by composition: a proof's scalars travel under one-time-pad keys, and an outer proof shows the keys satisfy every check the verifier made on them. - Recorder runs the verifier's own code over a padded transcript, through an inner verifier. An element is a Value: Public, the inner verifier's own, or Hidden, a node of a linear graph over the keys. A linear step is one node; a product or an inverse of hidden values is an auxiliary value and one row; an equality with a hidden side and a bit (ensure_bit) are one row each. - What it records depends on the transcript's shape alone: nodes, auxiliary values and rows in creation order, nothing merged, sorted or dropped by value. A verifier that builds rows and one that checks values therefore record the same system, which recursion over zero-knowledge proofs needs. - The system is the record's rows, then two dummy rows on fresh slots, over z = (1, slots). The record pulls row weights back onto the keys in one reverse pass, linear in the graph; the prover evaluates the graph from its keys. - The outer Spartan over E, the eq-weighted MLE-check with a per-variable degree-2 mask, ends in a RowClaim and a MaskClaim. - Keys draws a proof's keys, dummies and mask and commits them behind a hiding CommittedStack; KeyCommitment is the verifier's side. Their opening of one Weighted claim discharges both Spartan claims. - Randomness (Os, or Fixed for tests, never printed) gives a proof's Seed, cut into one ChaCha20 stream per Purpose. Co-Authored-By: Kevaundray Wedderburn <kevtheappdev@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tcoratger
force-pushed
the
zk-stack/4-outer-proof
branch
from
October 12, 2026 08:39
f116135 to
ed77f84
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack: #619 spec → #620 transcript → #621 pcs → #622 outer proof → #623 ZK leaves → #624 recursion. Replaces #532.
Part 4 of 6 of the zero-knowledge stack (spec: Annex F, "The record" and "The outer proof").
A new
zkcrate: the outer proof that the keys satisfy every check the verifier made on hidden values.API
Recorder<V>. It runs the verifier's own code over a padded transcript, through an inner verifier.Value<E>. An element isPublic, the inner verifier's own value, orHidden, aNodeof a linear graph over the keys.ensure_bit.Keys::commitdraws a proof's keys, dummies and mask, and commits them behind a hidingCommittedStack.KeyCommitment::readreads that commitment's root.outer::prove(ps, &record, &keys)andouter::verify(recorder, &commitment).Randomness::{Os, Fixed}gives a proof'sSeed, andSeed::stream(Purpose)one ChaCha20 stream per purpose. A fixed seed is never printed.Internals
RowClaimand aMaskClaim, discharged by one weighted opening of the key commitment.Tests
Co-authored-by: Kevaundray Wedderburn kevtheappdev@gmail.com
🤖 Generated with Claude Code