measuring the cost of zk

[ed255]

To make a decision about #252 it would be useful to figure out:

• The formula of number of blinding gates based on the number of circuit gates

We could get it empirically with a test similar to

pod2/src/backends/plonky2/recursion/circuit.rs

Line 794 in 88a7598

fn test_measure_recursion() {

[ed255]

Results using the set of standard gates in #251 (which include the ExponentiationGate,
NNFMulSimple and ECAddHomog (the later two configured for the Schnorr signature with the Quintic extension of Goldilocks, including regular and recursive gates).

Verification of a standard config circuit with just Noop gates:

Verification of a standard config circuit with our set of standard gates:

Verification of a standard zk config circuit with our set of standard gates:

The degree_bits are after applying blinding

Blinding of a circuit:

Thresholds:

• 2^12.75 -> 2^14
• 2^14.5 -> 2^15
• 2^15.75 -> 2^16
• 2^16.75 -> 2^17

To be more specific, and printing the data calculated in https://github.com/0xPolygonZero/plonky2/blob/82791c4809d6275682c34b926390ecdbdc2a5297/plonky2/src/plonk/circuit_builder.rs#L922:

• If the final blinded+padded circuit is 2^14 rows, 8326 of them are blinding (that's 50%)
• ... is 2^15, 8998 of them are blinding (27%)
• ... is 2^16,10342 of them are blinding (16%)
• ... is 2^17 rows, 13030 of them are blinding (that's 10%)
• ... is 2^18 rows, 10846 of them are blinding (that's 4%)

Since we want to make proofs on a phone we want to be at 2^14 or 2^15. And it's very unfortunate that we'd have to wast 27-50% of the proving time to committing to blinders.