[FEATURE]: Optimize the size of R1CSShape of PublicParams

[flyq]

I tried to put Nexus-zkvm’s verifier on the ICP chain, but failed because it was impossible to get SeqPP by deserialization on the chain. So I traced the internal structure of SeqPP

After decompressing and deserializing SeqPP (load_pp) in here, I got the following results:

ro_config size: 7128
shape size: 457055984
shape_secondary size: 10881160
pp size: 16288968
pp_secondary size: 96776
digest size: 32
shape: R1CSShape { num_constraints: 509030, num_vars: 490374, num_io: 2, A: [_, 3841133], B: [_, 6804135], C: [_, 475710] }
shape SparseMatrix A size
data: 3841133, indices: 3841133, indptr: 509031, cols: 490376
shape SparseMatrix B
data: 6804135, indices: 6804135, indptr: 509031, cols: 490376
shape SparseMatrix C
data: 475710, indices: 475710, indptr: 509031, cols: 490376

What is the problem?

The size of R1CSShape is large, the Matrix size about 490 k * 1 m, and the total size of R1CSShape is 457 MB,

What do you want to happen?

make the R1CSShape size under 50 MB

Additional notes

Because my proven program is simple, a fibnaccia program with 707 RISC-V instructions, if I do arithmetic on this program, the R1CSShape I get will be much smaller. But now when in the VM, the R1CSShape is very large. I'm not sure if there is a way to reduce the R1CSShape, for example, I only need to pay the R1CSShape corresponding to my program? Currently, PublicParams is generated before the prove. Is this large R1CSShape the arithmetic representation of the RISC-V VM(program)?

[sjudson]

@flyq thanks for the request! Proof compression for efficient on-chain verification is something we're currently developing, as sketched out in our whitepaper.

[taint160596]

Same problem

[danielmarinq]

@flyq and @taint160596 yup the R1CSShape encodes (multiple cycles of) the RISC-V machine.

Due to folding, the proofs are large, and the public parameters are too.

We're working on the "Proof Compression" mechanism, which will make it such that the proofs are very small (just 3 group elements), and the public parameter overheads disappear.