LayerZero researchers and engineers, collaborating with teams at Carnegie Mellon University and the University of Southern California, have released LatticeJolt, a new version of their open-source zkVM that shifts its cryptographic foundation from elliptic curves to lattices. This change delivers a faster, post-quantum system while maintaining the architecture that previously made Jolt the simplest and fastest zkVM available.
“Lattice Jolt shows that lattice-based SNARKs can be both faster and more compact,” the team reports, positioning it as a potential alternative to currently dominant hash-based post-quantum SNARKs; LatticeJolt targets 128 bits of security based on the Module-SIS standard, the same assumption underlying the most widely deployed post-quantum key-establishment primitive, ML-KEM.
LatticeJolt Achieves Faster Post-Quantum Proofs with Akita
Akita, a new polynomial commitment scheme using the Module-SIS lattice assumption, now underpins LatticeJolt, marking a deliberate departure from elliptic-curve cryptography for this specific component of the zero-knowledge virtual machine. This shift isn’t merely about future-proofing; it directly addresses computational efficiency by enabling operations on 128-bit fields, a significant reduction from the 256-bit fields required by elliptic curves. The resulting decrease in field element size substantially accelerates the multiplication-heavy process of proving computations within the zkVM.
Performance benchmarks demonstrate the impact of this change, with LatticeJolt achieving over 2 million RISC-V (RV64IMAC) cycles per second on the same machine, building upon previous optimizations that already yielded about 1 million cycles per second with the earlier, curve-based version of Jolt. (Metal is Apple’s framework for running code on the GPUs built into its devices, including MacBooks and iPhones.) In other words, in a single release, Jolt on a MacBook has gone from about 1 million cycles per second (curve-based, CPU-only) to over 10 million (lattice-based, with Metal).
This improvement brings the overhead of proving a computation down to roughly 10,000 times slower than simply running it, a dramatic reduction from the millions-fold difference observed four years ago. The team anticipates further gains through continued engineering and protocol refinements, suggesting that these performance figures are not static.
Proof size also benefits from the transition to lattice cryptography, with LatticeJolt generating proofs under 100 KB in size, a considerable advantage over other post-quantum zkVMs that typically produce proofs ranging from 200 KB to 600 KB or larger. The switch to lattices also improves Jolt’s memory usage, dropping the prover’s space usage from about 300 bytes per cycle to 200. For smaller statements commonly used in client-side proving, the target is proof generation in under one second. A companion paper, coming shortly, adds zero knowledge to Lattice Jolt.
Module-SIS and Module-LWE Underpin LatticeJolt’s 128-Bit Security
This move positions LatticeJolt as a potentially faster and more compact alternative to currently deployed hash-based post-quantum SNARKs, a shift mirroring the broader trend seen in digital signatures. While hash-based schemes have been considered the most conservative approach, lattice-based signatures, and now, potentially SNARKs, are gaining traction due to their improved speed and size. The underlying assumptions powering LatticeJolt, Module-SIS and Module-LWE, are not theoretical constructs; they already underpin ML-KEM, the most widely deployed post-quantum primitive globally.
This parallel suggests a potential pathway for wider adoption of lattice-based cryptography within the SNARK ecosystem, extending beyond key exchange to encompass zero-knowledge proofs. The development and implementation of Akita were also supported by engineering and research teams at a16z crypto.
Jolt’s Rewrite and Apple Metal Integration Boost Prover Speed to 10 Million Cycles
Lattice Jolt now achieves over 10 million RISC-V cycles per second on a MacBook, a substantial increase from the approximately 1 million cycles per second attained with the previous curve-based implementation and CPU-only processing. This leap in performance stems from a fundamental shift in cryptographic foundations; the system has moved from 256-bit fields required by elliptic curves to 128-bit fields inherent in lattice cryptography, significantly accelerating field element multiplication, the dominant operation in the proving process, Apple says.
The team’s recent work focused not only on integrating the new Akita polynomial commitment scheme but also on a complete rewrite of the Jolt codebase to facilitate easier GPU optimization. The new Apple Metal implementation is the first tangible result of this rewrite, unlocking substantial speed gains on Apple’s silicon.
Metal serves as Apple’s framework for utilizing the power of GPUs integrated into devices like MacBooks and iPhones, and its integration with Jolt has proven highly effective. This combination delivers a prover capable of handling billions of CPU cycles on GPUs and, millions on mobile phones, a scale previously unattainable. Beyond speed and memory efficiency, Lattice Jolt also offers a significant reduction in proof size.
This compactness is not merely a technical detail; smaller proofs translate directly to lower bandwidth requirements and faster verification times, critical for applications like decentralized finance and verifiable computation. The shift to lattices also builds on a sustained history of research in the area. Prior work including LaBRADOR, Greyhound, LatticeFold, SuperNeo, and Hachi paved the way for Akita and, ultimately, Lattice Jolt.
The team’s accomplishment lies in successfully integrating a lattice commitment layer into a high-performance zkVM architecture, demonstrating the viability of lattice-based SNARKs for practical applications, according to Apple. This mirrors a similar progression observed in digital signatures, where lattice-based approaches have gained prominence alongside more traditional methods. The team emphasizes that achieving acceptable user experience is paramount, the company says.
For client-side proving, where hand-optimized circuits are currently dominant, the goal is to generate proofs on a phone in under a second. The era of lattice SNARKs, they believe, has arrived, offering a compelling alternative to hash-based systems that have dominated the field for years.
Compact Proof Sizes and Memory Usage Enable Mobile Proving with LatticeJolt
Lattice Jolt now requires 200 bytes of prover space per cycle, a reduction from the previous 300 bytes, enabling proof generation on resource-constrained devices like mobile phones. This improvement extends the capabilities of the Jolt zkVM beyond GPU-powered servers, opening possibilities for on-device privacy and scalability. The ability to prove millions of RISC-V cycles on a phone represents a shift in where zero-knowledge proofs can be generated and utilized.
Proof size also underwent substantial reduction; Lattice Jolt generates proofs under 100 KB, markedly smaller than the 200-600 KB range typical of other post-quantum zkVMs. This compactness directly addresses bandwidth limitations, important for mobile applications and decentralized networks where data transmission costs are significant. The transition to lattices, specifically the Module-SIS assumption, isn’t merely about size and speed; it also mirrors a broader trend in cryptography.
Lattice-based signatures are increasingly favored over hash-based approaches due to their superior performance characteristics, and the team draws a parallel between these developments. The team clarifies a common misconception surrounding hash-based SNARKs, noting that their security relies on the properties of the underlying hash function. “Hash-based SNARKs are often described as the conservative post-quantum choice because they are ‘just based on hashes’,” they state. “That is true only if the underlying hash function is non-algebraic.” Most current deployments utilize SNARK-friendly algebraic hashes like Poseidon to facilitate efficient proof of hash evaluation, particularly for recursion.
Achieving 128 bits of security with hash-based SNARKs over a 128-bit field presents challenges, with soundness errors scaling unfavorably with statement size. The team points out that even hash-based SNARKs targeting fewer than 128 bits of security often operate over binary fields, which, while convenient for hash evaluations, create inefficiencies when proving CPU arithmetic.
This mismatch adds computational overhead to operations like CPU multiplications. Despite these challenges, the researchers envision a future with zkVMs built on diverse cryptographic assumptions, mirroring the variety seen in digital signatures. “The ecosystem should have zkVMs under every major assumption family, just as it has for digital signatures,” they suggest. Lattice Jolt, they claim, delivers everything builders need from a zkVM at once.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
