3
$\begingroup$

I know that zk-SNARK takes in range of milliseconds to verify statements. But what about the time to generate the proof. For example, if I have a circuit that tests the There is key s.t H(key)=s

Thanks for anyone offers help in this question since I need an answer to it urgently in my thesis.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

I just run example code from ZoKrates manual and measured time and memory usage.

Here is how "proof of preimage" problem defined in ZoKrates:

def main(field a, field b, field c, field d) -> (field):
    h0, h1 = sha256packed(a, b, c, d)
    h0 == 263561599766550617289250058199814760685
    h1 == 65303172752238645975888084098459749904
    return 1

For such a simple program:

  • setup takes ~20 seconds and ~350 Mb memory;
  • generating witness and proof takes <5 seconds and ~150 Mb memory.

For something more complex like proving UTXO in ZCash proving may take tens of seconds and couple of gigabytes (see here).

Following steps are required to run the proving protocol.

1. Compile human readable code into arithmetic circuits (~7 seconds, ~240 Mb):

$ time zokrates compile -i hashexample.code
2.08user 5.14system 0:07.24elapsed 99%CPU (0avgtext+0avgdata 238044maxresident)k
0inputs+21641416outputs (0major+70866minor)pagefaults 0swaps

Generated arithmetic circuit is 15Mb.

2. Trusted setup (~15 seconds, 350 Mb)

$ time zokrates setup
13.73user 0.94system 0:14.68elapsed 99%CPU (0avgtext+0avgdata 354912maxresident)k
0inputs+66248outputs (0major+90965minor)pagefaults 0swaps

On this step proving key (32Mb) and verifying key (2.6Kb) are generated.

3. Computing witness from known arguments (~1 second, ~150 Mb)

$ time zokrates compute-witness -a 0 0 0 5
0.82user 0.92system 0:01.75elapsed 99%CPU (0avgtext+0avgdata 148620maxresident)k
0inputs+1440outputs (0major+39469minor)pagefaults 0swaps

Witness is 458 Kb in size.

4. Generating the proof (~3 seconds, ~106 Mb)

$ time zokrates generate-proof
2.71user 0.06system 0:02.78elapsed 99%CPU (0avgtext+0avgdata 106188maxresident)k
0inputs+40outputs (0major+36676minor)pagefaults 0swaps

The proof is 1.4 Kb in size.

Improve this answer
$\endgroup$
7
  • $\begingroup$ I really want to thank you. you saved me. I have another question if statement I want to verify using ZK-SNARk include encryption operation as There is key s.t H(key)=s and H(Dec(U,key))= Ui . Can we get the time to generate a proof for the previous statement? $\endgroup$
    – Mohamed
    Nov 4, 2018 at 23:11
  • $\begingroup$ Couldn't find any SNARKified encryption algorithm, but I think it is safe to assume that decryption circuit size is comparable to the hashing circuit. So I checked double hashing: compile and setup takes 50sec and 700Mb, proof generation takes 10sec and 230Mb. For triple hasing it is 70sec, 1Gb and 14sec, 320Mb respectively. $\endgroup$
    – max taldykin
    Nov 5, 2018 at 7:34
  • $\begingroup$ What about the verification time in zokrtes ? $\endgroup$
    – Mohamed
    Mar 31, 2019 at 7:00
  • $\begingroup$ Verification is almost instant as it O(1) and does not depend on circuit size. $\endgroup$
    – max taldykin
    Mar 31, 2019 at 18:34
  • $\begingroup$ Is there is any code to determine the time of verification of a proof ?? $\endgroup$
    – Mohamed
    Mar 31, 2019 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.