| leanXMSS aggregation | 1.2K/s |
| leanSPHINCS aggregation | 280/s |
| leanDA commitment | 2 MiB/s |
| 2-to-1 recursion | 0.29s |
| hash compressions | 480K/s |
| cheap cycles | 5.4M/s |
leanVM is designed for security:
- 128-bit ROM (64-bit QROM) soundness
- no proximity gap conjecture
- end-to-end formal verification
- a traditional hash function
warning: Formal verification is in progress. leanVM is not (yet) production ready.
Expect leanVM to change significantly:
- hash: BLAKE2s is a placeholder. SHA2, SHA3, BLAKE3 are actively considered.
- ISA: A migration from leanISA to RISC-V (rv64im) is planned.
- zk: Support for zero-knowledge is planned.
note: Prior to binary fields leanVM used KoalaBear and Poseidon. The historical design is in this branch.
machine: M4 Max MacBook Pro (12 performance cores, 4 efficiency cores, 48GB RAM)
note: The Metal GPU was not used.
The XMSS parameters are specified in XMSS.pdf, with a (ROM) security proof in Lean 4.
cargo run --release -- aggregate --xmss 900 --log-inv-rate 1 --repeat 3aggregation, 900 XMSS signatures
cycles (VM steps) : 1,573,849 = 2^20.586
details : DEREF 2^18.947 (32.1%) SET 2^18.528 (24.0%) MUL 2^18.259 (19.9%) BLAKE2S 2^16.989 (8.3%) XOR 2^16.979 (8.2%) JUMP 2^16.839 (7.4%) MEMORY 2^21.305 TOTAL_COMMITTED 2^26.195
proof size : 295.4 KiB
proving time : 0.749 s ± 2.1% peak memory 8.769 GiB
per signature : 1,201.795 signatures/s
verifying : 3.799 ms
The SPHINCS parameters are specified in SPHINCS.pdf, with a (ROM) security proof in Lean 4.
cargo run --release -- aggregate --sphincs 245 --log-inv-rate 1 --repeat 3aggregation, 245 SPHINCS signatures
cycles (VM steps) : 2,132,425 = 2^21.024
details : XOR 2^18.951 (23.8%) MUL 2^18.93 (23.4%) SET 2^18.847 (22.1%) DEREF 2^18.711 (20.1%) BLAKE2S 2^16.992 (6.1%) JUMP 2^16.543 (4.5%) MEMORY 2^21.564 TOTAL_COMMITTED 2^26.301
proof size : 300.1 KiB
proving time : 0.861 s ± 1.5% peak memory 9.348 GiB
per signature : 284.603 signatures/s
verifying : 3.841 ms
cargo run --release -- aggregate --blobs 16 --log-inv-rate 1 --repeat 3aggregation, 16 blobs
cycles (VM steps) : 2,989,506 = 2^21.511
details : MUL 2^19.899 (32.7%) XOR 2^19.809 (30.7%) DEREF 2^19.138 (19.3%) JUMP 2^18.299 (10.8%) SET 2^16.787 (3.8%) BLAKE2S 2^16.295 (2.7%) MEMORY 2^21.696 TOTAL_COMMITTED 2^26.695
proof size : 322.4 KiB
proving time : 0.998 s ± 0.9% peak memory 12.646 GiB
blob throughput : 16.032 blobs/s, 2.004 MiB/s
verifying : 6.659 ms
cargo run --release -- recursion --n 2 --xmss-per-leaf 900 --log-inv-rate 2 --repeat 3recursion 2→1, over leaves of 900 XMSS signatures
cycles (VM steps) : 570,113 = 2^19.121
details : MUL 2^17.838 (41.1%) DEREF 2^16.988 (22.8%) XOR 2^16.747 (19.3%) SET 2^15.79 (9.9%) JUMP 2^14.488 (4.0%) BLAKE2S 2^13.978 (2.8%) MEMORY 2^19.507 TOTAL_COMMITTED 2^24.086
proof size : 191.3 KiB
proving time : 0.287 s ± 15.9% peak memory 10.124 GiB
verifying : 4.121 ms
BENCH_REPEAT=3 BENCH_COOLDOWN=2 FLOCK_N_LOG=18 cargo test --release --package flock --test batch_proving_hashes -- hash_batch_prove_verify --exact --nocapture --include-ignoredFlock BLAKE2s batch proving, 262,144 compressions (2^18 slots)
setup (preprocessing, excluded) : 0.0 ms
witness-gen : 64.6 ms ± 7.8% 10.6%
commit : 101.2 ms ± 0.4% 16.6%
zerocheck : 238.3 ms ± 3.9% 39.0%
lincheck : 20.3 ms ± 12.2% 3.3%
pcs opening : 186.0 ms ± 2.9% 30.5%
other : 0.0 ms 0.0%
------------------------------------------
prove TOTAL (witness excluded) : 545.8 ms ± 1.1% 89.4%
verify : 1.9 ms
throughput : 480,319 compressions/s ± 1.1%
(~3289.9 XMSS/s equivalent at 146 compressions/signature)
cargo run --release -- fibonacci --n 2000000 --log-inv-rate 1 --repeat 3Fibonacci (in the exponent, i.e. modulo 2^64 - 1), N = 2,000,000
cycles (VM steps) : 2,127,880
details : MUL 2^20.944 (98.9%) SET 2^13.288 (0.5%) DEREF 2^12.967 (0.4%) JUMP 2^10.968 (0.1%) XOR2^10.966 (0.1%) MEMORY 2^20.96 TOTAL_COMMITTED 2^25.26
proof size : 285.4 KiB
proving : 0.391 s ± 1.1% 5,442,734 cycles/s peak memory 5.203 GiB
verifying : 2.092 ms