Recursive proofs?

[morganthomas]

Does Winterfell support recursive proofs? Is there a simple way to write a circuit which takes as inputs and checks a zkSNARK generated for another circuit (or the same circuit)? Or how would you recommend going about doing this with Winterfell?

[irakliyk]

Theoretically, you could use Winterfell to build recursive proofs even now - but it will pretty difficult and the results will probably be unsatisfactory. There are two reasons for this.

First, for recursive proofs to be practical, we need to use arithmetization-friendly hash functions when building base-layer proofs. Winterfell currently supports only SHA256 and BLAKE3 hash functions, and these are not arithmetization-friendly. There is an issue (#52) to add support for Rescue hash function (or make the structure more generic). Once this is done, Recursive proofs in Winterfell will be practical.

The second part is related to putting together AIR for a STARK verifier (basically, describing the circuit of the verifier). I don't think there is a good way to do it generically (i.e., the AIR would need to be tailored to a specific project) - though, there is probably a good way to provide most common components (e.g., AIR for FRI verifier).

One other way to do recursive STARK proofs is by using a STARK VM. There are a couple of them in development right now. The one based on Winterfell is Miden VM - though it doesn't support recursive proofs yet either.

[eigmax]

@morganthomas I am curious what kind of scenario you are handling that need stark to verify the snark's proof. I am doing the almost opposite verification, using plonk gate to write the circuits which verify the stark's proof, as a kinda mixed proof system for Rollup.

[irakliyk]

Closing as #52 has been closed by #111.