Verifier in no_std mode

[dartdart26]

Hey, I was wondering if you've considered making the verifier Rust code compile and run without std, such that it can be used on blockchains, for example?

I was looking a bit into it, let me know if it is an useful thing to do. Also looked at whether the verifier can be a separate crate for that matter.

[WizardOfMenlo]

Hello! I haven't considered it, it seems something that could be helpful. Bandwidth-wise, I don't think I can do it myself, but would be happy to look at a no_std verifier crate if it helps.

[dartdart26]

Thanks. I think I can give it a shot and share it here (hopefully a PR). Though I suspect I'd need to reshuffle things a bit, say separate core, prover and verifier crates. At the same time, I don't want to do a huge change at once.

[dartdart26]

Just FYI, a friend (@tdimitrov) and I have an effort here, when we have some spare time. Not no_std yet, but splitting to separate crates, namely a separate verifier crate that doesn't require getrandom support with real randomness (allowing us to for example compile for Solana).

Next will be prover.

The cli crate hosts the example main function and integration tests. And everything else remains in common.

dartdart26#2

[dartdart26]

@WizardOfMenlo So it is now separated to verifier, prover, common and cli crates. Would you be interested in merging something like that to main? No worries if not - in such case we could close this issue and we can continue work in our fork for that. If yes, I could try prepare a PR.

For reference, the verifier crate now compiles in Solana mode (cargo build-sbf). Haven't tested yet what happens at runtime, but will do so soon. It is still not no_std, but doesn't use randomness which is what we want.

[dartdart26]

PR, if you feel like merging something like that: #206

We feel it makes sense, but we'd understand if you don't want to merge.

[dartdart26]

That's WHIR verifier running on Solana: https://github.com/dartdart26/whir-solana

[WizardOfMenlo]

@dartdart26 hey! Sorry, dropped the ball on this one, that's very impressive! Somewhat surprising that we run out of memory so early, what is the memory limit on Solana? We are doing some major refactor of the WHIR codebase (see #209 ) so I think we'll wait on the restructuring until that is finished.

cc @recmo

[dartdart26]

AFAIU, by default max heap size is 32 KB, but can be increased to 256 KB (I haven't tried that yet, but will do so).

No worries about the PR, just consider it if you think it is useful. If yes, I can rebase it once you are ready.

Re recent developments in cryptography, do you expect proof sizes will increase significantly for WHIR?