Best possible prover config for mobile devices and ability to cache constraint system solver results

[Scratch-net]

I have a circuit which is built using gnark and gadgets(thanks for them!) and which is around 152k constraints for 640 bytes of proved data and 75k constraints for 64 bytes of data.

The circuit processes data (bytes) in 64 byte blocks, kind of block cipher. So the more times I'll be able to call "Prove()" the more data blocks I can process, simple as that.

I need to do proofs on mobile devices, so they must be as fast and as efficient as possible.
Right now I managed to build a shared library for Android using CGO and build a simple app that uses it. Everything works, but I wonder if I can do better in terms of speed.
Circuit is built using Groth16 and BN254.

So, each time I call Prove() it happens in two stages:

Constraint system solver
Prover
On my android phone circuit which processes 64 bytes takes ~900ms to prove and the one that proofs 640 bytes takes a bit more than 2 secs.
I'd use the one with 640 bytes but on lower end devices it runs out of memory

Is is possible to cache solver results or they are purely witness dependent? Is it possible to squeeze any more performance out of the proving process?

We used BN128 with SnarkJS before but it was still 5-10 times slower on mobile devices then Gnark. With Gnark bn128 is out of the question, it's insecure anyway.

[gbotrel]

Hey --
One thing you could try first is ensure that you are running true 64bit binary; couple of years back, what we ended up doing for gnark-crypto only,instead of building a shared library with CGO, compile a binary directly with Go and call that on the Android side. See for example this ZPrize submission https://github.com/gbotrel/zprize-mobile-harness/blob/main/Makefile .

(side note that alt-bn128 and bn254 often refer to the same curve; it is not deemed insecure).

[Scratch-net]

I tried both standalone go app without cgo and shared library using ARM64 ndk toolchain, they both gave similar results