Proving Stack · 03 Wrap and accumulate
Charon ZK Engine
Compress zero-knowledge proofs from Hekate and aggregate any number of them into one fixed-size proof, checked once.
Charon takes the proofs Hekate makes on phones and edge devices and makes them cheap to keep and to check in bulk. It wraps each proof into a smaller form and accumulates any number of wrapped proofs into one result that keeps the same size. Charon will be provided as SaaS.
§ Why a second engine
Hekate proves where the data lives: on a phone, in linear time and bounded memory. Its Brakedown commitment is what makes that fast, and it is also what makes each proof large. A backend that receives proofs from many devices stores and verifies every one of them.
§ Wrap
Charon takes a Hekate proof together with its program bundle and commits to it again, with Reed-Solomon commitments over an additive-FFT domain and FRI folding. The wrapped proof is smaller, and it is the input the accumulator takes.
§ Accumulate
Accumulation folds wrapped proofs, one after another, into a fixed circuit. The result keeps the same shape however many proofs went in, and checking it costs the same: one check covers the batch.
- 01
Sign
Users sign with post-quantum ML-DSA.
- 02
Prove on the device
Hekate and the ML-DSA chiplet prove each signature verification.
- 03
Wrap and accumulate
Charon wraps each proof and accumulates a day of them.
- 04
Check once
An auditor checks one result.
Take a service whose users sign with post-quantum ML-DSA. Each device proves its signature verification with Hekate and the ML-DSA chiplet. Charon wraps each proof and accumulates a day of them into one result, which an auditor checks once.