Revealing Plonky2 Goldibear: The Fastest Proof Aggregator over the BabyBear Field

We are excited to share our latest advancements in cryptographic proof generation and aggregation with the introduction of Plonky2 Goldibear. Our new systems provide cutting-edge performance improvements, especially in recursive proof composition over the BabyBear field.

With the introduction of Plonky2 Goldibear, we have also developed a new version of Risclonky2 that no longer requires simulating arithmetic as it operates directly on the BabyBear field. This allows highly efficient verification and aggregation of Risc0 proofs, paving the way for the development of highly scalable user data-protecting applications.

Here's a detailed breakdown of the benchmark results showing that Plonky2 Goldibear is 77 times faster than Risc0 in proof aggregation over BabyBear on CPU, and it’s still 8,5 times faster compared to the Risc0 GPU prover outperforming it even in terms of cost effectiveness. 

Plonky2 Goldibear Key Performance Highlights

• Aggregation of 2 Proofs over BabyBear Field: 520 ms
  
  
• Wrapping a RISC0 proof into a Plonky2 Goldibear proof: 900 ms
  
  
• Aggregate 1024 Risc0 Proofs: 6.10 sec ***

Benchmark Table

Hardware:

CPU: 11th Gen Intel(R) Core(TM) i9-11900K

GPU: NVIDIA GeForce RTX 4090

Definitions:

*  Native aggregation is meant as aggregating proofs of the same type of the proving systems used (eg. Risc0 proofs aggregated using Risc0, Plonky2 proofs aggregated using Plonky2). In other words it does not need an additional wrap.

** Theoretical lower bound aggregation time considering parallel proving and proof recursion performed in a tree like structure. The source proofs are native to the prover (no wrap needed).

*** Theoretical lower bound aggregation time considering parallel proving and proof recursion performed in a tree like structure. The source proofs are Risc0 proofs (wrap needed using Plonky2 Goldibear).

Introducing Plonky2 Goldibear

Plonky2 Goldibear is our latest iteration of the Plonky2 prover, which supports generating proofs over both the Goldilocks and BabyBear fields. This flexibility allows for the generation of circuits that work efficiently under BabyBear, resulting in performance improvements and more versatile cryptographic applications.

Efficient Recursive Proofs Over BabyBear

With Plonky2 Goldibear, we have introduced optimized gates and gadgets to enable efficient recursive proof composition over the BabyBear field. Recursive proofs allow us to aggregate multiple proofs into a single proof, reducing verification complexity and improving performance. The support for BabyBear marks a significant milestone in our recursive proof capabilities.

Integration with Plonky3

Plonky2 Goldibear leverages the advances made in Plonky3, particularly in field arithmetic and hash primitive implementations. By integrating Plonky3’s optimizations, Plonky2 Goldibear can take full advantage of future improvements, making it highly adaptable and forward-compatible.

RISC0 Proof Wrapping (Risclonky2)

In addition to these advancements, we have developed a new version of the Risclonky2 library, which allows the wrapping of RISC0 proofs directly into Plonky2 Goldibear proofs over the BabyBear field. One of the key advantages of this library is that it eliminates the need to simulate arithmetic, significantly reducing the time required for wrapping. Specifically, the wrapping of a RISC0 proof now takes only 900 ms.

This breakthrough enables us to aggregate thousands of RISC0 proofs in a very short amount of time. For example, the aggregation of 1024 RISC0 proofs over BabyBear is estimated to take around 6 seconds. Comparatively, performing the same aggregation using RISC0 alone would take substantially longer, as the aggregation of just two RISC0 proofs on the same hardware takes 40 seconds. Aggregating 1024 RISC0 proofs using the original method would therefore take around 400 seconds.

Integration into SNARKtor Protocol

We are excited to announce that Plonky2 Goldibear will be integrated into the implementation of the SNARKtor protocol. This integration will provide an additional boost in performance and enable even more efficient interactions with the RISC0 framework, enhancing the capabilities of our cryptographic solutions.

What's Next

We are currently working on the hardware acceleration of Plonky2 Goldibear, which will further enhance proof aggregation speed, making it even faster and more efficient.
In parallel, we are also working on the implementation of the Polygon Hermez zkEVM proof verifier, which will enable rapid aggregation of Polygon zkEVM rollup proofs, unlocking new possibilities for scalable and secure applications.

Conclusion

Plonky2 Goldibear and Risclonky2 represent a significant leap forward in proof generation, recursive proof aggregation, and cryptographic efficiency. With the ability to operate over both BabyBear and Goldilocks fields, and seamless integration with RISC0, we are now able to deliver faster proof generation, more efficient recursion, and high-performance aggregation at scale.

These developments will play a key role in advancing our cryptographic solutions and maintaining our competitive edge in the rapidly evolving field of zero-knowledge proof technologies.

Special thanks to our Head of Zero Knowledge Technologies, Alberto Garoffolo, and our Cryptographer, Daniele Di Tullio, for their invaluable contributions.

Note: The repositories for Plonky2 Goldibear and Risclonky2 are currently private, with plans for public release in the near future. For those interested in further details or potential collaboration opportunities, please contact email us to marketing@telosfoundation.io.

This announcement is part of our 'Revealing Telos' Next Growth Leap' campaign, where we'll share major upcoming updates. We're committed to keeping our community connected with everything we're building behind the scenes. Stay tuned for more alpha!

‍