Hekate v0.30.0
Breaking release. Proofs are 30 to 50 percent smaller with no change to soundness or zero-knowledge. A post-quantum ML-DSA-65 proof drops from 5.0 to 3.4 MB, a Keccak proof from 1.3 MB to 642 KB. The size cut is pure margin: cheaper to store, faster to move over the wire, and lower cost anywhere a proof is transmitted or settled. The wire format and the Fiat-Shamir transcript both change, so proofs and bundles from 0.29.x no longer verify. Rebuild the prover cdylib (0.7.0) and re-prove.
Upgrade priority: high. Every program emits smaller proofs at no security cost, and the wire and transcript break means a migration is required either way.
§ What got smaller
Every proof shrinks, and multi-table programs (the post-quantum and Keccak circuits, which commit a main trace plus several chiplets) shed the most:
| Proof | Before | After | Smaller by |
|---|---|---|---|
| Keccak-f 2^15 | 1,312 KiB | 642 KiB | 51% |
| Keccak-f 2^20 | 5,156 KiB | 3,424 KiB | 34% |
| ML-DSA-44 | 5,139 KiB | 3,508 KiB | 32% |
| ML-DSA-65 | 5,156 KiB | 3,510 KiB | 32% |
| ML-DSA-87 | 8,620 KiB | 4,415 KiB | 49% |
| ML-KEM-768 | 4,232 KiB | 2,831 KiB | 33% |
| AES-128 | 3,405 KiB | 2,856 KiB | 16% |
The saving comes from two encoding changes, both free. The commitment now shapes its internal grid to each table's real row width instead of a one-size assumption, so wide circuits (Keccak, RAM) stop spending bytes they never needed; and the low-degree-test openings, previously one Merkle path per spot-check, collapse into a single shared proof per table with no duplicated data. There is no proving-time or memory regression, and the verifier does the same or less work.
§ No security tradeoff
The change is how proofs are laid out and opened, not what they prove. Soundness, zero-knowledge, the security level, and the size of every field element are unchanged. The new layout also tightens two internal checks: the commitment geometry is now bound into the transcript, so a misconfigured verifier fails fast at the right gate, and a malformed-proof parsing edge that could crash a 32-bit verifier is closed.
§ Breaking changes and upgrade
- Proofs and bundles. Wire format v2 and a changed transcript schedule: proofs and bundles from 0.29.x no longer verify or deserialize. Re-prove against this release; a proof is matched to the prover and verifier pair that produced it.
program_idis unchanged. Program definitions are untouched, so a program keeps its identity across the upgrade; only its proofs are re-emitted.- Prover cdylib 0.7.0, published and signed (SHA-256, Ed25519, and ML-DSA-65). Pair it with this release; an older cdylib emits proofs this verifier rejects.
- Version. Workspace 0.29.1 to 0.30.0.