We're excited to announce the Nexus zkVM 3.0, our next-generation zero-knowledge virtual machine.

This release is a full, ground-up rewrite of the previous generations of the Nexus zkVM, and is accompanied by a rigorous formal specification. The machine features a redesigned architecture for the robust, extensible, and modular proving of programs compiled for RISC-V – an instruction set architecture supported as a target by most major programming languages and compiler frameworks.

Based around a revamped guest runtime, fast memory checking, and backended by the Stwo prover, the new machine is more usable, more extensible, and ~1000x faster than the Nova family of folding schemes-based zkVM 1.0 and 2.0 releases.

Our Nexus zkVM 3.0 Specification describes our design in detail – including a formal description of the RISC-V arithmetization and memory checking arguments, which are at the core of our new machine. You can use the zkVM and review our implementation on Github.

zkVM design

At the heart of our design is a formally-specified set of Arithmetic Intermediate Representation (AIR) constraints for the RISC-V machine architecture, as well as a lookup-based memory checking argument developed by our research team (see the ZKProof 6 keynote by our Chief Scientist, Jens Groth).

Together, these scientific contributions provide for a concise and sound argument for the correctness of the Nexus zkVM 3.0. When paired with Stwo – StarkWare's record-breaking STARK prover – as the proving backend the Nexus zkVM 3.0 can quickly and succinctly prove any computation ~1000x faster than our earlier folding scheme-based zkVMs.

Our adoption of Stwo is driven by the quality and raw performance of the implementation, as well as the scientific and engineering acumen of the team behind it. Consistent with our commitment to open-science, the Nexus zkVM 3.0 is source-available with a formal specification.

Paired with these proving advancements are an entirely redesigned machine architecture and runtime. The new design is optimized for robust and efficient verifiable computation, with a modified Harvard architecture and dynamic memory model providing seamless "only prove what you use" memory management.

Continually advancing

This new Rust runtime makes developing for the zkVM – whether writing new code or porting existing applications – both much easier and far more reliable. The Nexus SDK supports our Nova-based provers and experimental Jolt support in a legacy compatibility mode as well.

The Nexus zkVM 3.0 also powers our prover network. Our team continues to work on new scientific and engineering advances to further accelerate the usability and performance of the zkVM, with the goal of enabling easy deployment of verifiable computation for numerous applications across zkML, blockchain, security, privacy, social trust, compliance, and auditing.

Using the zkVM

Using the Nexus SDK it is incredibly easy to prove Rust programs.

For example, after installation we just need two programs: a guest program that runs on the zkVM, and a host program that operates the zkVM itself.

By running:

$ cargo nexus host nexus-host

we can create a new Rust project directory with the following structure:

./nexus-host
├── Cargo.lock
├── Cargo.tom
├── rust-toolchain.toml
└── src
    ├── main.rs
    └── guest
        ├── Cargo.toml
        ├── rust-toolchain.toml
        └── src
            └── main.rs

Here, ./src/main.rs is the host program, while ./src/guest/src/main.rs is the guest program.

As an example of a simple guest program, we can make ./src/guest/src/main.rs:

#![cfg_attr(target_arch = "riscv32", no_std, no_main)]

use nexus_rt::println;

#[nexus_rt::main]
#[nexus_rt::public_input(x)]
fn main(x: u32, y: u32) -> u32 {
    println!("Read public input:  {}", x);
    println!("Read private input: {}", y);

    x * y
}

This guest program takes as input two integers, one public and one private, logs their values, and then returns their product.

As the host program ./src/main.rs, we can use:

use nexus_sdk::{
    compile::{cargo::CargoPackager, Compile, Compiler},
    stwo::seq::Stwo,
    ByGuestCompilation, Local, Prover, Verifiable, Viewable,
};

const PACKAGE: &str = "guest";

fn main() {
    println!("Compiling guest program...");
    let mut prover_compiler = Compiler::<CargoPackager>::new(PACKAGE);
    let prover: Stwo<Local> =
        Stwo::compile(&mut prover_compiler).expect("failed to compile guest program");

    let elf = prover.elf.clone(); // save elf for use with test verification

    print!("Proving execution of vm... ");
    let (view, proof) = prover
        .prove_with_input::<u32, u32>(&3, &5)
        .expect("failed to prove program"); // x = 5, y = 3

    assert_eq!(view.exit_code().expect("failed to retrieve exit code"), 0);

    let output: u32 = view
        .public_output::<u32>()
        .expect("failed to retrieve public output");
    assert_eq!(output, 15); // z = 15

    println!("output is {}!", output);
    println!(
        ">>>>> Logging\n{}<<<<<",
        view.logs().expect("failed to retrieve debug logs").join("")
    );

    print!("Verifying execution...");
    proof
        .verify_expected::<u32, u32>(
            &5,   // x = 5
            0,    // exit code = 0
            &15,  // z = 15
            &elf, // expected elf (program binary)
            &[],  // no associated data,
        )
        .expect("failed to verify proof");

    println!("  Succeeded!");
}

This host program compiles the guest program and then invokes the resultant binary with public input x = 5 and private input y = 3.

The zkVM will then run the guest program, return a view containing the output (z = 15) and logs, and produce a proof of its correct execution.

After the proving completes, the host program then reads the output out of the view, checks it, prints it along with any logs, and verifies the proof.

Then, we can actually execute the host program (including emulating and proving the guest program) with:

$ cargo run -r

And the host program will print:

Proving execution of vm... output is 15!
>>>>> Logging
Read public input:  5
Read private input: 3
<<<<<
Verifying execution...  Succeeded!

See our zkVM documentation, including guides and walkthroughs, at docs.nexus.xyz.

zkVM evaluation

The zkVM specification also includes a thorough evaluation of the performance of the machine. This evaluation includes both micro-benchmarks of the Stwo prover integration, as well as end-to-end benchmarks of the zkVM when executed on full Rust programs.

The evaluation includes results as to both the time and memory efficiency of the zkVM, as well as its overhead with respect to native execution.

The Nexus zkVM 3.0 is available today for developer use.