SP1Succinct

Description

SP1 is a RISC-V zkVM using the Plonky3 stack. The zkVM execution is proven recursively and is wrapped into a SNARK for final verification. It provides tools to generate onchain Groth16 or Plonk verifiers. SP1 targets 100 bits of security.

Proof system

SP1 proves execution of a RISC-V VM using several ZK circuits connected by lookup arguments, as implemented in Plonky3. VM execution trace is split into several chunks that could be proven in parallel with a STARK proving system. The parallelized proofs are recursively checked by the next layer of STARK circuits. The correctness of the final STARK proof is verified with the final wrap SNARK program, the wrap SNARK proof is verified onchain.

zkVM component

Verifies execution of a RISC-V program in a zkVM. Uses Plonky3 STARK toolkit with AIR arithmetization and FRI-based polynomial commitment scheme within the BabyBear field.

Recursion circuits

SP1 provides tools for recursive proof generation by verifying proofs in a zkVM. This uses the same toolkit as top-level proof system, but proves the correct verification of all proofs generated on the previous step.

Final wrap

SP1 supports Plonk (with KZG polynomial commitments) or Groth16 final SNARK wrap of the STARK proof for performant onchain proof verification (link). The gnark implementation of these proof systems over BN254 curve is used. For Plonk, Aztec Ignition trusted setup ceremony is used, for Groth16 Succinct run internal circuit-dependent phase 2 trusted setup, see below for more details.