| leanXMSS aggregation | 1,2K/s |
| leanSPHINCS aggregation | 880/s |
| leanDA commitment | 2,3 MiB/s |
| 2-to-1 recursion | 0.30s |
| proving KECCAK | 560K/s |
| cheap cycles | 6,2M/s |
leanVM is designed for security:
- 128-bit ROM (64-bit QROM) soundness
- no proximity gap conjecture
- end-to-end formal verification
- a traditional hash function
warning: Formal verification is in progress. leanVM is not (yet) production ready.
Expect leanVM to change significantly:
- hash: Keccak-256 is a placeholder: SHA2, BLAKE2s and BLAKE3 are actively considered.
- ISA: A migration from leanISA to RISC-V (rv64im) is planned.
- zk: Support for zero-knowledge is planned.
note: Prior to binary fields leanVM used KoalaBear and Poseidon. The historical design is in this branch.
machine: M4 Max MacBook Pro (12 performance cores, 4 efficiency cores, 48GB RAM)
note: The Metal GPU was not used.
The leanXMSS parameters are specified in leanXMSS.pdf, with a (ROM) security proof in Lean 4. This is not the definitive parameter set.
cargo leanvm aggregate --xmss 1400 --log-inv-rate 1 --repeat 3aggregation, 1,400 leanXMSS signatures
cycles (VM steps) : 1,569,346 = 2^20.582
details : XOR 2^18.675 (26.7%) SET 2^18.179 (18.9%) MUL 2^18.13 (18.3%) KECCAK 2^17.994 (16.6%) DEREF 2^17.559 (12.3%) JUMP2^16.788 (7.2%) MEMORY 2^23.109 BYTECODE 2^18.467 TOTAL_COMMITTED 2^26.801
proof size : 359.5 KiB
proving time : 1.15 s ± 0.5% peak memory 8.633 GiB
per signature : 1,216.937 signatures/s
verifying : 7.449 ms
The leanSPHINCS parameters are specified in leanSPHINCS.pdf, with a (ROM) security proof in Lean 4. This is not the definitive parameter set.
cargo leanvm aggregate --sphincs 975 --log-inv-rate 1 --repeat 3aggregation, 975 leanSPHINCS signatures
cycles (VM steps) : 1,774,463 = 2^20.759
details : XOR 2^18.916 (27.9%) SET 2^18.533 (21.4%) MUL 2^18.192 (16.9%) KECCAK 2^17.993 (14.7%) DEREF 2^17.75 (12.4%) JUMP2^16.871 (6.8%) MEMORY 2^22.769 BYTECODE 2^18.467 TOTAL_COMMITTED 2^26.313
proof size : 330.5 KiB
proving time : 1.102 s ± 1.1% peak memory 7.074 GiB
per signature : 884.923 signatures/s
verifying : 7.658 ms
cargo leanvm aggregate --blobs 16 --log-inv-rate 1 --repeat 3aggregation, 16 blobs
cycles (VM steps) : 3,197,310 = 2^21.608
details : XOR 2^20.223 (38.3%) MUL 2^19.895 (30.5%) DEREF 2^19.131 (18.0%) JUMP 2^18.297 (10.1%) SET 2^15.903 (1.9%) KECCAK2^15.324 (1.3%) MEMORY 2^21.939 BYTECODE 2^18.467 TOTAL_COMMITTED 2^26.486
proof size : 338.4 KiB
proving time : 0.87 s ± 3.4% peak memory 7.404 GiB
blob throughput : 18.382 blobs/s, 2.298 MiB/s
verifying : 12.228 ms
cargo leanvm recursion --n 2 --xmss-per-leaf 900 --log-inv-rate 2 --repeat 3recursion 2→1, over leaves of 900 leanXMSS signatures
cycles (VM steps) : 542,049 = 2^19.048
details : MUL 2^17.622 (37.2%) XOR 2^17.183 (27.5%) DEREF 2^16.839 (21.6%) SET 2^15.214 (7.0%) JUMP 2^14.526 (4.4%) KECCAK 2^13.63 (2.3%) MEMORY 2^19.78 BYTECODE 2^18.467 TOTAL_COMMITTED 2^24.02
proof size : 216.9 KiB
proving time : 0.309 s ± 1.6% peak memory 2.315 GiB
verifying : 9.176 ms
cargo leanvm hash --log-n 17 --repeat 3Keccak GKR batch proving, 131,072 permutations, a state committed every 12 rounds
witness : 14.8 ms ± 87.7% 6.3%
commit : 17.7 ms ± 34.5% 7.5%
output claim : 2.1 ms ± 20.4% 0.9%
layers and openings : 177.0 ms ± 4.1% 75.4%
pcs opening : 23.2 ms ± 7.0% 9.9%
------------------------------------------
prove TOTAL (witness included) : 234.8 ms ± 10.4%
verify : 4.2 ms
throughput : 558,291 permutations/s ± 10.4%
proof size : 290.2 KiB (1562 scalars, 253.6 KiB of Merkle openings)
cargo leanvm fibonacci --n 2000000 --log-inv-rate 1 --repeat 3Fibonacci (in the exponent, i.e. modulo 2^64 - 1), N = 2,000,000
cycles (VM steps) : 2,040,016
details : MUL 2^20.944 (98.9%) SET 2^13.288 (0.5%) DEREF 2^12.967 (0.4%) JUMP 2^10.968 (0.1%) XOR 2^10.966 (0.1%) MEMORY 2^20.959 BYTECODE 2^10.017 TOTAL_COMMITTED 2^25.261
proof size : 311.2 KiB
proving : 0.326 s ± 7.1% 6,257,419 cycles/s peak memory 2.46 GiB
verifying : 5.963 ms