We measure the performance of various zkVMs running a Groth16 verifier written in Rust using cryptographic primitives from Arkworks. The inputs are a single Groth16 proof, public inputs, and verification key over the BN254 curve. This proof is verified N times to simulate aggregating a batch of size N. The resulting ZKVM proof is required to be on-chain verifiable, when the necessary recursion circuits are available (currently only Risc Zero and SP1).
The UPA’s performance was measured using the open-source UPA prover tool. For each batch size, we chose an appropriate circuit configuration and measured the total time required to produce an on-chain-verifiable aggregation proof from a batch of Groth16 application proofs. This implies computing proofs of the UBV, Keccak, and Aggregation circuits. All proofs from the first layer of recursion (UBV and Keccak circuits) are computed in parallel, then the second layer of recursion (Aggregation circuit) is computed. The full script for keygen and benchmarking can be found here.