💻 computer science

zkPHIRE: A Programmable Accelerator for ZKPs over HIgh-degRee, Expressive Gates

The paper presents zkPHIRE, a novel programmable hardware accelerator that significantly outperforms both CPU and state-of-the-art solutions by efficiently handling complex, high-degree gates via the SumCheck protocol to enable scalable and fast Zero-Knowledge Proofs for the HyperPlonk system.

Original authors: Alhad Daftardar, Jianqiao Mo, Joey Ah-kiow, Benedikt Bünz, Siddharth Garg, Brandon Reagen

Published 2026-01-27

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Alhad Daftardar, Jianqiao Mo, Joey Ah-kiow, Benedikt Bünz, Siddharth Garg, Brandon Reagen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The "Magic Trick" That Takes Too Long

Imagine you want to prove to a friend that you know a secret password without actually telling them what the password is. In the world of cryptography, this is called a Zero-Knowledge Proof (ZKP). It's like showing someone you have a key to a house without handing them the key or letting them see the lock.

This technology is amazing for privacy (like proving you are over 21 without showing your ID) and security (like verifying blockchain transactions). However, there's a huge problem: it's incredibly slow.

Generating one of these proofs on a standard computer (CPU) can take minutes or even hours. It's like trying to bake a complex cake by hand when you need to serve a banquet in five minutes. The paper introduces a new machine, zkPHIRE, designed to be a "super-chef" that can bake these proofs in seconds.

The Problem: The "One-Size-Fits-All" Trap

To understand the innovation, we need to look at how these proofs are built.

The Old Way (Vanilla Gates): Think of a standard computer processor as a factory that only knows how to do two things: Add and Multiply. To build a complex proof, you have to break every single step of the math down into tiny additions and multiplications. It's like trying to build a skyscraper using only individual bricks. It works, but you need millions of bricks, and the construction takes forever.
The New Way (High-Degree Gates): Modern protocols (like HyperPlonk) allow for "High-Degree Gates." These are like pre-fabricated wall sections. Instead of laying one brick at a time, you can snap in a whole wall that includes a window, a door, and a frame all at once. This drastically reduces the number of steps needed.

The Catch: While these "pre-fabricated walls" are faster to build, they are weird shapes. A standard factory (or a previous specialized chip called zkSpeed) was built to only handle simple bricks. It couldn't handle the complex, custom shapes of the new walls. To use the new walls, you either had to go back to the slow, manual method or build a custom factory for every single type of wall, which is too expensive and inflexible.

The Solution: The "Programmable" Factory (zkPHIRE)

The authors built zkPHIRE, a new hardware accelerator that acts like a programmable, shape-shifting factory.

It's Flexible: Unlike the old factories that were hard-coded for specific shapes, zkPHIRE can be reprogrammed on the fly to handle any shape of "wall" (polynomial gate), whether it's a simple brick or a complex, high-degree curve.
It's Fast: It doesn't just handle these complex shapes; it handles them incredibly efficiently.
- Speed: It is 1,486 times faster than a standard computer CPU.
- Comparison: It is also 11.87 times faster than the previous best specialized chip (zkSpeed), even though zkSpeed was built for a simpler, less flexible task.
- Scalability: It can handle massive problems (up to $2^{30}$ constraints) while keeping the final "proof" (the receipt of the magic trick) tiny (only 4–5 KB).

How It Works: The "Smart Assembly Line"

The paper describes the inner workings of zkPHIRE using a few clever tricks:

The "Scratchpad" Strategy: Imagine a chef who keeps all their ingredients on the counter (on-chip memory). For simple recipes, this is great. But for massive banquets, the counter gets too crowded, and the chef wastes time reaching for things. zkPHIRE uses a smarter system: it keeps a small, organized "prep station" (scratchpad) for the ingredients it needs right now, and fetches the rest from the pantry (off-chip memory) just-in-time. This saves space and keeps the assembly line moving.
The "Forest" of Trees: To do the math, the chip uses a "Multifunction Forest." Imagine a team of workers passing buckets of water down a line. Instead of having one worker do everything, they pass the water through a series of trees (data structures) that multiply and add values simultaneously. This allows the chip to do many calculations at once without getting tangled.
Hiding the Wait: Sometimes, the machine has to wait for data to arrive from the pantry. zkPHIRE is clever enough to start working on a different part of the proof while it waits, so the machine never sits idle.

