feat: ultra keccak honk verifier

[alexghr]

Enable the new Keccak Ultra Honk flavor for the BlockRootRollup circuit, deploy a Solidity verifier for it and tell the rollup to use it

[spalladino]

Let's have someone from crypto team check that it's ok to change these names. cc @ludamad ?

[ludamad]

Looks okay to me

[alexghr]

I changed the names to be consistent and so that I could do prove_${flavor} in typescript where flavor="ultra_honk" | "ultra_keccak_honk"

[spalladino]

Seems like we could drop pks altogether, right?

[alexghr]

We don't generate the proving keys ahead of time so I just removed the code, yep.

[lucasxia01]

why did we even need this functionality before?

[alexghr]

@lucasxia01 I think it was leftover from the time we were integrating recursive proofs into the orchestrator :)

[spalladino]

Do we know if this needs to include the RootRollup artifact as well?

[alexghr]

This set should contain the artifacts with proofs verified on chain. I think this should contian the "root rollup" that will aggregate the proof of an epoch.

[spalladino]

Why is App outside the check? If it's because App is not a ProtocolArtifact, then let's change the signature of getUltraHonkFlavorForCircuit to accept a ProtocolArtifact | 'App'.

[spalladino]

THANK YOU

[alexghr]

Just pointing this change out! Without it the proofs generated by prove_ultra_keccak_honk_output_all couldn't be verified.

[AztecBot]

Benchmark results

Metrics with a significant change:

• protocol_circuit_simulation_time_in_ms (private-kernel-tail-to-public): 1,386 (+105%)
• avm_simulation_time_ms (Token:transfer_public): 27.7 (+33%)

Detailed results

All benchmarks are run on txs on the Benchmarking contract on the repository. Each tx consists of a batch call to create_note and increment_balance, which guarantees that each tx has a private call, a nested private call, a public call, and a nested public call, as well as an emitted private note, an unencrypted log, and public storage read and write.

This benchmark source data is available in JSON format on S3 here.

Proof generation

Each column represents the number of threads used in proof generation.

Metric	1 threads	4 threads	16 threads	32 threads	64 threads
proof_construction_time_sha256_ms	5,755	1,561	711	759	776
proof_construction_time_sha256_30_ms	11,447	3,086	1,384	1,433	1,469 (+1%)
proof_construction_time_sha256_100_ms	44,149	11,874	5,459	6,084 (+9%)	5,372 (-5%)
proof_construction_time_poseidon_hash_ms	78.0	34.0	34.0	59.0 (+4%)	89.0 (+3%)
proof_construction_time_poseidon_hash_30_ms	1,530	423	204 (+1%)	226	268 (+1%)
proof_construction_time_poseidon_hash_100_ms	5,646	1,515	678 (+1%)	720 (-1%)	746

L2 block published to L1

Each column represents the number of txs on an L2 block published to L1.

Metric	4 txs	8 txs	16 txs
l1_rollup_calldata_size_in_bytes	4,356	7,876	14,884
l1_rollup_calldata_gas	50,136	93,028	177,964
l1_rollup_execution_gas	842,955	1,576,743	3,361,735
l2_block_processing_time_in_ms	259 (+2%)	451 (+3%)	818 (+1%)
l2_block_building_time_in_ms	11,197 (-1%)	22,177	43,444 (-1%)
l2_block_rollup_simulation_time_in_ms	11,197 (-1%)	22,176	43,444 (-1%)
l2_block_public_tx_process_time_in_ms	9,567 (-1%)	20,493	41,733 (-1%)

L2 chain processing

Each column represents the number of blocks on the L2 chain where each block has 8 txs.

Metric	3 blocks	5 blocks
node_history_sync_time_in_ms	2,995 (+3%)	3,900 (+4%)
node_database_size_in_bytes	12,611,664	16,707,664
pxe_database_size_in_bytes	16,254	26,813

Circuits stats

Stats on running time and I/O sizes collected for every kernel circuit run across all benchmarks.

Circuit	simulation_time_in_ms	witness_generation_time_in_ms	input_size_in_bytes	output_size_in_bytes	proving_time_in_ms
private-kernel-init	78.7 (-5%)	382 (-3%)	21,395	44,898	N/A
private-kernel-inner	156 (-1%)	683 (-2%)	72,380	45,020	N/A
private-kernel-reset-tiny	294 (-1%)	702 (-2%)	65,101	44,886	N/A
private-kernel-tail	159	131 (-4%)	50,612	52,921	N/A
base-parity	5.57 (-1%)	N/A	160	96.0	N/A
root-parity	35.8	N/A	73,964	96.0	N/A
base-rollup	2,971 (-5%)	N/A	189,199	664	N/A
block-root-rollup	41.2 (-1%)	N/A	58,217	2,448	N/A
public-kernel-setup	80.9	N/A	105,089	71,222	N/A
public-kernel-app-logic	93.9	N/A	104,902	71,222	N/A
public-kernel-tail	841	N/A	390,586	16,414	N/A
private-kernel-reset-small	294	N/A	66,345	45,629	N/A
private-kernel-tail-to-public	⚠️ 1,386 (+105%)	608	453,751	1,825	N/A
public-kernel-teardown	80.4	N/A	105,353	71,222	N/A
merge-rollup	20.0 (+1%)	N/A	38,182	664	N/A
undefined	N/A	N/A	N/A	N/A	82,039 (+5%)

