Author: a16z crypto

Translation: Shenchao TechFlow

Shenchao Guide: zkVM has been criticized for being "too slow and too large". This time, a16z replaced elliptic curves with lattice cryptography, directly speeding up proof by 3 times and compressing proof size to below 100KB. This is currently the only post-quantum scheme capable of beating traditional elliptic curve schemes in speed, directly affecting the cost of validation on chain and privacy applications.

Today, we officially launch Lattice Jolt, the latest version of our open-source zkVM (zero-knowledge virtual machine). Jolt is already the fastest and simplest zkVM, and its architecture remains unchanged. However, the underlying cryptography has been swapped out: replacing elliptic curves with lattice cryptography. This single change brings three major benefits:

• Jolt becomes post-quantum secure.
• The speed of the prover and verifier improves by 2-3 times.
• Lattice Jolt becomes the shortest proof among all post-quantum zkVMs: currently under 100 KB, with further compression possible. Since proofs need to be on-chain and transmitted across networks, smaller proofs lead to lower validation costs.

These features cover all use cases of zkVM. The same prover can handle billions of CPU cycles on a GPU, while still proving millions of cycles on a phone. In both cases, developers write standard programs, without needing to manually handle specialized knowledge required for circuits. This is why we say Jolt is the "universal SNARK".

But the bigger story is the significance of Lattice Jolt for SNARK design and adoption. Almost all commercial post-quantum SNARKs available today are hash-based. Lattice Jolt proves that lattice-based SNARKs can be faster and more compact. Digital signatures are undergoing the same transformation: hash schemes are the conservative choice, but lattice schemes are what the world is deploying on a large scale. We expect SNARKs to follow this path, which will be explained in the latter part of this blog post.

Replacing Elliptic Curves with Lattices

The previous polynomial commitment scheme used by Jolt was called Dory, the only component in the entire system relying on elliptic curve cryptography. Lattice Jolt replaces Dory with Akita, a brand new polynomial commitment scheme based on the Module-SIS hardness assumption. Lattice Jolt is based on this standardized, well-researched assumption that corresponds to full 128-bit security.

Module-SIS and its sibling Module-LWE belong to the same family of assumptions, to which the world's digital infrastructure is transitioning. These assumptions not only support the digital signature standard ML-DSA but also the key establishment standard ML-KEM, the latter of which is already the most widely deployed post-quantum primitive around the globe.

The development and implementation of Akita have been led by researchers and engineers from LayerZero, with contributions from researchers at Carnegie Mellon University, the University of Southern California, and our engineering and research team at a16z crypto.

Why Lattice Jolt is Faster

Lattice Jolt is not only post-quantum secure but also faster than the replaced elliptic curve version.

The acceleration mainly comes from a simple reason. Elliptic curves forced Jolt to operate in a 256-bit field, while lattice cryptography can achieve the same level of security in a 128-bit field. The main task of the Jolt prover is field element multiplication (essentially multiplying very large numbers), so reducing the size of numbers by half makes each multiplication several times faster.

The version of Jolt with Dory was already fast: our last performance update showed that Jolt could prove about 700,000 RISC-V (RV64IMAC) cycles per second on a laptop, and subsequent optimizations pushed the curve version of Jolt over one million cycles per second.

Lattice Jolt can prove more than two million cycles per second on the same machine.

For most of the past six months, we not only focused on developing Akita and integrating it into Jolt, but also completely rewrote the Jolt codebase. Jolt was already performing well on GPUs, but this rewrite has made the GPU implementation much easier to build and optimize.

The first result is the Apple Metal implementation, which brings significant acceleration to Apple hardware. (Metal is Apple’s framework for executing code on the built-in GPUs of devices like MacBooks and iPhones.)

• GPU-accelerated Lattice Jolt can prove over 10 million RV64IMAC cycles per second on a MacBook.
• Pure CPU Lattice Jolt can prove over two million cycles per second on the same machine.
• Even the curve version of Jolt can now run at about four million cycles per second on MacBooks with Metal.

