$ show starkware-libs/stwo
This repository implements Stwo, a high-performance STARK proof system based on Circle STARKs (ePrint 2024/278) and the Stwo whitepaper. It is a Rust library providing a prover and verifier for zero-knowledge proofs over the Mersenne prime field M31 (p = 2^31 − 1) with extension fields CM31 and QM31. The architecture is modular: a core crate defines field arithmetic, FRI, polynomial commitment, and verification logic; a prover crate provides backend-agnostic proving with CPU and SIMD (AVX2/AVX-512, NEON, WASM) implementations; a constraint-framework crate offers a DSL for building AIR constraints and lookup arguments (LogUp, GKR). The system supports multiple hash channels (Blake2s, Poseidon252, Keccak256) and includes a no_std verifier suitable for on-chain deployment. Key entry points are `prover::prove()` and `core::verifier::verify()`. External dependencies include blake2, blake3, sha3, keccak, and starknet-crypto. The codebase is used in production by StarkWare's SHARP shared prover and by the Cairo VM prover (stwo-cairo). It demonstrates exceptional craftsmanship in SIMD optimization, field arithmetic, and protocol implementation, though it relies on nightly Rust and contains some unsafe code for performance.
The LLM identified 4 files worth highlighting for reuse:
Implements the M31 base field (p = 2^31 − 1) with arithmetic operations, including SIMD-optimized multiplication using platform-specific intrinsics (AVX2, AVX512, NEON, WASM) and a portable SIMD fallback. The modular reduction uses a partial_reduce/reduce pattern that avoids branching. This component is self-contained, depends only on core field traits, and can be extracted for any project requiring efficient M31 arithmetic.
Provides circle point arithmetic over M31 and its extensions, including point addition, negation (via conjugate), and coset operations. Implements the circle group law used in Circle STARKs. The implementation is mathematically rigorous and isolated, depending only on field traits. It can be reused in any protocol requiring circle group operations.
Defines the `EvalAtRow` trait and `ExprEvaluator` struct, which form a DSL for building AIR constraint evaluators. Supports masks, intermediate variables, logup enforcement, and relation tracking. The trait is polymorphic over backends (CPU/SIMD) and can be used to define constraint systems independently of the proving backend. This component is reusable for any STARK-based constraint system.
A proc-macro crate that auto-derives `Uninitialized`, `IterMut`, and `ParIterMut` traits for structs containing field vectors (e.g., trace columns). This eliminates boilerplate for initializing and iterating over columnar data structures. The derive macros are generic and can be applied to any struct with fields that implement the corresponding traits, making them reusable across different AIR components.