Stats on running time collected for app circuits

Function	input_size_in_bytes	output_size_in_bytes	witness_generation_time_in_ms
ContractClassRegisterer:register	1,344	11,731	341
ContractInstanceDeployer:deploy	1,408	11,731	18.3 (-1%)
MultiCallEntrypoint:entrypoint	1,920	11,731	402 (-1%)
FeeJuice:deploy	1,376	11,731	388
SchnorrAccount:constructor	1,312	11,731	72.8 (-1%)
SchnorrAccount:entrypoint	2,336	11,731	386 (+1%)
FeeJuice:claim	1,344	11,731	36.5 (+4%)
Token:privately_mint_private_note	1,280	11,731	100 (-3%)
FPC:fee_entrypoint_public	1,344	11,731	24.2 (-1%)
Token:transfer	1,312	11,731	216 (-3%)
Benchmarking:create_note	1,344	11,731	86.2 (+1%)
SchnorrAccount:verify_private_authwit	1,280	11,731	26.5 (+1%)
Token:unshield	1,376	11,731	525 (+2%)
FPC:fee_entrypoint_private	1,376	11,731	758 (+10%)

AVM Simulation

Time to simulate various public functions in the AVM.

Function	time_ms	bytecode_size_in_bytes
FeeJuice:_increase_public_balance	45.2	2,431
FeeJuice:set_portal	14.5 (+10%)	2,930
Token:constructor	78.7 (+3%)	15,813
FPC:constructor	49.5	9,720
FeeJuice:check_balance	36.5 (-3%)	2,357
Token:mint_public	47.5 (-3%)	5,011
Token:assert_minter_and_mint	468 (-1%)	3,155
AuthRegistry:set_authorized	45.8 (-2%)	924
FPC:prepare_fee	203 (-7%)	4,245
Token:transfer_public	⚠️ 27.7 (+33%)	21,586
FPC:pay_refund	45.4 (+2%)	5,303
Benchmarking:increment_balance	1,200	3,496
Token:_increase_public_balance	40.2 (+5%)	2,408
FPC:pay_refund_with_shielded_rebate	52.8 (-1%)	5,303

Public DB Access

Time to access various public DBs.

Function	time_ms
get-nullifier-index	0.153 (+3%)

Tree insertion stats

The duration to insert a fixed batch of leaves into each tree type.

Metric	1 leaves	16 leaves	64 leaves	128 leaves	256 leaves	512 leaves	1024 leaves
batch_insert_into_append_only_tree_16_depth_ms	2.16 (+1%)	4.01 (+1%)	N/A	N/A	N/A	N/A	N/A
batch_insert_into_append_only_tree_16_depth_hash_count	16.8	31.7	N/A	N/A	N/A	N/A	N/A
batch_insert_into_append_only_tree_16_depth_hash_ms	0.112	0.113 (+1%)	N/A	N/A	N/A	N/A	N/A
batch_insert_into_append_only_tree_32_depth_ms	N/A	N/A	11.2	17.6 (+1%)	31.0 (+1%)	59.4 (+3%)	112
batch_insert_into_append_only_tree_32_depth_hash_count	N/A	N/A	95.9	159	287	543	1,055
batch_insert_into_append_only_tree_32_depth_hash_ms	N/A	N/A	0.107	0.102 (+2%)	0.101 (+1%)	0.102 (+3%)	0.101
batch_insert_into_indexed_tree_20_depth_ms	N/A	N/A	14.3	25.6 (+1%)	43.9 (+2%)	82.5 (+2%)	160 (-1%)
batch_insert_into_indexed_tree_20_depth_hash_count	N/A	N/A	108	207	355	691	1,363
batch_insert_into_indexed_tree_20_depth_hash_ms	N/A	N/A	0.109	0.102	0.106 (+2%)	0.102 (+2%)	0.100 (-3%)
batch_insert_into_indexed_tree_40_depth_ms	N/A	N/A	16.6 (+1%)	N/A	N/A	N/A	N/A
batch_insert_into_indexed_tree_40_depth_hash_count	N/A	N/A	132	N/A	N/A	N/A	N/A
batch_insert_into_indexed_tree_40_depth_hash_ms	N/A	N/A	0.107 (+1%)	N/A	N/A	N/A	N/A

Miscellaneous

Transaction sizes based on how many contract classes are registered in the tx.

Metric	0 registered classes	1 registered classes
tx_size_in_bytes	64,838	668,997

Transaction size based on fee payment method

| Metric | |
| - | |