Goodbye to elliptic curves, the new generation of post-quantum zero-knowledge proof engines is here.

Written by: Markos Georghiades, Justin Thaler, Andrew Tretyakov, Michael Zhu, a16z crypto

Compiled by: Chopper, Foresight News

Today we officially release Lattice Jolt, the new version of the open-source zkVM project Jolt. The original design of Jolt's SNARK (Succinct Non-Interactive Argument of Knowledge) has already made it the fastest and simplest zero-knowledge virtual machine available today. The core change in this new version is the switch of the underlying cryptography from elliptic curves to lattice-based cryptography (Note: Lattice cryptography is a type of cryptographic system based on lattice mathematical problems, and is currently one of the mainstream post-quantum cryptography schemes selected by the US National Institute of Standards and Technology (NIST) to resist quantum computer attacks). This change achieves three enhancements:

• Enables Jolt to possess post-quantum security;
• Improves the speed of the prover and verifier by 2–3 times;
• Among all post-quantum zkVMs, Jolt has the shortest proofs: currently less than 100KB, with further compression space available. Smaller proof sizes mean lower verification costs across the network as proof data needs to be uploaded on-chain and transmitted.

These features are applicable to various application scenarios of zkVMs. This prover can handle billions of CPU calculations on GPUs or complete millions of calculations on mobile phones. In both scenarios, developers only need to write regular programs without the need to manually build highly specialized circuits. This is also why we refer to Jolt as the "Universal SNARK".

However, more notably is the significance of Lattice Jolt for the implementation and popularization of zero-knowledge proof technology. Nearly all currently operational post-quantum SNARKs are based on hash schemes. Lattice Jolt demonstrates that lattice-based SNARKs can achieve both faster speeds and more compact proofs simultaneously. The digital signature field is undergoing the same transformation: hash-based schemes are viewed as conservative choices, while lattice-based schemes represent the mainstream for global large-scale deployment, with shorter signatures and faster verification.

Replacing elliptic curves with lattice cryptography

The old version of Jolt used the Dory polynomial commitment scheme, which was the only component of the entire system dependent on elliptic curve cryptography. Lattice Jolt replaces Dory with Akita, a new polynomial commitment scheme based on the lattice assumption Module-SIS. Lattice Jolt relies on this thoroughly researched standard assumption to achieve a complete 128-bit security level.

Module-SIS and its sibling Module-LWE are the assumptions being adopted for global digital infrastructure migration. This assumption not only supports the NIST digital signature standard (FIPS 204) but also supports the key agreement standard FIPS 203, the latter being the most widely used post-quantum cryptographic primitive globally.

Akita has been developed under the leadership of researchers and engineers from LayerZero, with collaborative input from research engineering teams from Carnegie Mellon University, the University of Southern California, and a16z crypto.

The principles behind Lattice Jolt's performance improvements

Lattice Jolt not only achieves post-quantum security but also outperforms the old elliptic curve version.

The speed enhancement primarily comes from a simple reason. Elliptic curves require Jolt to operate within a 256-bit finite field; lattice-based cryptography can achieve equivalent security strength within a 128-bit finite field. The majority of the prover's overhead comes from the multiplication of field elements (very large numbers). Halving the length of field numbers results in a speed increase of several times for each multiplication operation.

The old version of Jolt, equipped with Dory, was already quite fast: prior tests showed that it could accomplish approximately 700,000 RISC-V (RV64IMAC) operations per second on a laptop; after subsequent optimization, the elliptic curve version of Jolt surpassed 1,000,000 operations per second. In comparison, Lattice Jolt can achieve over 2,000,000 operations per second on the same device.

In the past six months, the team not only developed Akita and integrated it into Jolt but also completely rewrote the Jolt codebase. The performance of the old version was already good, but the rewritten code significantly reduced the difficulty of GPU implementation and optimization.

The first implemented achievement is the Apple Metal implementation, greatly enhancing the computational speed on Apple devices (Metal is the development framework Apple provides for GPUs in devices like MacBooks and iPhones).

The GPU-accelerated version of Lattice Jolt can achieve extremely high RV64IMAC throughput on MacBooks; the CPU-only version of Lattice Jolt can perform over 2,000,000 operations per second on identical laptops. After Metal optimization, the elliptic curve version of Jolt reaches about 4,000,000 operations per second on MacBooks.

In other words, with one version update, Jolt's performance on Macs was improved from (elliptic curve + pure CPU) at approximately 1,000,000 operations per second to (lattice cryptography + Metal) exceeding 10,000,000 operations per second.

To understand these numbers intuitively: Four years ago, when we calculated the cost of SNARK proofs, the cost of completing a single proof was millions of times that of executing the calculation directly. Lattice Jolt has compressed this factor to about 10,000 times. The optimization does not end here; there is still significant room for improvement at both the protocol and engineering levels.

The size of the proof is as important as the speed of the prover. Lattice Jolt's proof size is less than 100KB, far smaller than other post-quantum zkVMs (most such schemes have proof sizes over 200KB, and can be as large as 600KB or more).

Switching to lattice cryptography further optimizes Jolt's already leading memory usage: the prover's memory overhead has dropped from about 300 bytes per cycle to 200 bytes. This means that proofs of millions of RISC-V operations can also be performed on mobile devices.

A supplementary paper will be released shortly, which will add zero-knowledge features to Lattice Jolt, necessary for privacy applications.

The underlying logic of lattice cryptography being superior to hash schemes

For many years, the research focus in the SNARK field, as well as nearly all deployed post-quantum SNARKs, has chosen a hash-based route to address the quantum computing threat.

