# Oumuamua Labs

> Oumuamua Labs is a cryptography lab focused on privacy. We build Hekate to generate zero-knowledge proofs on mobile and edge, and Charon to aggregate them.

## Proving Stack

- [Hekate ZK Engine](https://oumuamua.dev/hekate): Write zero-knowledge programs in Rust and prove them in linear time and bounded memory over binary fields, with no trusted setup.
- [ZK Toolkit for iOS & Android](https://oumuamua.dev/mobile): Add zero-knowledge proofs to iOS and Android apps: on-device proving keeps private data on the phone, and one async Swift or Kotlin call returns the proof.
- [Charon ZK Engine](https://oumuamua.dev/charon): Compress zero-knowledge proofs from Hekate and aggregate any number of them into one fixed-size proof, checked once.

## Primitives

- [ML-DSA Verification](https://oumuamua.dev/primitives/signatures/mldsa.md): Verify post-quantum ML-DSA (Dilithium) signatures in zero knowledge at all FIPS 204 levels, many per proof, without revealing the key or the signature.
- [RSA-2048 PKCS#1 v1.5 Verification](https://oumuamua.dev/primitives/signatures/rsa.md): Verify RSA-2048 PKCS#1 v1.5 signatures with SHA-256 in zero knowledge: the modulus is public, the signature and the signed message stay private.
- [Keccak-f[1600]](https://oumuamua.dev/primitives/hashing/keccak.md): Prove SHA-3, SHAKE128 and SHAKE256 hashes in zero knowledge with a Keccak-f[1600] circuit; your program chains the sponge over the permutation calls.
- [SHA-256](https://oumuamua.dev/primitives/hashing/sha2.md): Prove SHA-256 hashes in zero knowledge: all 64 rounds of the FIPS 180-4 compression function per block, with padding and block chaining in your program.
- [ML-KEM Sender / Receiver](https://oumuamua.dev/primitives/encryption/mlkem.md): Prove post-quantum ML-KEM (Kyber) KeyGen, Encaps and Decaps in zero knowledge at all FIPS 203 levels, with keys and shared secrets kept private.
- [AES-128 and AES-256 Encryption](https://oumuamua.dev/primitives/encryption/aes.md): Prove AES-128 and AES-256 encryption in zero knowledge, key expansion included, with the key kept private and constant-time trace generation by default.
- [Binary Tower Fields](https://oumuamua.dev/primitives/math/binary-tower-fields.md): Binary tower fields from GF(2) to GF(2^256) in Rust, constant-time by default, PMULL on aarch64: the math core of the Hekate engine and its chiplets.

## Docs

- [Documentation](https://oumuamua.dev/hekate/docs.md): Hekate documentation: install the Rust zero-knowledge proof engine, write a first program, then learn its tables, chiplets, LogUp buses and prover.
- [Installation](https://oumuamua.dev/hekate/docs/getting-started/installation.md): Add Hekate to a Rust project: the open-source crates, the signed prover binary that hekate-prover-sys downloads and verifies, and the platforms it runs on.
- [Your First ZK Program](https://oumuamua.dev/hekate/docs/getting-started/your-first-zk-program.md): Write a private payment in Rust and prove it in zero knowledge: the note exists, is spent once and balances, while amounts, owners and the note stay hidden.
- [System Architecture](https://oumuamua.dev/hekate/docs/basics/system-architecture.md): How Hekate turns a Rust program into a zero-knowledge proof: tables and chiplets joined by LogUp buses, binary tower fields, and an open verifier.
- [Prover Engine](https://oumuamua.dev/hekate/docs/basics/prover-engine.md): How a zero-knowledge prover works, step by step in Hekate: commit to every table, prove the constraints with sumcheck, open the commitments, hide the witness.
- [AIR Constraints](https://oumuamua.dev/hekate/docs/basics/air-constraints.md): Write AIR constraints for Hekate zero-knowledge circuits in Rust: polynomials over two rows, selectors, boundaries, gadgets, degree and preflight reports.
- [Execution Trace](https://oumuamua.dev/hekate/docs/basics/execution-trace.md): Fill the execution trace of a Hekate zero-knowledge program in Rust: column types, power-of-two heights, padding rows, chiplet tables and wiping secrets.
- [Verifier Logic](https://oumuamua.dev/hekate/docs/basics/verifier-logic.md): Verify Hekate zero-knowledge proofs in Rust: pin the program id, read the result, and verify one proof, many with a prepared program, or a parallel batch.
- [LogUp Buses](https://oumuamua.dev/hekate/docs/basics/logup-buses.md): How LogUp buses connect the tables of a Hekate zero-knowledge proof: a multiset check as a sum of fractions, the binary-field trap, a bus of your own in Rust.
- [Cryptographic Chiplets](https://oumuamua.dev/hekate/docs/basics/cryptographic-chiplets.md): Use Hekate's cryptographic chiplets in Rust, from Keccak, SHA-256 and AES to RSA, ML-KEM and ML-DSA, or write your own: zero-knowledge tables called over buses.
- [Preflight](https://oumuamua.dev/hekate/docs/basics/preflight.md): Debug Hekate zero-knowledge circuits in Rust before you prove: check the witness against every constraint, read the report, and know what it misses.
- [PIOP Protocol](https://oumuamua.dev/hekate/docs/advanced/piop-protocol.md): How Hekate's polynomial IOP proves a table in zero knowledge: columns as multilinear polynomials, sumcheck down to one point, a hash-based commitment.
- [Zero Knowledge](https://oumuamua.dev/hekate/docs/advanced/zero-knowledge.md): How Hekate's zero-knowledge proofs hide the witness: one-time pads on rounds, claims and bus sums, a hiding hash-based commitment, a zk-Ligero outer argument.
- [Soundness and Security](https://oumuamua.dev/hekate/docs/advanced/soundness-and-security.md): What a Hekate zero-knowledge proof guarantees: the terms behind its 100 bits of soundness, Fiat-Shamir binding, forgery tests and the checks left to you.
- [Benchmarks](https://oumuamua.dev/hekate/benchmarks.md): Proving time, verification, proof size and peak memory for ML-DSA, ML-KEM, AES, Keccak, SHA-256 and RSA in Hekate, with the commands to reproduce each run.
- [Releases](https://oumuamua.dev/hekate/releases): Hekate releases: signed prover binaries for macOS, Linux, iOS and Android, and the open-source Rust workspace, with release notes and an Atom feed for each.
- [Pricing](https://oumuamua.dev/hekate/pricing.md): Hekate's open code is AGPL-3.0-only; its signed prover binary is free. A product shipped under other terms, open source or closed, needs a commercial license.
- [Hekate Swift](https://oumuamua.dev/mobile/swift.md): On-device zero-knowledge proofs on iOS: one async Swift call runs your Rust prover in a detached task, and Task.cancel() reaches Rust.
- [Hekate Kotlin](https://oumuamua.dev/mobile/kotlin.md): On-device zero-knowledge proofs on Android: one suspend Kotlin call runs your Rust prover on a dispatcher you choose, and Job.cancel() reaches Rust.
- [Mobile ZK Benchmarks](https://oumuamua.dev/mobile/benchmarks.md): Mobile zero-knowledge proof benchmarks: proving time, proof size and peak memory for ML-DSA (Dilithium), RSA-2048, Keccak-256 and SHA-256 proofs.
- [Primitives](https://oumuamua.dev/primitives.md): Hekate chiplets that prove ML-DSA, ML-KEM, AES, Keccak-f[1600], SHA-256 and RSA-2048 PKCS#1 v1.5 inside zero-knowledge proofs over binary tower fields.
- [About Oumuamua Labs](https://oumuamua.dev/about): Oumuamua Labs is an applied cryptography research lab focused on privacy: zero-knowledge proving systems that run on the user's own device.

