When Proofs Meet Hardware: Comparing NTT and SumCheck in Zero-Knowledge Systems
2026-06-15 • Hardware Architecture
Hardware Architecture
AI summaryⓘ
The authors compare two methods, SumCheck and Number Theoretic Transform (NTT), used in zero-knowledge proofs, focusing on how well they perform in hardware systems. They find that SumCheck is generally faster for very complex calculations, while NTT can be better for simpler tasks if there is enough memory to take advantage of data reuse. Their work is the first to directly evaluate these methods under the same hardware conditions, helping others understand when to use each method. They show there is no one best choice for all situations.
Zero-Knowledge ProofsSumCheck ProtocolNumber Theoretic Transform (NTT)zkSNARKsHardware AccelerationPolynomial DegreeOn-chip SRAMOff-chip BandwidthData ReuseZeroCheck Protocol
Authors
Jianqiao Mo, Alhad Daftardar, Barath GaneshKumar, Kaiyue Guo, Hong Wang, Benedikt Bunz, Siddharth Garg, Brandon Reagen
Abstract
In the ZKP community, it has long been discussed that the SumCheck protocol is asymptotically more efficient than the Number Theoretic Transform (NTT), requiring only $O(N)$ arithmetic versus $O(N \log N)$. At the same time, hardware accelerator designers propose that NTT is more hardware-friendly, benefiting from locality and data reuse, while SumCheck suffers from sequential, dependent rounds. Despite these competing intuitions, the hardware-system-level trade-offs between NTT- and SumCheck-based proving primitives remain insufficiently understood. Beyond individual accelerator design, this work presents, to our knowledge, the first hardware-system-level direct comparison of NTT- and SumCheck-based proving primitives under a unified architectural framework. We study them in the context of the ZeroCheck protocol, a common building block in zkSNARKs. We implement optimized systems for both primitives. Both are evaluated under the same level on-chip SRAM and off-chip bandwidth budgets. Our results show that there is no universal winner. Generally, SumCheck outperforms NTT for high-degree polynomials. For low-degree polynomials, performance depends on memory availability: under given SRAM budgets, NTT might deliver better performance for medium-sized workloads by exploiting data reuse. These findings, bridging cryptographic protocol design and hardware architecture, offer practical guidance for understanding the proving cost of NTT- and SumCheck-based zero-knowledge proof systems.