Adds SPARK

[batmendbar]

SPARK

Reference for this implementation

• SPARK: https://eprint.iacr.org/2019/550
• Stronger security analysis of SPARK: https://people.cs.georgetown.edu/jthaler/Lasso-paper.pdf

Proposed protototype workflow

1. Serve step

   • One time
     • Starts the server
     • Compiles the circuit
     • Calculates the SPARK matrix data and commits to them
   • Ongoing
     • Listens to SPARK query requests and produces SPARK proofs using the pre-calculated commitments

2. Provekit prove step

   • Runs provekit prover and obtains a deferred evaluation
   • Sends a deferred evaluation request to the server

3. Provekit and SPARK verify step

   • Verifies Provekit and SPARK proofs

Design decisions

Pack $A$, $B$, $C$ into one block matrix Z:

This is a result from Marcin (https://gist.github.com/kustosz/14b62de666f721ab855536e575891bd1)

The trick:

$$Z = \begin{bmatrix} A & B \ 0 & C \end{bmatrix}$$

Same total non-zeros, double the dimensions. Then for any $\beta$, $p$, and $q$:

$$A(p,q) + \beta B(p,q) + \beta^2 C(p,q) = (1+\beta)^2 \cdot Z!\left(\tfrac{\beta}{1+\beta}, p,\ \tfrac{\beta}{1+\beta}, q\right)$$

One matrix, one commitment, one opening.

Batching GPA and WHIR proofs

• Combining GPA

  • Products of hashes corresponding to read sets and write sets of row-wise and column-wise memory check are combined into one GPA
  • Products of hashes corresponding to init and final vectors are combined into one GPA (separate for row-wise and col-wise memory). Possible optimization - if number of rows and columns for the matrix are ensured to be equal, we can combine them into one GPA.

• WHIR Batching
  | num_terms_2batched e-values are committed and opened together. Opened once in sumcheck and once in rs_ws GPA
  | num_terms_4batched | Address/timestamp values for row-wise and col-wise memory checks are committed and opened together

Temporary Sumcheck for split witness

The current ZK WHIR doesn't support batching which would enable easier handling of split witness commitment. The repo currently uses an additional sumcheck proposed by Marcin until batch ZK commitment is supported https://gist.github.com/kustosz/c7c3f756aaae77f37e035c30c4961ea3.

The trick:

Collapsing two claims into one: With claims on $A(r,0,q_1)$ and $A(r,1,q_2)$. Draw random $\beta$ and note their RLC is just another sum over $A(r,\cdot)$, so run a Sumcheck #2 to reduce to a single claim $A(r, \gamma)$.

Full workflow for a Noir passport circuit:

# 1. Start the server (compiles circuits and pre-commits)
provekit-cli serve \
  --socket /tmp/spark.sock \
  --output-dir ./benchmark-inputs \
  --circuit t_attest:./target/t_attest.json &

# 2. Wait for server readiness
while [ ! -S /tmp/spark.sock ]; do sleep 1; done

# 3. Prove (generates Noir proof + SPARK proof)
provekit-cli prove \
  ./benchmark-inputs/t_attest.pkp \
  ./benchmark-inputs/tbs_720/t_attest.toml \
  -o ./benchmark-inputs/t_attest-proof.np \
  --socket /tmp/spark.sock \
  --circuit t_attest \
  --spark-out ./benchmark-inputs/t_attest-spark-proof.sp

# 4. Verify Noir + SPARK proof
provekit-cli verify \
  ./benchmark-inputs/t_attest.pkv \
  ./benchmark-inputs/t_attest-proof.np \
  --spark-proof ./benchmark-inputs/t_attest-spark-proof.sp

What is not included

• Recursive SPARK

Benchmark

[TODO: Update with new benchmark]

[github-actions]

CSP benchmarks

Metric	Value
Workflow status	[PASS] success
Commit	b1599452ece3
Run	#25153709596
Circuits benchmarked	21
Iterations averaged per circuit	3

Prover time, peak RSS, peak heap, and verifier time are arithmetic means across the iterations. Peak heap comes from the largest peak memory entry in provekit-cli prove's tracing output; peak RSS is reported by /usr/bin/time -v (max-resident-set-size).

Each metric cell shows the current value followed by the percentage delta against the latest successful main run #25049705974. (new) marks circuits absent from the baseline.