The Results: Why It Matters

The paper tested zkPHIRE on various real-world scenarios, including:

ZCash: A privacy-focused cryptocurrency.
Rollups: Methods to speed up blockchain transactions.
zkEVM: A way to run complex smart contracts privately.

The Verdict:

Speed: It turns a process that takes hours on a normal computer into a process that takes milliseconds.
Efficiency: It achieves this while using less physical space (silicon area) than previous attempts.
Versatility: It proves that you don't have to choose between "fast but rigid" and "slow but flexible." zkPHIRE is both fast and flexible.

Summary

Think of zkPHIRE as the difference between a hand-cranked pencil sharpener and a high-speed, programmable industrial sharpening machine.

The old way (CPU) was slow and manual.
The previous specialized way (zkSpeed) was fast but could only sharpen standard pencils.
zkPHIRE is fast, can sharpen any shape of pencil (even weird, custom ones), and does it so efficiently that it makes privacy-preserving technology practical for the real world.

The paper claims this is the first time such a flexible, high-speed machine has been built specifically for these complex "High-Degree" proofs, paving the way for faster, more private, and more secure digital systems.

Technical Summary: zkPHIRE

Problem Statement

Zero-Knowledge Proofs (ZKPs) are critical for privacy-preserving computation in domains like blockchain, machine learning, and electronic voting. However, their widespread adoption is hindered by the exceptionally high computational overhead required for proof generation, which can take minutes to hours on a CPU.

While hardware accelerators (ASICs) and GPU implementations have been proposed to mitigate these costs, they face significant limitations regarding flexibility and scalability:

Rigid Architectures: Prior accelerators, such as zkSpeed, often rely on fixed-function units designed for specific "Vanilla" gate sets (e.g., standard additions and multiplications). They struggle to efficiently handle the complex, high-degree, and custom gates increasingly used in modern protocols (e.g., Halo2, HyperPlonk's Jellyfish gates).
Scalability Issues: Fixed-function designs often require large on-chip scratchpads to store intermediate data (Multi-linear Extension or MLE tables). As problem sizes scale (e.g., beyond $2^{24}$ gates), the memory footprint becomes impractical, limiting the accelerator's applicability to large-scale ZKP workloads.
SumCheck Complexity: Modern ZKP protocols utilize the SumCheck protocol to verify arithmetic circuits. While efficient for simple gates, SumCheck becomes computationally irregular and data-intensive when applied to high-degree, expressive gates. The dataflow varies significantly based on the polynomial structure, making fixed hardware designs suboptimal.

Methodology

The authors propose zkPHIRE, a programmable, full-system accelerator designed to efficiently handle arbitrary custom gates via the SumCheck protocol. The system is built around a novel, programmable SumCheck unit integrated into a larger framework supporting the HyperPlonk protocol.

1. Programmable SumCheck Unit

The core innovation is a programmable datapath that balances resource allocation with immediate data reuse, avoiding the rigidity of fixed-function units.

Architecture: The unit consists of Processing Elements (PEs) containing MLE Update units, Extension Engines (EEs), and Product Lanes (PLs).
Dataflow: Instead of streaming all MLE entries simultaneously, the unit processes one polynomial term at a time. It fetches tiles of data from off-chip memory into local, banked scratchpad buffers.
Scheduling: A graph-based scheduler decomposes polynomial constraints to map MLE tables to EEs and PLs. It utilizes an accumulation-based schedule to minimize temporary storage requirements compared to balanced tree approaches, allowing for efficient handling of repeating polynomials within a term.
Flexibility: The unit supports arbitrary numbers of terms and degrees. It dynamically adapts to different polynomial structures by reconfiguring the mapping of MLEs to hardware resources.
ZeroCheck Integration: The design integrates the construction of auxiliary random polynomials (ZeroChecks) directly into the SumCheck datapath, eliminating separate precomputation steps and reducing memory overhead.

