Summary
A zkVM lets a developer prove the execution of a program rather than design a separate circuit for every application. RISC Zero and SP1 document workflows for compiling programs, generating proofs and verifying results. The name does not guarantee that every available proof format hides the execution witness.
How it works
The prover executes a guest program with its inputs and generates a proof. The verifier checks the proof against an expected program identity and interprets its public outputs. Approving the program identity is essential: successful verification of somebody else's program does not establish your intended claim.
| Question | RISC Zero | SP1 |
|---|---|---|
| What identifies the program? | An image ID, checked when verifying a receipt | A program verification key, or its hash in the documented external verifier interface |
| What is public? | The receipt's journal contains public program outputs | The program commits public values, supplied to verification |
| What does the prover receive? | The guest program and its execution inputs | The compiled program and input stream used for execution |
| Where can proving run? | Local CPU/GPU, or remote proving through Boundless | Local proving, or the Succinct Prover Network |
| Which privacy caveat matters? | Development mode generates no real proof | The security model says individual STARK proofs are not zero-knowledge; its Groth16 and PLONK implementations are |
The RISC Zero receipt guide and SP1 verification guide describe the verifier interfaces. Pin the program identity through your own build or a trusted distribution channel, then validate the meaning of the public result.
Trust model / threat model
Private from whom? Data omitted from public outputs may be hidden from the proof recipient in an appropriate zero-knowledge mode. It is still available to the machine doing the proving. RISC Zero explicitly recommends local proving for private inputs. The Succinct network assigns requests to third-party provers; outsourcing therefore changes who receives the witness.
Correct execution is a narrow claim. SP1's security model requires applications to validate private inputs and hints. A proof does not authenticate an external data source or repair an unsafe program. Bind the expected dataset, authorization rules and requested operation into the statement your verifier accepts.
Readiness
Usable for supported developer workflows. Both projects document proving and verification APIs. This is not a blanket rating of every program, proof mode or network service. Review the chosen backend's security assumptions, including any setup ceremony, and benchmark the actual workload.
Limits
Proving cost and verification cost are different budgets. SP1 documents trade-offs between core, compressed and wrapped proofs; there is no workload-independent speed ranking here. Use private computation compared to decide whether you need a proof, confidential execution, or both.
Primary sources
- RISC Zero receipts and image IDs
- RISC Zero proof-generation options
- SP1 proving basics
- SP1 off-chain verification
- SP1 proof types
- SP1 security model
- Succinct Prover Network
Also in Decentralized Compute
Page history
- Updated
- 2026-10-25
- Origin
- Written for ungovernable.tech.
- Improve this page
- Suggest an edit — issues and pull requests are welcome.