Meanwhile, academia continues to research lattice-based SNARKs and commitment schemes, with numerous relevant papers published; Akita's predecessor schemes are among them. Lattice Jolt builds on this research, integrating lattice-based commitment layers into a high-performance zkVM architecture while demonstrating that lattice-based SNARKs offer incomparable speed and compact proof size.

This trend is not surprising. As mentioned earlier, the digital signature field has undergone a completely identical transformation. Cryptographers have designed multiple signature schemes. Hash-based signatures are often seen as the most conservative choice, with simple security assumptions and a long research history. However, the global industry is turning to lattice-based signatures on a large scale, because they are shorter and verify faster:

• NIST’s standard lattice-based signature FIPS 204 has a signature size of only a few KB;
• NIST's hash-based alternative standard FIPS 205 has a size several times that of the former.

The conclusions in the fields of encryption and key exchange are even clearer: there are no hash-based key exchange schemes, and nearly all post-quantum deployments adopt lattice-based solutions. The core key exchange standard FIPS 203, finalized by NIST, is already enabled by default in mainstream browsers, communication software, and the vast majority of web TLS connections.

The analogy between SNARKs and signatures is not superficial. Digital signatures essentially act as proof of knowledge of a private key, bound to a specified message; SNARK extends this paradigm from a single statement to any computation. Therefore, the longstanding cryptographic patterns of SNARKs are unlikely to deviate entirely from those of signatures and encryption systems.

A common misconception needs clarification: hash-based SNARKs are often described as conservative post-quantum schemes, on the grounds of "merely being based on hash functions." However, this is only valid when the underlying hash function is a non-algebraic function.

Today, the vast majority of deployed hash SNARKs utilize algebraic hash constructions like Poseidon tailored for SNARKs, reducing the cost of proving hash correctness. Recursive proving scenarios particularly rely on this design (recursive proving refers to proving that a SNARK proof itself is valid). These constructions are far more complex than standard hash structures and have lower maturity in cryptanalysis.

In short, we are not fully confident in the security boundaries of algebraic hashes, even though they are widely applied in production SNARK systems. A notable development is that the Ethereum Foundation recently stated that it will gradually abandon Poseidon in its post-quantum roadmap.

Algebraic hashes are not the only hidden assumptions of deployed hash SNARKs; many schemes employ conjectural specific security boundaries instead of rigorously proven security conclusions, with many once-considered secure schemes gradually encountering cryptanalysis attacks.

Even avoiding the conjectural flaws of hash-based SNARKs often results in a failure to meet the 128-bit security level, and achieving complete 128-bit security comes with significant performance trade-offs. Why? Both types of SNARKs are vulnerable to low probabilities of proof forgery. The forgery risk of hash SNARKs rises proportionally with the computational load, and security levels drop significantly when proving large tasks; the forgery risk of lattice-based SNARKs increases only slowly with the computational load, essentially maintaining the 128-bit security strength even when handling large-scale computations, with minor losses manageable through conventional techniques.

Ironically, some systems marketed as "conservative post-quantum choices" actually rely on both algebraic hashes and unproven gap conjectures, and their security levels are below 128 bits. Therefore, although hash SNARKs are an important research direction, they are not as low-risk as many perceive.

A single Jolt, three underlying cryptographies: elliptic curves, lattice cryptography, hash

Our position has always been that zkVM should not be tied to a single cryptographic foundation. We need mature, high-performance SNARKs based on elliptic curves, hashes, and lattice cryptography, as different security assumptions and performance characteristics fit different scenarios.

However, drawing from the experience of the digital signature industry, lattice-based SNARKs will become the most widely deployed post-quantum scheme.

The architecture of Jolt is just right for this transition. The original design of Jolt leveraged the advantages of elliptic curves in commitments, such as quick commitments of sparse vectors. Lattice cryptography also possesses this characteristic: when most elements of the vector are 0 or small values, the commitment cost is extremely low, and Jolt almost exclusively commits to such vectors. This is what enabled us to replace Dory directly with Akita without any changes to the rest of the Jolt architecture.

We will also develop a hash version of Jolt in the future. However, compared to the elliptic curve and lattice versions, the hash version has lower space efficiency and larger proof sizes, along with various complex issues. The reason is that the most promising hash SNARK operates on special numerical systems that suit proof of hash operations but do not match native arithmetic on CPUs, leading to exorbitant proof costs for ordinary CPU multiplication. Even so, the ecosystem should have zkVMs based on all mainstream cryptographic assumption systems, just like in the digital signature field.

Universal SNARK

Lattice Jolt brings together all the core demands of developers for zkVM: post-quantum security, transparency, high speed, concise proofs, and high memory efficiency. It integrates the research results of lattice-based SNARKs from LaBRADOR to Hachi into a production-grade zkVM, while fully retaining the high-performance advantages of the original Jolt.

Our goal is not just to open-source this top-performing zkVM, but also to significantly eliminate the need for custom-tailored SNARKs for specific applications. This does not mean that Jolt's performance will match that of specialized provers designed for specific scenarios — this is unrealistic, much like expecting a CPU to match the performance of dedicated ASICs across all tasks. What is needed is for Jolt to be fast enough to provide a good user experience.

For mobile lightweight zero-knowledge proof scenarios, the core threshold is to keep proof generation on mobile devices around 1 second. Jolt is already very close to this goal, with significant room for further acceleration.

The era of lattice-based SNARKs has arrived.