Skip to main content

​
Overview

Jolt is a zkVM (zero-knowledge virtual machine) for RISC-V that efficiently proves and verifies program execution. Unlike traditional zkVMs that use complex arithmetic circuits, Jolt leverages a fundamentally different approach: lookup arguments.

​
Core Innovation: Just One Lookup Table

The name “Jolt” stands for Just One Lookup Table. This reflects the system’s core innovation: proving CPU instruction execution by decomposing each operation into lookups against precomputed tables, rather than expressing everything as arithmetic constraints.

​
Why Lookups?

Traditional zkVMs represent CPU instructions (like multiplication, bitwise operations, etc.) as large arithmetic circuits. This is inefficient because:
  • Circuits for complex operations require many constraints
  • Proof size and verification time grow with circuit complexity
  • Adding new instructions requires designing new circuits
Jolt’s lookup-based approach offers several advantages:
  • Simplicity: Instructions decompose into table lookups rather than complex circuits
  • Speed: Lookups are proven using efficient sumcheck protocols
  • Extensibility: New instructions can be added by defining new lookup tables

​
The Lookup Singularity: Lasso

Jolt builds on Lasso, a breakthrough protocol for proving lookups in large tables. Lasso enables:
  • Sublinear proof size: Proofs are much smaller than the lookup table itself
  • Fast proving: The prover time scales with the number of lookups, not table size
  • Batch efficiency: Multiple lookups can be proven together
This “lookup singularity” makes it practical to prove millions of instruction executions efficiently.

​
Memory Checking: Twist and Shout

Beyond instruction execution, a zkVM must also prove correct memory and register behavior. Jolt uses Twist and Shout, a state-of-the-art memory checking protocol that:
  • Proves all memory reads return previously written values
  • Uses one-hot addressing for efficient encoding
  • Supports incremental updates for register state
  • Achieves 6x speedup over previous approaches

​
Architecture Components

​
RISC-V Support

Jolt currently supports the RV64IMAC instruction set:
  • RV64I: 64-bit Base Integer Instruction Set
  • M Extension: Integer Multiplication and Division
  • A Extension: Atomic Operations
  • C Extension: Compressed Instructions
This covers the core instructions needed for most general-purpose programs.

​
Tracer (Emulator)

The tracer is a RISC-V emulator that:
  • Executes the guest program (compiled as a RISC-V ELF binary)
  • Records every instruction cycle with full CPU state
  • Captures all memory and register accesses
  • Produces an execution trace as input to the prover
The trace contains a Cycle struct for each instruction, recording the program counter, instruction opcode, register values, and memory operations.

​
Cryptographic Primitives

Jolt combines several cryptographic building blocks:
  • Sumcheck protocol: Interactive proof protocol reduced to non-interactive via Fiat-Shamir
  • Multilinear polynomial commitments: Using Dory for transparent setup
  • BlindFold: Zero-knowledge layer that hides witness values (optional)

​
Polynomial Representation

All trace data is encoded as multilinear polynomials over the BN254 scalar field. Jolt uses specialized polynomial types:
  • DensePolynomial: Full field elements for standard data
  • CompactPolynomial: Small integers (u8-i128) promoted to field elements on-demand
  • RaPolynomial: Lazy materialization for read-after addresses
  • SharedRaPolynomials: Memory-efficient sharing of equality tables

​
Standard vs Zero-Knowledge Mode

Jolt can operate in two modes:

​
Standard Mode

  • Proves correctness of execution
  • Reveals sumcheck round polynomial coefficients
  • Faster proving with smaller proofs
  • Use case: Public computation verification

​
Zero-Knowledge Mode (BlindFold)

  • Proves correctness without revealing intermediate witness values
  • Uses Pedersen commitments for sumcheck rounds
  • Encodes verifier checks into R1CS proved via Nova folding
  • Use case: Private computation with hidden inputs/execution
The mode is controlled via the zk feature flag at compile time.

​
Performance Characteristics

​
Proof Generation

Prover time is dominated by:
  1. Sumcheck inner loops: Polynomial binding and evaluation
  2. Commitment generation: Dory polynomial commitments
  3. Memory checking: RAM and register read-write verification

​
Proof Size

Proof size scales with:
  • Number of sumcheck rounds (logarithmic in trace length)
  • Number of committed polynomials
  • Polynomial commitment openings
Typical proofs are a few hundred kilobytes for programs with millions of cycles.

​
Verification

Verification is fast (milliseconds) because:
  • Verifier only processes sumcheck challenges
  • Polynomial commitments use succinct verification
  • No need to re-execute the program

​
Key Papers

Jolt is based on cutting-edge research:

Build docs developers (and LLMs) love

Get started for freeTalk to us