Infrastructure

The incorporation of the new Brakedown encoding in Plonky3 has dramatically increased proving speeds, enabling the encoding of witness data at approximately 1.2 GB/s. Initial estimates suggest a proving rate of around 4 MHz using a single CPU-only machine, making this solution notably faster than current alternatives—nearly three orders of magnitude.

While we have made substantial progress, our team continues to refine and optimize our implementations. In particular, we see significant potential for augmenting the speed of Brakedown. Given its memory-bound nature, we anticipate that utilizing block matrix multiplication could provide significant performance enhancements.

The Mersenne prime offers notable performance advantages in arithmetic hashes, such as Rescue, due to the remarkably efficient field arithmetic—for instance, an M1 chip can execute more than three field multiplications per cycle.

The Tip5 hash function is not necessarily crucial to our recursion strategy—it was primarily used as an illustrative example. We are considering Poseidon2 among other recent schemes as potential alternatives.

We typically utilize degree 3 constraints in most Algebraic Intermediate Representations (AIRs). Many logical constructs naturally map to degree 3 constraints, although occasionally, we add intermediate columns manually to reduce the degree of specific relations.

Our multiset equality arguments could substantially benefit from higher degree constraints. Elevating the degree would allow us to batch more terms into a singular cumulative sum.

While a 64-bit ISA could be beneficial for applications performing large number calculations with ‘u64’s, we initially chose to concentrate on the 32-bit variant for simplicity's sake.

We refrained from employing Miden's Merkle Abstract Syntax Trees (MAST) approach due to the complexities it introduces in supporting LLVM with arbitrary jumps. Treating the program as trusted has proven beneficial, eliminating the need to validate faults.

One can conceptualize coprocessors as separate STARKs, which employ either FRI or another Polynomial Commitment Scheme (PCS), and can be interconnected using multiset equality arguments.