Update: We are currently rerunning our benchmarks on consumer grade hardware (Intel i7-12700F, 32GB of RAM). The results are 4x better than the benchmarks reported here, which were run on a AWS machine with a slow CPU. See here for initial results.

Context

Notation

• $|z|$: CCS whole witness length
• $|\text{x}|$: public instance length (set to 1 in this case)
• $|\text{w}{\text{CCS}}|$: private CCS witness length, i.e. $|z| = |\text{x}| + |\text{w}{\text{CCS}}| + 1$
• $t$: number of matrices in CCS
• $B$: Ring coefficient bound, which is chosen to be a power of two
• $\kappa$: number of rows in Ajtai matrix
• $L$: $B^L > \frac{p}{2}$ for a finite field with prime $p$ ($|\vec{\text{f}}| = |\text{w}_{\text{CCS}}| \cdot L$)
• $\vec{\text{f}}$: decomposed witness for the folding scheme
• $\text{nv}$: Number of variables for MLE = $\lceil\text{log}_2|\vec{\text{f}}|\rceil = \lceil\text{log}2(|\text{w}{\text{CCS}}| \cdot L)\rceil$
• $b, k$: $b^k = B$
• $s$: Number of NTT splits of the ring
• $\tau$: degree-extension of ring split component
• $d$: cyclotomic degree of the ring ($d = s\cdot \tau$)

Ring configuration

We choose the following Goldilocks ring configurations: