h

The world is rightly focused on the cost and time of proof generation -- and for good reason. I've been thinking about this from multiple angles, and ahead of a tweet series I'll be posting this week, here's a prelude. What impacts proving time and cost? At a high level, three key factors play a role: 1.  Hardware – The machines running the proofs. 2.  Prover algorithm – The core logic dictating proof generation efficiency. 3.  Orchestration & pricing – How proving tasks are managed and allocated. Now, let's zoom in on the prover algorithm. One crucial factor that affects the complexity of proof generation is the number of rounds between the prover and verifier in the interactive PIOP (Polynomial Interactive Oracle Proofs). This isn't just relevant when applying the Fiat-Shamir transformation -- it also matters when considering modifications to it. Research has shown that Fiat-Shamir can be insecure in certain contexts, leading to the need for alternative transformations. Whichever the transformation is, the more rounds in the protocol, the more complexity is introduced by these transformations. More than a decade ago, I debunked a claim published in a top-tier conference that was indirectly tied to round complexity in zero-knowledge proof protocols (it was called "Revisiting Lower and Upper Bounds for Selective Decommitments"). The related-work deep-dive led me to learn about some of the most impactful results in this area -- many of which remain relevant today. This week, I'll be writing a series of threads exploring these insights, breaking down how round complexity shapes the landscape of proof systems. Stay tuned!

The age of the software engineer is over

Crypto needs to make a hard pivot from Telegram to Signal