What if I do not need the "zero-knowledge" property?

[wangtsiao]

What if I do not need the "zero-knowledge" property?

Will it make the proving more efficient, if it does, then how much of a performance boost can it bring?

[brianretford]

It's a good question and one we've been thinking about recently. @jbruestle would have to answer to provide a notion of perf improvement, but it's likely to be substantial.

[wangtsiao]

The current version of risc0 is too slow to apply in the real world.

Would you provide a version or a branch of risc0 which removes the zero-knowledge property? Then it plays a role as a verifiable computation framework and will get a performance improvement.

If you would not plan to work on it, please give me some information or materials on how to implement it. I want to give it a try. Very appreciate.

[pdg744]

As far as I can tell, unless the trace length is very close to one of the performance cliffs, removing the zero-knowledge property wouldn't provide any performance gain at all.

In particular, the only thing that's necessary to make the STARK into a ZK-STARK is to add a row for each FRI query. With current settings, that's 50 extra rows. Since we're padding the trace length to the nearest power of 2 anyway, there's really no cost to making the proof ZK.

EDIT: Oh, I forgot that there's also this "shift" of the execution trace to a coset to avoid queries revealing data from the original trace... I guess that actually is a non-trivial amount of work that we could omit in a non-zk version... Doesn't seem likely that there's a whole lot to gain here but maybe I'm wrong.

[pdg744]

For what it's worth, the performance has come a long way since February and we still have lots of room for further improvement. We have some numbers at https://risczero.com/datasheet.pdf, although these are already out of date, too...