Repository navigation
Conversation
tcoratger
added this pull request to stack #625
October 11, 2026 22:45
This was referenced Oct 11, 2026
Benchmarks: base against this PR, on one runner6e1d4b8 merged into its base, against the base abd13d6: each benchmark run in turns on one runner, base and PR 5 times each. A size is shown when it changed; a time or a peak memory when it moved the same way in every round and its median by at least 1% (the change is the median ratio, with the rounds' range). Threads shows the named configuration; BLAKE2sProver stages
FibonacciProver stages
leanSPHINCSProver stages
leanXMSS
Prover stages
Every resultBLAKE2s
Prover stages
Fibonacci
Prover stages
Field and transpose kernels
Flock
PCS
leanSPHINCS
Prover stages
leanXMSS
Prover stages
|
Prover::zero_knowledge(randomness) makes proofs that reveal nothing of the advice or the run beyond the run's shape: each table's height and the rate. - ProofKind (Plain, ZeroKnowledge) is the one notion every layer takes: the witness's layout, the size check, the verifier's layout, the envelope (LVMZ for zero knowledge, so a proof of one kind is refused as the other) and the session. - A zero-knowledge layout is the hiding stack (data lanes, zero lanes, the random group, every lane padded) and grinds L0_LIST_BITS more before the bus: the key commitment is a second list every challenge before the openings is unioned over. - The final clock's free bits, the bus, the tables, flock's reductions and the opening's lane rounds travel under one-time-pad keys; the opening then reveals its claim and the rest is in the clear. - The verifier runs its own core over the padded transcript through the zk crate's recorder (Layout::record_core); each free clock bit is recorded as a bit, so a failed row's bit 41 has no place in it. - Deferred claims: the prover sends what they need of the public polynomials (each bytecode term, RAM's image, each circuit's slice weights); DeferredClaims::into_plain records each hidden claim as a linear constraint on them and batches them by one challenge into claims of the plain shape, which check_deferred settles as a plain proof's. So the core of either kind leaves the same claims, which recursion carries out alike. - The outer proof shows the keys satisfy the record, discharged by the key commitment's opening. - Program::prove_execution takes the Prover whose rate and randomness it proves with; verify, verify_core and verify_recording take either kind of proof. Aggregation trees still refuse zero-knowledge leaves, and the CLI's --zk is for single runs. Tests: an honest proof verifies, round-trips its bytes, is refused under another output or as a plain proof, and is a function of its seed; tampered bytes across the proof are refused without panic; a forged run whose final clock carries the failure bit is refused by the outer proof. Cost on leanXMSS-100 (Apple M1 Pro, 16 threads): proving 0.27 s plain, 0.29 to 0.32 s zero knowledge; proof 296 KiB to 485 KiB; verifying 3.8 ms to 7.5 ms. Every full-size workload proves and verifies in zero knowledge. Co-Authored-By: Kevaundray Wedderburn <kevtheappdev@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tcoratger
force-pushed
the
zk-stack/5-zk-leaves
branch
from
October 11, 2026 23:18
c1c0900 to
73902e1
Compare
Co-Authored-By: Kevaundray Wedderburn <kevtheappdev@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack: #619 spec → #620 transcript → #621 pcs → #622 outer proof → #623 ZK leaves → #624 recursion. Replaces #532.
Part 5 of 6 of the zero-knowledge stack (spec: Annex F).
Prover::zero_knowledge(randomness)makes proofs that reveal nothing of the advice or the run beyond each table's height and the rate.What
ProofKind(PlainorZeroKnowledge) is threaded through every layer instead of boolean flags:LVMZ), so a proof of one kind is refused as the other;Layout::record_core. Each clock bit is a recorded bit, so a failed row's bit 41 has no place in it.DeferredClaims::into_plain:check_deferredsettles as usual.Program::prove_executiontakes theProver.verify,verify_coreandverify_recordingtake either kind. The CLI has--zk.Tests
The full workspace suite passes, plain proofs unchanged.
Cost
leanXMSS-100 on an Apple M1 Pro, 16 threads:
Co-authored-by: Kevaundray Wedderburn kevtheappdev@gmail.com
🤖 Generated with Claude Code