I just run example code from ZoKrates manual and measured time and memory usage.
Here is how "proof of preimage" problem defined in ZoKrates:
def main(field a, field b, field c, field d) -> (field):
h0, h1 = sha256packed(a, b, c, d)
h0 == 263561599766550617289250058199814760685
h1 == 65303172752238645975888084098459749904
return 1
For such a simple program:
- setup takes ~20 seconds and ~350 Mb memory;
- generating witness and proof takes <5 seconds and ~150 Mb memory.
For something more complex like proving UTXO in ZCash proving may take tens of seconds and couple of gigabytes (see here).
Following steps are required to run the proving protocol.
1. Compile human readable code into arithmetic circuits (~7 seconds, ~240 Mb):
$ time zokrates compile -i hashexample.code
2.08user 5.14system 0:07.24elapsed 99%CPU (0avgtext+0avgdata 238044maxresident)k
0inputs+21641416outputs (0major+70866minor)pagefaults 0swaps
Generated arithmetic circuit is 15Mb.
2. Trusted setup (~15 seconds, 350 Mb)
$ time zokrates setup
13.73user 0.94system 0:14.68elapsed 99%CPU (0avgtext+0avgdata 354912maxresident)k
0inputs+66248outputs (0major+90965minor)pagefaults 0swaps
On this step proving key (32Mb) and verifying key (2.6Kb) are generated.
3. Computing witness from known arguments (~1 second, ~150 Mb)
$ time zokrates compute-witness -a 0 0 0 5
0.82user 0.92system 0:01.75elapsed 99%CPU (0avgtext+0avgdata 148620maxresident)k
0inputs+1440outputs (0major+39469minor)pagefaults 0swaps
Witness is 458 Kb in size.
4. Generating the proof (~3 seconds, ~106 Mb)
$ time zokrates generate-proof
2.71user 0.06system 0:02.78elapsed 99%CPU (0avgtext+0avgdata 106188maxresident)k
0inputs+40outputs (0major+36676minor)pagefaults 0swaps
The proof is 1.4 Kb in size.