In sirius, we try to minimize the number of commitments. This is because the ecc scalar mul in verifier circuit is very costly. Thus, the commitment key size roughly equals the total number of rows times total number of columns times the bits of field.
When we fold large circuit, e.g. zkevm circuit. The key might be too large. Given the zkevm circuit data:
the row number is roughly 2^20; advice column number is 884 . number of fixed col+selectors is 250.
We commit fixed and advice columns separately. It means the key size is roughly 2^30*256/2^30=256GB.
To solve this issue, we need reduce the key size while increasing number of commitments. Thus the verifier circuit size will be increased. However, this is acceptable because the step circuit size is larger than ivc part.
For example, if we reduce the key size by 8, the ivc circuit part will increase at most 8 which is 2^17*8=2^20, the total number of rows is unchanged. Now, the key size in the worst case is 32GB.
In sirius, we try to minimize the number of commitments. This is because the ecc scalar mul in verifier circuit is very costly. Thus, the commitment key size roughly equals the total number of rows times total number of columns times the bits of field.
When we fold large circuit, e.g. zkevm circuit. The key might be too large. Given the zkevm circuit data:
the row number is roughly
2^20; advice column number is884. number of fixed col+selectors is250. We commit fixed and advice columns separately. It means the key size is roughly2^30*256/2^30=256GB.To solve this issue, we need reduce the key size while increasing number of commitments. Thus the verifier circuit size will be increased. However, this is acceptable because the step circuit size is larger than ivc part.
For example, if we reduce the key size by
8, the ivc circuit part will increase at most8which is2^17*8=2^20, the total number of rows is unchanged. Now, the key size in the worst case is32GB.