That means, with this single release, Jolt on MacBooks has grown from about one million cycles per second (curve version, pure CPU) to over ten million cycles per second (lattice version, with Metal).

In a larger context: Four years ago, when we first estimated the cost of SNARK provers, proving a computation was millions of times more expensive than directly executing it. Lattice Jolt has reduced this cost to about ten thousand times cheaper. This is not the end; there is still optimization space in engineering and protocol layers.

The proof size and prover speed are equally important. At less than 100 KB, Lattice Jolt's proofs are already much smaller than other post-quantum zkVMs, which range from over 200 KB to about 600 KB or more.

After switching to lattices, Jolt's already excellent memory usage further improved: the prover's space usage dropped from around 300 bytes per cycle to 200 bytes. This means you can prove millions of RISC-V cycles on a phone.

A companion paper will be released soon, which will endow Lattice Jolt with zero-knowledge properties, a necessity for privacy applications.

Why Choose Lattices Instead of Hashes

For years, the SNARK community's focus (and essentially all production deployments) has been on hash-based SNARKs, treating them as the path to post-quantum security.

However, there has always been a continuous line of research on lattice SNARKs and lattice commitments, covering LaBRADOR, Greyhound, LatticeFold, SuperNeo, and the direct predecessor of Akita, Hachi. Lattice Jolt builds on this research, bringing the lattice commitment layer into high-performance zkVM architecture while proving that lattice-based SNARKs are unmatched in speed and compactness.

This should not be surprising. As mentioned, a similar pattern has already occurred with digital signatures.

Cryptographers have constructed signatures based on many assumptions. Hash signatures are often viewed as the most conservative choice: their security assumptions are simple and old. But the world is primarily moving towards lattice signatures because they are shorter and faster:

• ML-DSA signatures are about a few KB.
• NIST standardized hash alternatives SLH-DSA are several times larger.
• For encryption and key exchange, the situation is clearer: there are no hash schemes available (there are proofs that this is impossible), and post-quantum deployments overwhelmingly rely on lattices. ML-KEM (the primary key establishment standard established by NIST in 2024) has already been deployed by mainstream browsers and communication applications by default, used in a vast number of TLS connections online.

The analogy between SNARKs and signatures is not superficial. Digital signatures are essentially a proof of knowledge of a private key for an authorized message. SNARKs extend this paradigm from a narrow statement to arbitrary computations. So it would be odd if the long-term cryptographic landscape for SNARKs were markedly different from that of signatures and encryption.

There is also a misconception worth clarifying: hash SNARKs are often characterized as conservative post-quantum choices because "they only rely on hash functions." This is only true when the underlying hash function is non-algebraic.

Today, most hash-based SNARK deployments rely on SNARK-friendly algebraic hash constructions (like Poseidon) for low-cost proof that the hash is correctly evaluated. This is especially important for recursion (where recursion refers to proving that you hold a valid SNARK proof). These constructions have more structure than standard hash functions, and their cryptanalysis is still immature.

In short, we lack confidence in the security of algebraic hash functions. Despite this, they are still widely used in production-grade SNARK systems. (However, there has been a signal of progress: the Ethereum Foundation recently announced it would discontinue their use.)

Algebraic hashes are not the only hidden assumptions in deployed hash-based SNARKs: many systems historically would use speculative proximity-gap bounds to set specific security levels rather than using rigorously proven bounds. Some of the strongest bounds have later been proven to be incorrect.

Even avoiding the speculative hash-based SNARKs mentioned above, their security targets are often below 128 bits, as full 128-bit security comes with significant performance overhead. Why? Hash-based SNARKs cannot achieve 128-bit security in a 128-bit field because their reliability error scales with n/|F|, where n is roughly the size of the statement being proven and |F| is the field size. Thus, proving a statement of one billion steps in a 128-bit field will lose about 30 bits of security, bringing it below 100 bits. In contrast, Lattice Jolt’s reliability error scales with log(n)/|F|, almost preserving full 128-bit security in the same field (the small log(n) loss can be recovered with standard techniques).

