ZK-gossip for lightning channel announcements

[halseth]

Thanks for the insights! (and for finding a bug )

@AdamISZ

Your gist has an 80 second prove time for the un-wrapped, correct? Does the wrapped version take more time, if so how much more?

Yes, that’s correct. On my laptop (M1 Max, 32GB) creating the STARK creates about 80 seconds. The wrapped (groth16) version is currently not possible to create on non-x86 hardware.

RISC0 provides a (trusted) proof server one can use. Using that server the fully wrapped proof is created in less than 30 seconds. I must assume that it is sporting som beefy GPUs, but it gives you an idea what is possible. I am aiming to rent som GPUs myself to see what proving times I can get to for the groth16 proof.

An interesting thing to note is that wrapping the proof (STARK->SNARK) reveals nothing about the private inputs, so one can imagine outsourcing the wrapping to a non-trusted server without giving up privacy.

@AdamISZ

Do we have a path to getting these numbers down, do you think?

I’m certain these numbers can be brought down quite a lot. As of now I have spent close to no time profiling the ZK application. RiscZero has an extensive guide on how one can do this: Guest Optimization Guide | RISC Zero Developer Docs

In addition there are alternative implementations of the zkVM that claims to have better performance, like SP1. It would be worthwhile spending some time comparing them.

@AdamISZ

“Concise” in the above para. : maybe 2-4kB is not concise! There is some analysis here. I always assumed that was fine, but for LN … perhaps it just isn’t (?), even if there are other advantages like < 100ms verification and 1-2 seconds for proof.

My hunch is that we need verification times to be at least sub-second on “normal” hardware, preferably sub-100ms. Proof times I am not too worried about, several minutes is not a problem since you are waiting several blocks anyway before announcing it. Proofs are gossiped around so they should not be too big (and maybe they have to be less than 65kB to fit the LN max message size?).