On the Performance of Cloud-based ARM SVE for Zero-Knowledge Proving Systems

TL;DR

This paper evaluates the performance gap between ARM and x86-64 CPUs for zero-knowledge proof computations, finding current ARM CPUs are slower but could surpass x86-64 with larger vector sizes and architectural improvements.

Contribution

It provides a detailed analysis of ARM SVE performance in ZKP systems and suggests potential hardware enhancements to outperform x86-64 CPUs.

Findings

ARM CPUs are 1.4X to 1.6X slower than x86-64 for Merkle tree building.

Current ARM CPUs have smaller vector sizes and lower clock speeds limiting performance.

Increasing ARM vector size to 512 bits could enable higher performance than x86-64.

Abstract

Zero-knowledge proofs (ZKP) are becoming a gold standard in scaling blockchains and bringing Web3 to life. At the same time, ZKP for transactions running on the Ethereum Virtual Machine require powerful servers with hundreds of CPU cores. The current zkProver implementation from Polygon is optimized for x86-64 CPUs by vectorizing key operations, such as Merkle tree building with Poseidon hashes over the Goldilocks field, with Advanced Vector Extensions (AVX and AVX512). With these optimizations, a ZKP for a batch of transactions is generated in less than two minutes. With the advent of cloud servers with ARM which are at least 10% cheaper than x86-64 servers and the implementation of ARM Scalable Vector Extension (SVE), we wonder if ARM servers can take over their x86-64 counterparts. Unfortunately, our analysis shows that current ARM CPUs are not a match for their x86-64 competitors. Graviton4 from Amazon Web Services (AWS) and Axion from Google Cloud Platform (GCP) are 1.6X and 1.4X slower compared to the latest AMD EPYC and Intel Xeon servers from AWS with AVX and AVX512, respectively, when building a Merkle tree with over four million leaves. This low performance is due to (1) smaller vector size in these ARM CPUs (128 bits versus 512 bits in AVX512) and (2) lower clock frequency. On the other hand, ARM SVE/SVE2 Instruction Set Architecture (ISA) is at least as powerful as AVX/AVX512 but more flexible. Moreover, we estimate that increasing the vector size to 512 bits will enable higher performance in ARM CPUs compared to their x86-64 counterparts while maintaining their price advantage.