A16z Crypto has introduced a new version of its Jolt cryptographic proof system that uses lattice mathematics to protect against potential quantum-computing attacks while cutting the time needed to confirm software calculations.
The open-source system, known as Lattice Jolt, can generate proofs at more than twice the rate of its predecessor when tested on the same laptop, according to a post from a16z Crypto. It also reduces proof sizes and memory demands, potentially making the technology more practical for blockchains and consumer devices.
Jolt is a zero-knowledge virtual machine, or zkVM. It lets a computer provide cryptographic evidence that a program produced the correct result. A second computer can then check the evidence without rerunning the entire program.
Such proofs can reduce the amount of work performed directly on a blockchain. They can also support applications in which users need to confirm a calculation without disclosing all the information involved.
The current Lattice Jolt release proves that a program ran correctly, but it does not yet conceal private information. A16z Crypto said a planned companion paper will add the zero-knowledge capability needed for privacy applications.
A New Cryptographic Foundation
The earlier Jolt system relied partly on elliptic-curve cryptography, a widely used method that could eventually be defeated by a sufficiently powerful quantum computer.
A16z Crypto removed that dependency by replacing Jolt’s Dory commitment scheme with a lattice-based system called Akita. A commitment scheme allows a prover to lock in mathematical information and later demonstrate facts about it without presenting the full dataset.
Akita relies on Module-SIS, a mathematical problem associated with multidimensional arrangements of points called lattices. Researchers generally believe that solving these problems would remain difficult even for quantum computers.
Researchers and engineers at LayerZero led Akita’s development and implementation, working with researchers at Carnegie Mellon University, the University of Southern California and a16z Crypto.
The underlying approach is related to the lattice mathematics used in federal post-quantum standards. These include ML-DSA for digital signatures and ML-KEM for establishing secure encryption keys.
A16z Crypto said its system is designed to provide 128 bits of security, a commonly targeted level intended to place direct attacks beyond practical reach.
Jolt Performance Improves
Moving to lattices allowed Jolt to use 128-bit mathematical fields instead of the 256-bit fields required by its elliptic-curve design. Smaller values reduce the cost of the repeated multiplications involved in creating a proof.
The lattice version processed more than 2 million RISC-V cycles a second using a laptop’s central processor, compared with more than 1 million for the previous system, according to the post. RISC-V is an open set of processor instructions that Jolt uses to represent ordinary software operations.
Performance exceeded 10 million cycles a second on a MacBook when the system used Apple’s Metal framework to place part of the work on the computer’s graphics processor. The developers also rewrote Jolt’s software to make GPU-based implementations easier to build and improve.
That means the reported gain does not come entirely from the change in cryptography. It also reflects changes to the code and the use of different computing hardware.
Lattice Jolt generates proofs smaller than 100 kilobytes. A16z Crypto said competing post-quantum zkVM proofs range from more than 200 kilobytes to roughly 600 kilobytes or higher.
Proof size affects the cost of sending and recording the results. That is especially important on blockchains, where storing data can carry substantial fees.
The new system also lowered memory use from about 300 bytes to 200 bytes for each processor cycle being proved. A16z Crypto said the reduction allows mobile phones to handle programs involving millions of cycles.
The performance claims have not been independently confirmed, and results can vary with the hardware, workload and security assumptions used in testing.
Lattices Challenge Hash-Based Designs
Most post-quantum SNARKs now in use depend on hash functions. SNARKs are short cryptographic proofs that can be checked with much less work than the underlying calculation requires.
Hash-based designs are often presented as a cautious choice because standard hash functions have a long history of analysis. A16z Crypto argues that many proof systems instead use specialized algebraic hashes whose security has received less study.
The organization expects lattice-based proof systems to gain adoption because they can offer greater speed and smaller outputs. It pointed to post-quantum digital signatures, where lattice methods are generally more compact than hash-based alternatives.
A16z Crypto still plans to build a hash-based form of Jolt. Its stated aim is to support three separate foundations — lattices, hashes and elliptic curves — so developers can choose among different security and performance trade-offs.
For applications running on consumer devices, the developers are working toward generating a proof on a phone in about one second. A16z Crypto said Jolt is close to that threshold, with additional software and protocol improvements planned.