Results

Circuit	Constraints	Witnesses	Prover time	Peak RSS	Peak heap	Verifier time	Proof size	PKP size
ecdsa_p256	143,282 (±0.0%)	258,158 (±0.0%)	2.99 s (+0.9%)	306 MB (+18.7%)	284 MB (+26.1%)	340 ms (-1.9%)	2.80 MB (+0.7%)	810 KB (±0.0%)
keccak_1024	822,870 (±0.0%)	1,543,366 (±0.0%)	6.65 s (+4.2%)	1.30 GB (+35.7%)	1.29 GB (+39.1%)	840 ms (-1.2%)	3.13 MB (-0.1%)	6.07 MB (±0.0%)
keccak_128	163,058 (±0.0%)	313,707 (±0.0%)	2.14 s (+1.1%)	347 MB (+27.1%)	322 MB (+33.4%)	367 ms (±0.0%)	2.79 MB (-0.6%)	1.22 MB (±0.0%)
keccak_2048	1,575,606 (±0.0%)	2,945,822 (±0.0%)	12.33 s (+4.3%)	2.45 GB (+35.2%)	2.49 GB (+38.3%)	1.43 s (-0.7%)	3.27 MB (-0.1%)	12.36 MB (±0.0%)
keccak_256	256,206 (±0.0%)	487,012 (±0.0%)	2.35 s (+1.7%)	424 MB (+29.6%)	401 MB (+38.2%)	407 ms (-0.8%)	2.86 MB (+0.8%)	1.97 MB (±0.0%)
keccak_512	445,094 (±0.0%)	839,130 (±0.0%)	3.70 s (+1.7%)	760 MB (+27.0%)	707 MB (+38.9%)	553 ms (-1.2%)	3.00 MB (-0.4%)	3.40 MB (±0.0%)
poseidon2_12	479 (±0.0%)	563 (±0.0%)	350 ms (±0.0%)	24.44 MB (+3.5%)	14.78 MB (+0.6%)	100 ms (±0.0%)	1.04 MB (-0.4%)	436 KB (±0.0%)
poseidon2_16	556 (±0.0%)	719 (±0.0%)	350 ms (-2.8%)	24.81 MB (+4.1%)	14.97 MB (+0.6%)	100 ms (±0.0%)	1.05 MB (±0.0%)	530 KB (±0.0%)
poseidon2_2	231 (±0.0%)	278 (±0.0%)	340 ms (-1.9%)	23.07 MB (+1.5%)	14.11 MB (±0.0%)	100 ms (±0.0%)	1.02 MB (-2.1%)	108 KB (±0.0%)
poseidon2_4	529 (±0.0%)	535 (±0.0%)	340 ms (±0.0%)	23.58 MB (+2.8%)	14.40 MB (+0.7%)	100 ms (±0.0%)	1.03 MB (+0.3%)	31.67 KB (±0.0%)
poseidon2_8	363 (±0.0%)	423 (±0.0%)	350 ms (±0.0%)	24.14 MB (+1.8%)	14.59 MB (+0.7%)	100 ms (±0.0%)	1.04 MB (-0.3%)	365 KB (±0.0%)
poseidon_12	504 (±0.0%)	524 (±0.0%)	350 ms (-0.9%)	23.79 MB (-0.1%)	14.78 MB (+0.6%)	100 ms (±0.0%)	1.04 MB (+0.3%)	410 KB (±0.0%)
poseidon_16	609 (±0.0%)	633 (±0.0%)	350 ms (±0.0%)	24.14 MB (+1.8%)	15.07 MB (+0.6%)	100 ms (±0.0%)	1.02 MB (-3.2%)	536 KB (±0.0%)
poseidon_2	240 (±0.0%)	249 (±0.0%)	343 ms (+1.0%)	23.00 MB (+2.2%)	14.02 MB (±0.0%)	100 ms (±0.0%)	1.03 MB (+2.0%)	53.79 KB (±0.0%)
poseidon_4	297 (±0.0%)	309 (±0.0%)	340 ms (±0.0%)	23.44 MB (+2.0%)	14.40 MB (+0.7%)	100 ms (±0.0%)	1.03 MB (-0.7%)	210 KB (±0.0%)
poseidon_8	402 (±0.0%)	418 (±0.0%)	347 ms (-0.9%)	23.77 MB (+3.0%)	14.59 MB (+0.7%)	100 ms (±0.0%)	1.05 MB (+3.8%)	305 KB (±0.0%)
sha256_1024	196,940 (±0.0%)	339,764 (±0.0%)	2.23 s (+1.1%)	388 MB (+26.0%)	356 MB (+30.1%)	413 ms (-1.6%)	2.80 MB (+0.3%)	1.89 MB (+1.7%)
sha256_128	46,398 (±0.0%)	80,974 (±0.0%)	1.10 s (+1.5%)	118 MB (+17.2%)	104 MB (+24.3%)	260 ms (±0.0%)	2.51 MB (+0.1%)	506 KB (+0.2%)
sha256_2048	345,399 (±0.0%)	612,724 (±0.0%)	3.62 s (+1.2%)	677 MB (+23.0%)	638 MB (+32.0%)	590 ms (-2.2%)	2.96 MB (-0.5%)	3.11 MB (+2.9%)
sha256_256	67,904 (±0.0%)	117,944 (±0.0%)	1.38 s (±0.0%)	172 MB (+14.5%)	156 MB (+20.3%)	290 ms (-1.1%)	2.63 MB (-0.6%)	713 KB (-2.9%)
sha256_512	110,916 (±0.0%)	191,884 (±0.0%)	1.52 s (+0.2%)	226 MB (+25.1%)	203 MB (+28.3%)	320 ms (±0.0%)	2.69 MB (+1.2%)	1.09 MB (-4.7%)