Showing that a sealed record rests on a withdrawn premise without revealing which one: cost of a zkVM prototype
On an Apple M4, one run per configuration: proof generation 31.88 to 32.82 s, receipts 225,384 to 227,432 bytes, verification 9.54 to 9.85 ms, nearly unchanged between 2^10 and 2^20 log entries within one segment.
MeasurementWhere does it stop?Re-checked
- Designed for
- To measure whether a holder can show that a sealed record has a premise listed in a withdrawal log without revealing which premise, its id or its log position, and at what proof time, receipt size and verification time.
What was tested
We built a Rust prototype on the RISC Zero 3.0.6 zkVM that makes a succinct STARK receipt for “a hidden premise of this sealed record is in this withdrawal log”. The host checks that the guest rejects false variants and that no hidden value appears in clear text. Three configurations ran once each on an Apple M4.
What we observed
On the Evidence Grade v3 core leaf with a 2^20-entry log: 217,439 cycles in one 2^18 segment, 31.88 s to generate, 227,432 bytes, 9.54 ms to verify. The first prototype leaf took 32.74 s at 2^20 entries and 32.82 s at 2^10. The guest refused 5 of 5 false variants.
What this means for Heimdall
At this scale, a proof that a premise was withdrawn, built to hide which one, takes about 32 seconds to make and about 10 milliseconds to check. The prototype is not wired to the layer.
Limits
One run per configuration, one machine. Zero-knowledge is the zkVM’s design target, not a property we tested. The Groth16 wrap could not run on Apple Silicon. Log entries are not bound to an issuer.
What remains open
Bind the proof to the issuer’s withdrawal entry in the built log.