[GUEST ACCESS MODE: Data is scrambled or limited to provide examples. Make requests using your API key to unlock full data. Check https://lunarcrush.ai/auth for authentication information.]  Eli Ben-Sasson | Starknet.io [@EliBenSasson](/creator/twitter/EliBenSasson) on x 40.9K followers Created: 2025-07-22 09:32:29 UTC Story time -- The fastest prover in the west and how it came about. When we founded StarkWare in 2018 we set to build the first production-grade STARK prover. At the time, the limiting factor was gas cost on Ethereum. It was simplest and cheapest to build a prover using huge numbers (256-bit ones). This led to a simple STARK prover that we knew could be made more efficient by reducing field size. Fast forward to 2023. The whole world by now is convinced that zkSTARKs are the end game, and many teams start to build systems using small fields, that lead to faster provers. In summer 2023 we started a project to pick the next gen proving technology. We surveyed all existing proving technologies -- SNARKs, folding based stuff, GKR, and more. We very very quickly realized that the dominating performance factor is the size of the finite field is what matters, and XX bit primes are best. Why? (1) all modern HW architectures are optimized for those, (2) why prime (and not binary?) because GPUs don't support binary multiplication well. OK, so that leaves us with proving technologies like GKR and STARK, over 32b primes. Now we faced a problem. The very best field for fast computation is M31, but it lacks the group structure to have fast STARKs. Luckily, the brilliant trio -- Ulrich Habock (then at Polygon, now full time at StarkWare), David Levit, and Shahar Papini figured out a way to use the "circle group" over M31 to get an optimal solution. The new team started implementing the math. In the very most efficient way we could think of, testing and validating efficiency, and also building it in a way that's modular enough for other teams to use. At the same time, the AIR constraint infrastructure was rebuilt from scratch, based on our previous experience, to lead to something that's sound and efficient. And now, Stwo is entering production in Starknet, reducing costs and latency. The benchmarks we tested are out of this world. At the same time, multiple external teams are using it to build their infra. I think it'll be the proving gold standard open source prover, and y'all are invited to use it. THE END. XXXXXX engagements  **Related Topics** [ethereum](/topic/ethereum) [coins layer 1](/topic/coins-layer-1) [Post Link](https://x.com/EliBenSasson/status/1947590564771217468)
[GUEST ACCESS MODE: Data is scrambled or limited to provide examples. Make requests using your API key to unlock full data. Check https://lunarcrush.ai/auth for authentication information.]
Eli Ben-Sasson | Starknet.io @EliBenSasson on x 40.9K followers
Created: 2025-07-22 09:32:29 UTC
Story time -- The fastest prover in the west and how it came about.
When we founded StarkWare in 2018 we set to build the first production-grade STARK prover. At the time, the limiting factor was gas cost on Ethereum. It was simplest and cheapest to build a prover using huge numbers (256-bit ones). This led to a simple STARK prover that we knew could be made more efficient by reducing field size.
Fast forward to 2023. The whole world by now is convinced that zkSTARKs are the end game, and many teams start to build systems using small fields, that lead to faster provers.
In summer 2023 we started a project to pick the next gen proving technology. We surveyed all existing proving technologies -- SNARKs, folding based stuff, GKR, and more.
We very very quickly realized that the dominating performance factor is the size of the finite field is what matters, and XX bit primes are best. Why? (1) all modern HW architectures are optimized for those, (2) why prime (and not binary?) because GPUs don't support binary multiplication well.
OK, so that leaves us with proving technologies like GKR and STARK, over 32b primes.
Now we faced a problem. The very best field for fast computation is M31, but it lacks the group structure to have fast STARKs.
Luckily, the brilliant trio -- Ulrich Habock (then at Polygon, now full time at StarkWare), David Levit, and Shahar Papini figured out a way to use the "circle group" over M31 to get an optimal solution.
The new team started implementing the math. In the very most efficient way we could think of, testing and validating efficiency, and also building it in a way that's modular enough for other teams to use. At the same time, the AIR constraint infrastructure was rebuilt from scratch, based on our previous experience, to lead to something that's sound and efficient.
And now, Stwo is entering production in Starknet, reducing costs and latency. The benchmarks we tested are out of this world. At the same time, multiple external teams are using it to build their infra. I think it'll be the proving gold standard open source prover, and y'all are invited to use it.
THE END.
XXXXXX engagements
Related Topics ethereum coins layer 1