Paper 2024/1873

$\mathsf{Cirrus}$: Performant and Accountable Distributed SNARK

Abstract

As Succinct Non-interactive Arguments of Knowledge (SNARKs) gain traction for large-scale applications, distributed proof generation is a promising technique to horizontally scale up the performance. In such protocols, the workload to generate SNARK proofs is distributed among a set of workers, potentially with the help of a coordinator. Desiderata include linear worker time (in the size of their sub-tasks), low coordination overhead, low communication complexity, and accountability (the coordinator can identify malicious workers). State-of-the-art schemes, however, do not achieve these properties. In this paper, we introduced $$, the first accountable distributed proof generation protocol with linear computation complexity for all parties. $$ is based on HyperPlonk (EUROCRYPT'23) and therefore supports a universal trusted setup. $$ is horizontally scalable: proving statements about a circuit of size $$ takes $$ time with $$ workers. The per-machine communication cost of $$ is low, which is only logarithmic in the size of each sub-circuit. $$ is also accountable, and the verification overhead of the coordinator is efficient. We further devised a load balancing technique to make the workload of the coordinator independent of the size of each sub-circuit. We implemented an end-to-end prototype of $$ and evaluated its performance on modestly powerful machines. Our results confirm the horizontal scalability of $$, and the proof generation time for circuits with $$ gates is roughly $$s using $$ $$-core machines. We also compared $$ with Hekaton (CCS'24), and $$ is faster when proving PLONK-friendly circuits such as Pedersen hash.