Ironically, some systems marketed as "conservative" post-quantum choices actually rely simultaneously on algebraic hash functions, speculative proximity-gap bounds, and target security levels below 128 bits. Thus, while hash-based SNARKs are an important direction, they do not automatically become the low-risk options many think they are.

One Jolt, Three Foundations: Curves, Lattices, and Hashes

We have always believed that Jolt should not be tied to a single cryptographic foundation. We should have mature and high-performance SNARKs based on curves, hashes, and lattices. Different assumptions and performance characteristics will apply to different scenarios.

However, if we take digital signatures as a reference, lattice-based SNARKs will become the most widely deployed post-quantum choice.

Jolt is in an unusual position of advantage in this transition. The original Jolt design took advantage of the properties of elliptic curves that are particularly useful for commitments, including fast commitments to sparse vectors. Lattice commitments have the same property: when most entries of a vector are zero or small, the cost of committing to the vector is very low, and Jolt mostly commits to such vectors. This property allowed us to replace Dory with Akita while keeping the rest of Jolt unchanged.

We will build a hash-based version of Jolt. However, compared to the curve-based and lattice-based Jolt versions, the hash-based version is less space efficient, the proofs are larger, and various complexities arise. This is because the most promising hash-based SNARKs operate in binary fields. This numeral system facilitates the proof of hash evaluations but does not align with the arithmetic methods of the CPU. This mismatch makes proving normal CPU multiplication expensive. Nonetheless, the ecosystem should have zkVMs under each major assumption family, just like in the field of digital signatures.

Universal SNARK

Lattice Jolt simultaneously meets all the needs of builders for zkVM: post-quantum, transparent, fast, compact, and space-efficient. It brings the lattice SNARK research path from LaBRADOR to Hachi into production-grade zkVM, without sacrificing any of the original advantages that made Jolt fast.

Our goal is not only to open-source the most powerful zkVM for anyone to use but also to significantly eliminate the need for manual tuning of SNARKs for specific applications. This does not require Jolt to be as fast as manually tuned provers. That is an impossible goal, akin to demanding CPUs to match dedicated ASICs in every task. It only requires Jolt to be fast enough to provide an acceptable user experience.

For "small" statements related to client proofs (where manually optimized circuits currently dominate these scenarios), the key benchmark is generating a proof on a phone in about a second or less. Jolt is already close to achieving this, and many acceleration schemes are underway.

The era of lattice SNARKs has arrived.

This content is for reference only and should not be relied upon as legal, business, investment, or tax advice. For such matters, you should consult your own advisors. Any mention of securities or digital assets is for illustrative purposes only and does not constitute investment advice or an offer to provide investment advisory services. Furthermore, this content is not directed at any investors or potential investors and should not, under any circumstances, serve as a basis for making investment decisions related to any fund managed by a16z. (Offers to invest in a16z funds are made only through the fund's private placement memorandum, subscription agreements, and other related documents, and those documents should be read in their entirety.) Any mentioned, cited, or described investment or portfolio company does not represent all investments in a16z managed tools, and there is no guarantee that these investments will be profitable or that any future investments will have similar characteristics or results. A list of investments made by funds managed by Andreessen Horowitz (excluding investments that issuers do not permit a16z to publicly disclose, as well as undisclosed public digital asset investments) is available at https://a16z.com/investments/.

Charts provided in the text are for reference only and should not be used as a basis for any investment decisions. Past performance does not indicate future results. This content only represents the situation as of the date stated. Any forecasts, estimates, forward-looking statements, targets, prospects, and/or opinions expressed in these materials are subject to change at any time without prior notice and may differ or conflict with the views expressed by others. For more important information, please refer to https://a16z.com/disclosures.