2. Full-System Architecture (zkPHIRE)

The SumCheck unit is embedded within a larger accelerator framework for HyperPlonk, which includes:

Multifunction Forest: A set of tree-based units reused for MLE evaluation, product computations, and building MLEs. This shared design improves resource utilization and reduces area compared to dedicated units.
MSM (Multi-Scalar Multiplication): A dedicated unit for elliptic curve operations, optimized for the specific witness counts of HyperPlonk (including sparse and dense MSMs).
Permutation Quotient Generator: A pipelined unit for constructing permutation arguments, featuring an optimized modular inverse unit that reduces area by 4.2× compared to prior work.
Memory Organization: The system employs smaller, tile-based scratchpads rather than massive global SRAMs. This reduces area consumption and allows more die space for computational units, accepting slightly higher off-chip memory latency in exchange for better scalability.
Masking Optimization: The architecture overlaps the latency of Gate Identity checks (ZeroChecks) with MSM computations during the Wire Identity phase, effectively hiding latency.

3. Evaluation Methodology

The authors evaluated the design using TSMC 22nm technology (scaled to 7nm for comparison) with a 1GHz clock.

Benchmarks: They tested a diverse array of polynomial constraints, including those from Spartan, Halo2 (elliptic curve operations), and HyperPlonk (Vanilla and Jellyfish gates).
Comparisons: Performance was benchmarked against a 32-thread CPU (AMD EPYC 7502), an NVIDIA A100 GPU, and the prior ASIC state-of-the-art, zkSpeed (and an enhanced version, zkSpeed+).
Design Space Exploration: The authors swept parameters (PEs, EEs, PLs, SRAM size, bandwidth) to identify Pareto-optimal designs across various bandwidth scenarios (from DDR to HBM3).

Key Contributions

Programmable SumCheck Accelerator: The first hardware unit capable of supporting arbitrary high-degree multilinear polynomials, enabling compatibility with custom gate types found in modern ZKP protocols.
High-Degree Gate Evaluation: The first hardware evaluation demonstrating that high-degree gates offer significant performance and scalability benefits, particularly when reducing the total gate count of a circuit.
Optimized Hardware Primitives:
- A unified Multifunction Forest that saves 15.2% area by reusing tree units across protocol steps.
- An optimized Modular Inverse unit that achieves a 4.2× area reduction over prior work while maintaining throughput.
Full-System Accelerator (zkPHIRE): A complete accelerator for the HyperPlonk protocol that supports succinct proofs for problem sizes up to $2^{30}$ constraints.

Results

Speedup over CPU: zkPHIRE achieves a 1486× geometric mean speedup over a 32-thread CPU baseline.
Speedup over Prior ASICs: At iso-area (comparing to a 294 mm² design vs. a 366 mm² zkSpeed+ design), zkPHIRE achieves an 11.87× geometric mean speedup over zkSpeed+.
Speedup over GPU: When compared to an NVIDIA A100 GPU running the ICICLE library, zkPHIRE achieves approximately 70× speedup for SumCheck operations.
Scalability: The system supports problem sizes up to $2^{30}$ nominal constraints while maintaining small proof sizes (4–5 KB).
Jellyfish Gates: Using Jellyfish gates (which reduce gate counts by up to 32×) combined with zkPHIRE's programmability yields further performance gains. For example, a 4× reduction in gate count via Jellyfish gates allows zkPHIRE to outperform Vanilla gate implementations on both zkSpeed+ and zkPHIRE.
Resource Efficiency: The design achieves these results with a total area of roughly 294 mm² (at 7nm scaling) and a power consumption of 202.28 W.

Significance

The paper claims that zkPHIRE represents a significant step forward in ZKP hardware acceleration by addressing the trade-off between performance and flexibility. Unlike previous accelerators that were limited to specific gate sets, zkPHIRE's programmable SumCheck unit allows it to adapt to the evolving landscape of ZKP protocols, which are increasingly relying on complex, high-degree gates for efficiency.

The authors emphasize that their work demonstrates compelling performance while scaling to large problem sizes ( $2^{30}$ ) and maintaining succinct proof sizes. By abstracting SumCheck into common primitives (updates, extensions, products) and exploiting parallelism across tables and evaluation products, zkPHIRE provides a scalable foundation for future ZKP applications, including private age verification, trustworthy AI, and blockchain scalability. The results suggest that programmable architectures are essential for supporting the next generation of expressive ZKP protocols without sacrificing the performance gains of ASICs.