Introducing SP1: A performant, 100% open-source, contributor-friendly zkVM.
We’re excited to announce Succinct Processor 1 (SP1): our first-generation zero-knowledge virtual machine (zkVM) that verifies the execution of arbitrary Rust (or any LLVM-compiled language) programs. SP1 targets an order of magnitude performance improvement vs. existing zkVMs—its alpha release is already up to 28x faster for certain programs and competitive with circuit-based approaches.
SP1 is a 100% open-source, contributor-friendly public good that takes a collaborative approach towards building the best zkVM for rollups, coprocessors, and other ZKP applications. SP1 is continuously evolving—disrupting the status quo of black-box zkVMs that are hard to customize and keep up to date with the latest proof system advances. Start building with SP1 and contributing today.
The future of truth is programmable
Zero-knowledge proofs (ZKPs) are a powerful primitive that will enable a new generation of more secure, scalable and innovative blockchain architectures that rely on truth not trust. But ZKP adoption has been held back because it is “moon math”, requiring specialized knowledge in obscure ZKP frameworks and hard to maintain one-off deployments. Performant, general-purpose zkVMs, like SP1, will obsolete the current paradigm of specialized teams hand rolling their own custom ZK stack and create a future where all blockchain infrastructure, including rollups, bridges, coprocessors, and more, utilize ZKPs via maintainable software written in Rust (or other LLVM-compiled languages).
State-of-the-art performance
SP1 achieves state-of-the-art performance on several real-world workloads inspired by common blockchain use-cases like bridging and verifying Merkle proofs. Our performance is a result of multiple design choices that utilize the latest proof system advances, including a cross-table lookup architecture, a customizable “precompile” system that can accelerate almost any performance bottleneck without much additional recursion overhead, and more.
For the first time, SP1 shows that a general-purpose zkVM can have performance competitive with circuit-based approaches, while accelerating developer productivity by orders of magnitude.
SP1 outperforms existing zkVMs by up to 28x on real world workloads
We benchmark SP1 on a variety of programs, showing between 4-28x improvements on performance on three realistic workloads. Our benchmarks measure end-to-end proving time on a single machine with 64 ARM-based CPUs, and 512GB of RAM. In production, latency can be significantly decreased with parallelized proving across a cluster for both approaches.
SP1’s blazing fast speed is a game-changer for real-world applications like a ZK Tendermint light client, reducing proving time from 2.2 hours to 4.6 minutes. Read more about our methodology in the appendix.
SP1 is competitive with circuit-based approaches while improving developer productivity by over 100x
Perhaps more interesting than SP1’s state of the art performance against existing zkVMs, is that its precompile-centric architecture allows for performance competitive with (and sometimes exceeding) that of custom hand-rolled circuits. In the cases below, we benchmark programs proven with SP1 vs. SOTA custom circuits the Succinct team has previously written for a variety of important use-cases in production. In the case of the SSZ Merkle proof verification program, the VM is actually faster than the circuit as the flexibility of the VM allows for conditional computation that a circuit does not allow for.
Development time with SP1 is >100x faster and more maintainable than with custom circuits, while proof generation speed/cost remains competitive.
Built from day one to be customizable and maintained by a diverse ecosystem of contributors
Today, zkVMs are built monolithically by isolated companies, making them difficult to customize and keep updated with the latest advances. We challenge this approach. SP1 is 100% open-source (MIT/Apache 2.0) with no code obfuscation and built to be contributor friendly, with all development done in the open. Unlike existing zkVMs whose constraint logic is closed-source and impossible to modify, SP1 is modularly architected and designed to be customizable from day one. This customizability (unique to SP1) allows for users to add “precompiles” to the core zkVM logic that yield substantial performance gains, making SP1’s performance not only state of the art vs. existing zkVMs, but also competitive with circuits in a variety of use-cases.
Embracing the Open Source Bazaar
SP1 makes use of high-quality, production-grade open-source dependencies like Plonky3 where possible, to compound with the exponential progress of ZK innovation and build a zkVM that is future proof. We believe that the terminal zkVM is similar to the Linux project: free, open-source software that is permissively licensed and maintained by an active community of contributors from a diverse set of companies and geographies. Already, multiple teams and individuals have merged PRs to SP1, including Succinct Labs, Sina (CEO, Witness), Aayush (ZK email), Preston (CTO, Sovereign Labs) and more.
SP1 is still a work-in-progress and there is much more left to build. We are open-sourcing today in the spirit of transparency and inviting the community to build the best zkVM together with us.
Build with SP1
The code for SP1 can be found at this repository: https://github.com/succinctlabs/sp1. Note that SP1 is in alpha and not yet intended for production use.
Today, developers can write programs (including complex, large programs like a Tendermint light client) in Rust (with std support), generate proofs and verify them. SP1 already supports proving of programs of arbitrary length by sharding a long computation into smaller shards, and then generating a global proof of all shards. Start building with SP1 today: https://succinctlabs.github.io/sp1/.
Check out some of the exciting use cases that can be built on top of SP1:
Contribute to SP1: If you’re interested in contributing to SP1 itself, check out the list of open issues in the Github repository.
Roadmap: In the coming months, we plan on getting audits of the core VM constraints and logic, optimizing SP1’s performance and also adding support for recursive onchain verification which will allow for converting SP1’s STARK proofs to groth16, for cheap onchain usage in Ethereum smart contracts.
Acknowledgements
SP1 is built on the shoulders of giants in this space. We would like to thank StarkWare, for being the original pioneers of STARKs and zkVMs, the Polygon Zero Labs team for creating Plonky2 and Plonky3, foundational open-source dependencies upon which SP1 is built, Risc0 for the vision of a RISC-V zkVM, Daniel Lubarov and Max Gillet for work on Valida that pioneered the cross-table lookup architecture, Ulrich Habock for Logup, and countless other individuals in the ZK space that have inspired our work.
Appendix
Performance comparison with other zkVMs:
Performance comparison with circuits:
Benchmarking Methodology
The benchmarking programs can be found in the SP1 examples directory (Fibonacci, SSZ Merkle Proofs, Tendermint ZK Light Client). For each program, we generated a proof for both zkVMs, and patched all relevant crates (including the sha2, crypto-bigint and curve25519-dalek crates). The “# of Cycles'” column is the number of RISC-V instructions executed by the program. The proof generation time is in seconds and verification time is in milliseconds. Note that the cycle count for the Tendermint program is provided as 2 numbers because it is significantly smaller in the SP1 zkVM because of SP1's first-class support for precompiles, which are difficult to add in Risc0 because constraint logic is closed-source. SP1’s architecture allows for precompiles to be added without substantially impacting recursion overhead, significantly decreasing the cycle count of complex programs and thus improving proof generation performance. For all other programs, the cycle count is relatively similar between the two zkVMs.
We chose to use the poseidon hash function for both SP1 and the Risc0 zkVM as poseidon is a standard, recursion-friendly hash used by many teams. All other settings were the default Risc0 prover settings in their repository. The benchmark was run on a AWS Linux ARM CPU machine (r6a.16xlarge) 64 vCPUs and 512GB of RAM, with a reserved pricing of $1.64 per hour.
NB: Note that due to the very complex, multi-dimensional nature of zkVM performance (including factors like hardware, single-node vs. multi-node performance, memory usage, recursion cost, hash function selection) these benchmarks only present a simplified view of performance. We tried our best to provide as fair of a comparison as possible, although it is difficult for a single benchmark to capture all nuances. Also because SP1 is still a work in progress, the performance numbers are not final and are expected to improve over time.