Performance and Benchmarks

Circom

In summary:
Both native witness generation and proof generation are generally faster than snarkjs in the browser, with potential speed improvements of up to 20 times.
However, performance varies across different circuits. We recommend developers benchmark their custom circuits before selecting tools for app development.

Details

warning

• witnesscalc hasn't been integrated in mopro. See zkmopro/mopro#110.
• circom-witness-rs is not fully compatible with circom circuits. See: zkmopro/mopro#32.
• wasmer doesn't work in iOS. See: zkmopro/mopro#109.

iOS

Benchmarks on an iPhone 12 mini (2020).

Witness generation

SHA256	witnesscalc	circom-witness-rs	wasmer	w2c	snarkjs
Average	22.3 ms	36.1 ms	476.1 ms	90.3 ms	163.5 ms
Stdev	1.2 ms	0.3 ms	27.8 ms	1.2 ms	6.7 ms
Comparing to snarkjs	~7x	~4.5x	~(-3)x	~1.8	-

Keccak256	witnesscalc	circom-witness-rs	wasmer	w2c	snarkjs
Average	144.7 ms	26.2 ms	440.7 ms	160.7 ms	257.1 ms
Stdev	1.8 ms	4.5 ms	10.4 ms	3.3 ms	4.1 ms
Comparing to snarkjs	~1.8x	~10x	~(-1.7)x	~1.6x	-

RSA	witnesscalc	circom-witness-rs	wasmer	w2c	snarkjs
Average	208.5 ms	513.1 ms	5488 ms	3861 ms	5421 ms
Stdev	5.8 ms	11.2 ms	47.8 ms	10.8 ms	9.9 ms
Comparing to snarkjs	~26x	~10x	~(-1)x	~1.4x	-

Proof generation

SHA256	rapidsnark	ark-works	snarkjs
Average	795.2 ms	550.4 ms	2374.1 ms
Stdev	17.2 ms	27.2 ms	62.9 ms
Comparing to snarkjs	~3x	~4.3x	-

Keccak256	rapidsnark	ark-works	snarkjs
Average	2647.9 ms	1221.1 ms	8149.1 ms
Stdev	14.4 ms	42.7 ms	283.575 ms
Comparing to snarkjs	~3x	~6.7x	-

RSA	rapidsnark	ark-works	snarkjs
Average	2908.6 ms	2324.4 ms	10304.8 ms
Stdev	112.9 ms	67.1 ms	605.5 ms
Comparing to snarkjs	~3.5x	~4.4x	-

Details: Spreadsheet of Circom benchmark (iOS)

note

• Tachyon performs well in macOS, but we haven't integrated it in mobile. See zkmopro/mopro#143

Android

TBD

macOS

Benchmarks on an Macbook Pro M1 Max (2021).

Witness generation

SHA256	Tachyon	witnesscalc	circom-witness-rs	wasmer	w2c	snarkjs
Average	32.7 ms	22.2 ms	42.8 ms	454.5 ms	88.8 ms	132.8 ms
Stdev	0.7 ms	5.2 ms	2.2 ms	26.7 ms	1.0 ms	1.3 ms
Comparing to snarkjs	~4x	~6x	~3x	~(-3.4)x	~1.5x	-

Keccak256	Tachyon	witnesscalc	circom-witness-rs	wasmer	w2c	snarkjs
Average	82.9 ms	72.3 ms	14.1 ms	447.1 ms	169 ms	234.6 ms
Stdev	0.2 ms	7.7 ms	0.8 ms	5.9 ms	2.0 ms	3.2 ms
Comparing to snarkjs	~2.8x	~3x	~16x	~(-1.9)x	x1.4x	-

RSA	Tachyon	witnesscalc	circom-witness-rs	wasmer	w2c	snarkjs
Average	218.4 ms	167.6 ms	522.9 ms	5109 ms	3847.2 ms	4638.8 ms
Stdev	16.8 ms	7.5 ms	7.7 ms	25.1 ms	61.3 ms	32.4 ms
Comparing to snarkjs	~21.2	~27x	~8.8x	~(-1.1)x	~1.2x	-

Proof generation

SHA256	Tachyon	rapidsnark	ark-works	snarkjs
Average	536.1 ms	773.8 ms	1137.3 ms	1350.4 ms
Stdev	10 ms	17 ms	127 ms	26 ms
Comparing to snarkjs	~2.5x	~1.7x	~1.1	-

Keccak256	Tachyon	rapidsnark	ark-works	snarkjs
Average	1931 ms	2514 ms	1133 ms	3791 ms
Stdev	31.9 ms	75.2 ms	168 ms	58.6 ms
Comparing to snarkjs	~1.9x	~1.5x	~3.3	-

RSA	Tachyon	rapidsnark	ark-works	snarkjs
Average	2307 ms	2560 ms	2530 ms	5504 ms
Stdev	18.7 ms	21.3 ms	266.1 ms	69.3 ms
Comparing to snarkjs	~2.3	~2.1x	~2.1x	-

Details: Spreadsheet of Circom benchmark (macOS)

Halo2

In summary:
The performance of the Mopro build is comparable to the native Halo2 build.

Details

The bellow tests were run on a Macbook Pro M1 Pro (2021) as well as an iPhone 15 Pro (2023).

Keccak256	Prove Time (s)	Verify Time (s)
Native (M1 Pro)	10.3 s	0.15 s
Emulator (M1 Pro)	10.1 s	0.13 s
iPhone 15 Pro	11.0 s	0.12 s

RSA	Prove Time (s)	Verify Time (s)
Native (M1 Pro)	76.5 s	11.1 s
Emulator (M1 Pro)	64.5 s	9.0 s
iPhone 15 Pro	crashes	crashes

Note that the iPhone 15 Pro crashes when running the RSA circuit due to the large memory requirements. The circuit needs around 5GB of memory to run, while the iPhone 15 Pro usually limits the application memory usage to 3GB.