dusk-plonk is a pure Rust implementation of the PLONK zero-knowledge proving system over the BLS12-381 elliptic curve.

It uses KZG10 as its default polynomial commitment scheme and includes custom gates for efficient circuit construction. Details of Dusk's implementation are available in the PLONK specification. Security audits are available in the Dusk audits repository.

DISCLAIMER: This library is currently unstable. A security audit has been completed, though further in-depth analysis and testing are encouraged. Use at your own risk.

To see how to use this library, check the 'examples' directory.

This crate includes a variety of features which are briefly explained below:

• alloc: Enables the usage of an allocator, allowing for Proof constructions and verifications. Without this feature it IS NOT possible to prove or verify anything. Its absence only makes dusk-plonk export certain fixed-size data structures such as Proof. This is useful in no_std environments that also do not make use of an allocator.
• std: Enables std usage as well as rayon parallelization in some proving and verifying operations. It also uses the std versions of the elliptic curve dependencies, utilizing the parallel feature from dusk-bls12-381. This feature is enabled by default.
• debug: Enables the runtime debugger backend, outputting CDF files to the path defined in the CDF_OUTPUT environment variable. When used, the binary must be compiled with debug = true. For more info, check the cargo book. It is recommended to derive the std output and std error and then place them in a text file for efficient gate analysis.

Proving is not constant-time. The KZG commitments to witness polynomials use a variable-time multi-scalar multiplication, so an attacker who can observe the proving machine (timing, cache or branch-predictor traces) may learn about the witness. Prove on hardware such an attacker cannot observe. Fixed-base scalar multiplication computes its NAF digits and selects each round's addend without branching on the scalar; other witness code makes no such guarantee. Verification only handles public data.

The crate documentation provides information about all the functions that the library provides, as well as the documentation regarding the data structures that it exports. To check this, visit the documentation page or run make doc or make doc-internal.

Benchmarks taken on Apple M1, for a circuit-size of 2^16 constraints:

• Proving time: 7.871s
• Verification time: 2.821ms (This time does not vary depending on the circuit-size.)

For more results, please run cargo bench to get a full report of benchmarks in respect of constraint numbers.

• Reference implementation by Aztec Protocol/Barretenberg.
• FFT Module and KZG10 Module were adapted from ZEXE/Zcash and SCIPR Lab, respectively.

This code is licensed under the Mozilla Public License Version 2.0 (MPL-2.0). Please see LICENSE for more information.

This implementation is designed by the Dusk team.

• If you want to contribute to this repository/project, please check our CONTRIBUTING.md.
• If you want to report a bug or request a new feature addition, please open an issue on this repository.