## Blog

- [Zero-knowledge proofs on mobile: Hekate's first benchmarks](https://oumuamua.dev/blog/zk-on-mobile-benchmarks.md): How long a zero-knowledge proof takes on a phone: 1.34 s for a post-quantum ML-DSA (Dilithium) signature, 1.02 s for a private payment, on an iPhone 14 Pro Max.
- [One Tensor Commitment for Tables of Every Height](https://oumuamua.dev/blog/one-tensor-commitment.md): Every table of a multi-table AIR proof in one tensor commitment: one fold vector, one query set, one sumcheck, and t + 1 support cells for unsalted leaves.
- [One support cell short](https://oumuamua.dev/blog/postmortem-0-37.md): Hekate 0.37.0 postmortem: in 0.35.0 and 0.36.0, a zero-knowledge proof could confirm a guess of its own witness. The fix costs one field element per proof.
- [Columns only the bus read](https://oumuamua.dev/blog/postmortem-0-36.md): Hekate 0.36.0 postmortem: five soundness gaps, three with forgeries that 0.35.0 accepted, and the ordered service buses that close them.
- [The estimate that chose its own geometry](https://oumuamua.dev/blog/postmortem-0-35.md): Hekate 0.35.0 postmortem: the security level was overstated, and 0.35.0 restates it at 100 bits that follow from published theorems. No forgery is known.
- [Liveness was a witness](https://oumuamua.dev/blog/postmortem-0-34.md): Hekate 0.34.0 postmortem: the prover decided whether a block existed, and the same decision switched off the constraints that policed it.
- [Zero-Knowledge Ring-Switching without the Transpose](https://oumuamua.dev/blog/zk-ring-switching.md): Ring-switching made zero-knowledge: over a binary field of degree n, the correction costs n − 1 multiplication constraints for any number of batched claims.
- [Shapes the honest prover never builds](https://oumuamua.dev/blog/postmortem-0-33.md): Hekate 0.33.0 postmortem: seven soundness gaps across the Keccak and AES chiplets. Both computed their round functions correctly; neither proved its cipher.
- [Three unbound values](https://oumuamua.dev/blog/postmortem-0-32.md): Hekate 0.32.0 postmortem: three soundness failures found in our own prover, two of them total breaks confirmed with a proof-of-concept prover.

## Optional

- [hekate on GitHub](https://github.com/oumuamua-labs/hekate)
- [hekate-mobile on GitHub](https://github.com/oumuamua-labs/hekate-mobile)
- [hekate-math on GitHub](https://github.com/oumuamua-labs/hekate-math)
- [hekate-pqc on crates.io](https://crates.io/crates/hekate-pqc): API reference at https://docs.rs/hekate-pqc
- [hekate-aes on crates.io](https://crates.io/crates/hekate-aes): API reference at https://docs.rs/hekate-aes
- [hekate-keccak on crates.io](https://crates.io/crates/hekate-keccak): API reference at https://docs.rs/hekate-keccak
- [hekate-sha2 on crates.io](https://crates.io/crates/hekate-sha2): API reference at https://docs.rs/hekate-sha2
- [hekate-rsa on crates.io](https://crates.io/crates/hekate-rsa): API reference at https://docs.rs/hekate-rsa
- [hekate-math on crates.io](https://crates.io/crates/hekate-math): API reference at https://docs.rs/hekate-math