Ziren: General-Purpose zkVM & Proving Infrastructure
ZK
Joined June 2023
- Tweets3.9K
- Following585
- Followers42.4K
- Likes9.8K
ZKM retweeted
The Metis Hybrid Rollup is now running on devnet.
Having led the decentralized sequencer work at Metis, I’m glad to see DSeq adding post-quantum signatures while Ziren proves the chain.
The same sequencer upgrade is under way on @GOATNetwork.
Two elliptic curves stand between a Ziren proof and Ethereum. One carries memory from shard to shard inside the proof. The other wraps the finished proof so that Ethereum can check it cheaply.
Last month, both got public alternatives: a hash chain for the first, measured at 5.4% more proving time on one GPU and 17.6% on four, and an experimental Solidity verifier for the second, which checked a Ziren proof of an Ethereum mainnet block in a single transaction in a local test.
Neither is released yet. Here we set out what each curve does, what replacing it costs, and what we do not yet claim. 🧵
We took a proof Ziren produced on @eth_proofs for Ethereum block 26,240,087, re-shrunk it with the Keccak suite, and submitted it to the verifier on a local Ethereum node that enforces the 16,777,216-gas cap on a single transaction.
It verified in one transaction: 13,668,039 gas in total, of which 2,834,640 is the 182 KB proof packet's calldata. Deploying every verifier module costs 141.6 million gas, once. Tampered public values were rejected.
13.7 million gas is far more than a Groth16 check, so this suits a rollup that verifies on demand rather than one that verifies every batch. The verifier lives in github.com/ProjectZKM/OPSucc…, next to a proposed bridge design that can wait to finalize until a withdrawal needs it, so that one proof covers every batch since the last.
#568 is a draft. Its release gates include full proving on the current version, a review of its security parameters, and gas and deployment measurements under the transaction cap for every approved build.
1
5
1,089
None of this makes anything post-quantum secure today, and the paper says so: the security levels it computes are classical, and it claims post-quantum security for no configuration.
Fiat-Shamir proofs like Ziren's stay sound against quantum adversaries in the quantum random-oracle model, but with weaker concrete bounds: a quantum collision search on the 248-bit digest of the measured instantiation costs about 2^83 evaluations rather than 2^124.
A hash-based verifier also protects the proof check, not the keys around it. In the bridge design's own words, it "does not make blob KZG, signatures, consensus or governance post-quantum safe". @Ethereum's blob commitments and every account's ECDSA key move with Ethereum's own upgrades.
8
864
Ziren’s validity proofs are now running on Metis’s devnet, and they can be verified on the EVM two ways:
• Groth16 wrapper: about 233k gas, 260-byte proof
• Direct hash-based verifier: about 13.6M gas, 182 KB proof, in a single transaction and without an elliptic-curve wrapper
The work ahead on the proof side is bringing that second cost down, and replacing the elliptic curve still used for the memory check inside each proof.
→ zkm.io/blog/completing-the-h…
Security has led Ziren’s development because both GOAT’s BitVM3 bridge and Metis’s Hybrid Rollup will rely on its proofs.
With Ziren 2.0, the speed has caught up, with Ethereum mainnet blocks proved in 8.6 seconds on average.
And the post-quantum work carries to every system that uses Ziren’s proofs: its commitments are hash-based in 2.0, and the work to remove the last two elliptic curves is in progress.
→ github.com/ProjectZKM/Ziren
In 2023, ZKM was formed to build a zkVM that supports Cannon, the Golang MIPS VM behind @MetisL2’s fraud proofs.
Quantum safety has since become a requirement with published NIST end dates, and the Hybrid Rollup is being completed to meet it.
CEO @KevinLiu explains why now is the right time for it to happen:
→ x.com/kevinliu/status/211978…
ZKM retweeted
Metis announced the Hybrid Rollup in 2023, so why is it only happening now?
Two main reasons.
Metis runs its own version of the OP Stack, so proving it meant building a zkVM for the MIPS program Metis already uses for fraud proofs - not grabbing an off-the-shelf prover and rewriting Metis in another language. Ziren was the harder path for our developers, and making it production-grade - through external security reviews, and now fast enough to prove Ethereum blocks in real time - took time.
Also, while it was being built, post-quantum went from a background concern to having a concrete deadline. NIST retires today’s curves by 2035, so the Ziren proof path is being made hash-based from end to end - no wrapper, switched in module by module.
This has all taken time, energy, and resources. But the result will be a post-quantum secure hybrid rollup on Ethereum. Worth the work and the wait.
ZKM retweeted
Ziren is the backbone of the GOAT Network stack. Its speed and cost carry straight into the bridge that will move BTC between Bitcoin and GOAT, so a faster Ziren means cheaper, faster exits.
And the new core stays hash-based - the heaviest cryptography in the proof system is already quantum-resistant, while the remaining elliptic-curve pieces are replaced on the published post-quantum plan.
The full plan, with sources and measurements, is on Applied PQC - the open-source post-quantum research initiative our engineers run.
appliedpqc.io/blog-bitcoin-l…
Ziren 2.0 is what years of security and performance work add up to: the paper, the audits, the Lean proofs, real-time proving of Ethereum blocks.
The next major leap is our post-quantum work: removing the last elliptic curves from the path between a Ziren proof and the chains that check it.
That matters for everything Ziren proves - Bitcoin L2s today, Ethereum L2s next - starting with a major partner we’ve worked with since the beginning.
ZKM retweeted
Our team has taken the hard path on every decision for many years.
Build a zkVM from scratch on MIPS. A working decentralized sequencer set. A truly trust-minimized Bitcoin bridge. Post-quantum security in progress across the stack. And now real-time proving on Ethereum.
Ziren is already the heart of GOAT Network, and work is now underway to bring it to Metis.