Magnetar

post-quantum RV64 zkVM from standard hashes hash-only transparent 120-bit provable Rust

Magnetar proves executions of general-purpose RV64I programs with every computational assumption rooted in standard hash functions — SHA-3 for Fiat–Shamir transcripts, BLAKE3 for the single Merkle commitment. This repository is the complete, tested implementation of the paper Magnetar: High-speed post-quantum RV64 zkVM from standard hashes (eprint 2026-2423): every component of the protocol runs, proves, verifies, and rejects tampering.

One commitment

MosaicPCS packs every committed polynomial — the direct witness segments and the memory arguments' one-hot components and increments — onto aligned subcubes of one cube, and commits once.

Hash-only security

No curves, no lattices, no trusted setup, no conjectured proximity gaps — the 120-bit bound uses only proven gaps inside the unique-decoding radius.

Sum-check native

The whole stack is multilinear sum-checks over binary fields: the prover's work is linear in the trace length and every argument is field-element sized.

Fully integrated

The seven-step Construction 3 runs end-to-end: Virtual Spartan, two BinaryTwists, two BinaryRouters, BinaryShout, and the final PCS evaluation argument.

The protocol, end to end

  1. Execute. The interpreter runs the microcode-expanded program and records the trace plus the memory-access log.
  2. Commit. The direct segments and the auxiliary polynomials form one MosaicPCS polynomial; the protocol's only commitment.
  3. Virtual Spartan. The two SIMD R1CS relations (F₂ bit constraints and F₂¹²⁸ packed products) reduce jointly to one claim per witness segment — the virtual claims are forwarded, the direct claims held.
  4. Reduce the virtual claims. BinaryTwist for registers and RAM (with the Ψ-sum-checks binding the address and index claims), BinaryRouter for shifts and sub-word stores, BinaryShout for the bytecode.
  5. Prove the committed evaluations. MosaicPCS lifts each claim for free (aligned subcubes), batches them with one sum-check, and ring-switches to the packed polynomial for the single PCS evaluation argument.

Architecture

CratePaperContents
magnetar-field§3B = F₂, K = F₂¹²⁸ with PCLMULQDQ + portable carry-less multiplication, eq tables, multilinear folding, 128-bit packing with the φc functional
magnetar-hash§6SHA3-256 Fiat–Shamir transcripts (domain-separated, ratcheting) and BLAKE3 Merkle trees
magnetar-sumcheck§3.2The characteristic-two multi-factor sum-check engine plus the sparse prover (linear-in-T prover work)
magnetar-pcs§3.6, §5.2Affine-substitution codewords, the fold-chain evaluation argument, and ring switching with exact φc bit extraction
magnetar-spartan§4.1–4.3, §5.3Sparse R1CS, the SIMD reduction, and Virtual Spartan (lockstep outers, α-batched inner, per-segment claims)
magnetar-memory§4.4BinaryTwist and BinaryShout with the refined one-hotness (Frobenius Δ*) and the discharge helpers
magnetar-router§5.4BinaryRouter for shifts and sub-word stores (routings, selectors, offset links)
magnetar-cpu§5.1The RV64I decoder, microcode expansion, the interpreter with the full access log, and the dual SIMD R1CS circuit
magnetar-zkvm§5.2, §5.5MosaicPCS, KeyGen, the complete Construction-3 prover/verifier, and the proof-size instrumentation

Quick start

git clone https://github.com/idrees2516/magnetar
cd magnetar
cargo test --workspace --release   # 69 tests: every argument + tamper classes
cargo run --release --bin magnetar -- fib 2

The last command executes a Fibonacci program, proves the execution, verifies the proof, and prints the measured cost model — the committed-bit inventory per component, the PCS geometry, and the byte breakdown of the proof (the PCS evaluation argument dominates, exactly as the paper's cost analysis predicts).

Security posture