Entering the era of lattice SNARKs – with a faster, post-quantum Jolt

Today we are releasing Lattice Jolt, a new version of our open source zkVM (zero knowledge virtual machine). The architecture is the same one that already made Jolt the fastest and simplest zkVM available. What changes with this new version is the cryptography underneath it, which now rests on lattices instead of elliptic curves. This one change does three things at once:

• It makes Jolt post-quantum.
• It makes the prover and verifier 2x-3x faster.
• It gives Jolt the shortest proofs of any post-quantum zkVM: under 100 KB today, with a path to further reductions. Proofs get posted on-chain and sent over networks, so smaller proofs mean cheaper verification everywhere.

Those properties hold across the whole range of settings where zkVMs get used. The same prover that handles billions of CPU cycles on GPUs can also prove millions of cycles on a phone, and in both cases developers write ordinary programs rather than hand-crafted circuits requiring special expertise. That is what we mean when we call Jolt the “everything SNARK”.

But the bigger story is what Lattice Jolt means for SNARK design and adoption. Nearly every post-quantum SNARK in production today is hash-based. Lattice Jolt shows that lattice-based SNARKs can be both faster and more compact. Digital signatures are going through the same transition: Hash-based schemes are the conservative choice, but lattice-based ones are what the world is mostly deploying. We expect SNARKs to follow, and the second half of this post explains why.