Revisiting Accepted Wisdom in SNARK Design | a16z crypto research

TL;DR

Jolt's design challenges common beliefs in the snark community, showcasing that simpler instruction sets and high degree constraints may not be crucial for ZKVMs, and large fields can be efficient. Recursion and breaking circuits into smaller pieces may not always lead to better performance.

Transcript

so uh I think the way that jolt Works actually uh counters a number of narratives or just general beliefs uh in sort of the community that's building and deploying these snarks so I wanted to describe some of them um so one of them uh and you see this uh Viewpoint expressed uh prominently like on Twitter all the time is that uh simpler instruction ... Read More

Key Insights

• 😫 Simplifying instruction sets does not necessarily result in faster ZKVMs; prover costs are determined by the size of the lookup table.
• 👋 High degree constraints may not be crucial for ZKVMs; the focus should be on using a good lookup argument.
• 🌥️ Large fields are not necessarily wasteful in snark design, especially when using elliptic curve-based commitment schemes.
• 🥺 Breaking circuits into smaller pieces may not always lead to better performance; it depends on the specific snark design.
• 🍳 Jolt's design showcases economies of scale, challenging the belief that breaking circuits into smaller pieces is always beneficial.
• 🇨🇷 The prover's costs in Jolt are dependent on the lookup argument size, not the complexity of the instructions.
• ✋ R1CS, a special type of degree two constraints, is sufficient for Jolt's design, diminishing the importance of high degree constraints.

Questions & Answers

Q: Why do simpler instruction sets not necessarily lead to faster ZKVMs?

Jolt's design proves that the prover's costs are determined by the size of the lookup table, which depends on the inputs to the instruction, rather than the complexity of the instruction itself.

Q: How does Jolt handle high degree constraints compared to other snark designs?

Jolt opts for a special kind of degree two constraints called R1CS, shifting the focus from high degree constraints to the use of a good lookup argument for better performance.

Q: Why is the belief that snarks over large fields are wasteful challenged?

Committing to small field elements with elliptic curve-based schemes can be accomplished with minimal overhead, making large fields efficient in certain settings.

Q: Is breaking circuits into smaller pieces always beneficial in snark design?

While popular techniques rely on recursion and breaking circuits into smaller pieces, Jolt's design shows that it can lead to diseconomies of scale, and one proof for a larger circuit may be better.

Summary & Key Takeaways

• Jolt's design counters narratives in the snark community that believe simpler instruction sets result in faster ZKVMs, showing that instruction complexity doesn't affect prover costs significantly.

• The focus on supporting high degree constraints may not be as important for ZKVMs as using a good lookup argument, like the one Jolt utilizes.

• Snark designers often prefer working with small fields to avoid wastefulness, but committing with elliptic curve-based schemes to small field elements can be fast.