CLIENT SIDE PROVING: How big can circuits for mobile proving be?

With Anon-Aadhaar v1 circuits being 1.7m constraints, we wanted to answer this question with Project MoPerf.

While there are many performance related concerns the biggest blocker is memory usage. With modern phones with 4GB we can do 1.7m+ constraints.

We previous did a PoC with Anon-Aadhaar (160k constraints). With AA v1 (nullifiers+selective disclosure, see https://twitter.com/PrivacyScaling/status/1757828914733310047 for more) constraints increased more than 10x to 1700k. We weren't sure if this was still feasible on mobile, so we wanted to test this.

zk-pilled or something | Now: http://zkintro.com, folding, mobile proving, etc | Was: Created @vacp2p and @Waku_org | 英文中文都可以

This is important, because most ZK Identity solutions have the same ballpark complexity (~1m constraints), and they have to be run from mobile to function as desirable. Circom is also still the most mature stack out the there, and other stacks come with different trade-offs.

While there is more work to be done (including improving performance), this gives us confidence to get Anon-Aadhaar v1 to work on mobile in the form of a showcase app. For more details, read here: https://hackmd.io/5ItB2D50QcavF18cWIrmfQ?view=#Results. To be continued.