Search papers, labs, and topics across Lattice.
This paper provides a comprehensive hardware-system-level comparison of the SumCheck protocol and the Number Theoretic Transform (NTT) within zero-knowledge proof systems, specifically analyzing their performance in the context of the ZeroCheck protocol. The study reveals that while SumCheck generally excels for high-degree polynomials, NTT can outperform SumCheck for low-degree polynomials depending on memory availability and workload size. These insights highlight the nuanced trade-offs between computational efficiency and hardware compatibility in cryptographic protocol design, offering valuable guidance for future implementations.
SumCheck outperforms NTT for high-degree polynomials, but NTT can take the lead for low-degree cases depending on memory constraints鈥攖here's no one-size-fits-all solution.
In the ZKP community, it has long been discussed that the SumCheck protocol is asymptotically more efficient than the Number Theoretic Transform (NTT), requiring only $O(N)$ arithmetic versus $O(N \log N)$. At the same time, hardware accelerator designers propose that NTT is more hardware-friendly, benefiting from locality and data reuse, while SumCheck suffers from sequential, dependent rounds. Despite these competing intuitions, the hardware-system-level trade-offs between NTT- and SumCheck-based proving primitives remain insufficiently understood. Beyond individual accelerator design, this work presents, to our knowledge, the first hardware-system-level direct comparison of NTT- and SumCheck-based proving primitives under a unified architectural framework. We study them in the context of the ZeroCheck protocol, a common building block in zkSNARKs. We implement optimized systems for both primitives. Both are evaluated under the same level on-chip SRAM and off-chip bandwidth budgets. Our results show that there is no universal winner. Generally, SumCheck outperforms NTT for high-degree polynomials. For low-degree polynomials, performance depends on memory availability: under given SRAM budgets, NTT might deliver better performance for medium-sized workloads by exploiting data reuse. These findings, bridging cryptographic protocol design and hardware architecture, offer practical guidance for understanding the proving cost of NTT- and SumCheck-based zero-knowledge proof systems.
