Keynote: SP1 Hypercube: Step into a Higher Dimension by Tamir Hemo, Succinct

Transcript

Okay, up next we've got Tamir Hemo, uh, head of engineering at Succinct. I believe I have the title correct. Um, speaking about SP1 Hyper Cube. Uh, name of the presentation is SP1 Hyper Cube, stepping into a higher dimension. Thanks. >> Thank you. Is it like this? All right. Hi everyone. Uh, my name is Tamir. I'm the head of cryptography at succinct and I'm going to tell you today a little bit about hyper cube and what makes me excited about it and in general it's succinct we've been running SP1 in production for almost two years maybe even more and we learned a lot from this and hyper cube is kind of like the crystallization of that uh of

these lessons so what is important about a zkVM there's actually three things equally important The first performance it has to be cheap it has to be fast and you know with it proofs we've achieved real time proving with 16 GPUs but also it has to be secure and I'm going to talk about that later and another thing I want to talk about is how rich the ZKVM is affects who can use it. So let's start with performance. That's what we gathered here for.

And this week we kind of published the benchmarks around being able to prove 99.7% of blocks uh with under 12 seconds with 16 GPUs and these kind of things are coming down all the time and there's like a lot of improvements in the pipeline. How did we do that? What was the main reason for performance? The main upgrade was our new proving system which is a multi-linear system and it was designed by it's kind of like proof system use case code design. We've optimized our performance by changing the algorithm to fit the problem.

We had a research paper on this the jagged PCS which is a polomial commitment scheme for a specific types of polomials or a group of polinomials that appears in a ZKVM execution. Now I'm not going to try to explain all of it but I want you to walk away with maybe this picture and I'm going to try to kind of explain this. So when you prove an execution of a ZKVM usually you have some sort of circuits or for some people some checks for different op codes. So let's say you have the add instruction that happened a bunch of times usually the biggest one exor load mo

each of them is encoded as a polomial that's basically true for any VM and the prover has to kind of group all these proofs of validity together somehow in the univariat land where each of them is kind of like a univariat polinomial of different size there's not really a way to patch them together actually geometrically this is actually a very accurate analogy If you kind of know the geometry, they're kind of like spheres, which is really hard to pack. A famous mathematical problem. And multilinear polinomials are kind of like rectangles or like multi-dimensional rectangles where even though you have to have the area be the same as the corresponding sphere, you

can play with the width and the height and pack things together really nicely. And that creates a really efficient proof system for the VM workload. Um, come talk to us about it if you're interested. Now, another lesson which is like a lot of people said, "Oh, wow. It's hard to sleep at night." We have, you know, billions of dollars secured by SP1. It really makes you think and it really makes you take this responsibility really seriously.

So for hyper cube we really wanted to have the best possible guarantees. The first thing is bits of security. Uh recently there's been a lot of noise about the conjectures and even in SP1 Turbo we kind of we used more queries than the conjectures allow kind of have some sort of like uh buffer but it was not provable. For hard cube, we realize the performance is good enough. We can go to provable security. So right now the real time per like the real-time proofs hyper cubes posting are 100 bits of provable security which really is getting rid of these uh proximity gap conjectures that are

really something I see as training wheels for hashbased VMs and Arancha is taking our training rules off. So uh I think is a good thing. And the other thing is the circuits themselves. And we did a lot to work with professionals and hire even hire our own ver uh formally ver formal verification person Devon. And really what we have is SP1 lean. The repo is open source. You can see all the proofs and the assumptions. And it's mathematical correctness proofs for the risk circuits. It's not the whole VM yet, but it's a really big part of the most risky logic and it's verified and

the things that excites me about it is that it's verified against the official risk 5 spec. So there is a source of proof which is like what risk 5 means and we prove our thing against that. And the second thing we did uh something that's more um immediate feedback is integrating with Pyus. And Picas is this uh system by Veradise that allows you to prove that your circuit is not under constraint. Um oh I should have said under constraint in this slide [laughter] but it's an automatic tool that you just plug in and it proved the terminism of all our risk 5 circuits and also a few pre-ompiles which is like much much

harder for the lean to do at this moment. So, we're going to keep working on this, but already I sleep a lot better. And the last thing that I wanted to discuss, which is not really discussed today yet, because we're really focused on L1 and realtime proving, but if we're going to have a VM and the Ethereum ecosystem is going to use it, all the L2s should use it too. And what do they need or what do other people need? I want to take as a case study arbitum and arbitum has we've been working with arbitum to zky they their stack and in arbitrum there's a specific feature that actually ethereum l1 is considering in

the long term which is native contracts arbitum stylus allow allows you to write a native contract in the client can execute it with native speeds so when we are coming to prove arbitum we want to preserve that cost model any stylist uh program has to be proven in the same cost as a native program. The problem is if you have a contract, it's not code you can trust. The code might have bugs. It might be malicious. We don't want a bad contract to to collapse the entire client. The solution, the VM has to be more [clears throat] complicated.

So SP1 Hyper Cube has the ability to execute untrusted code. What does that mean? It means enforcing memory privileges. If I have an executable portion of memory, I have to make sure nobody writes to it while I execute. There's memory isolation. If I allocate a piece of uh memory address space for this user program, I need to make sure that even if it um overflows or it has like some some seg fault, I need to have a handling for that in SP1.

And finally, it has to be sandboxed. So, write SP1 uh when you plug in pre-ompiles in ref, you get very like low-level control of circuits you can plug in. That's really unsafe for an untrusted contract to have. So, all the pre-ompiled calls, all the SP1 SIS calls are not able to be called from the stylus contract. They have to go to the client. Um, and that's basically um what we do for that. And that's mostly what I want to talk about. And you know, I'm really excited about Harvard Cube the soon going to be in production. And

um it was really fun working on this new proof system and I hope you will enjoy reading the code and yeah, thanks everyone for this event. [applause] >> All right. Thank you, Tamir. Uh, we've got one question here. Unless Oh, yeah. Basically, is hyper cube open source? If so, is the code repository available on GitHub or any public repository? >> Uh, yes. So, actually for proofs, the the version on e proofs is available in the same repo that we used in May. It's called hyper cube verifier if proofs demo or something like that. uh and very very soon our audits are like about to

end very soon and then we will release it on the main repo and in the network and yeah >> excellent uh how well will the WASM integration work with non-arbitum programs >> um well we haven't expos this is all uh work in progress and we haven't exposed the native thing yet although you could actually already do it um the nice thing about executing elves is that you don't really have to talk to us if you know what you're doing. Uh for example, the Aragon team building Silkworm, they have a C++ client and they managed to plug into SP1 without even talking to us. We were really like, "Oh, wow. You guys just did it." Like that was nice.

>> Yeah. They just showed up on Youth Bruce one day. >> Yeah. They just like, "Oh, we did it." >> All right. Thank you very much. >> Thank you.