Xprove: Verifiable Computation

Executive Summary

xProve bridges the gap between "we computed this privately" and "here is cryptographic proof the computation was honest." Multi-party computation produces answers, but answers without proof require trust. In regulated industries — insurance, healthcare, finance, government — trust is not enough.

Xprove generates cryptographic proofs that xCompute evaluations were performed correctly. The verifier learns that the result is correct — nothing else. No access to the underlying data, shares, or intermediate values. The computation can be verified in logarithmic time without re-execution.

Key insight: XorIDA operates over GF(2), and GF(2) is the native field for binary-tower STARK proofs. This is not a coincidence to be ignored. XOR is free in xCompute (zero communication) and free in the proof system (linear constraint). AND gates are the only non-trivial constraint in both systems. The cost structures align perfectly.

This structural alignment means xProve proofs for xCompute circuits are 10–50x more efficient than encoding the same circuits into prime-field proof systems (which waste 30–255x space per bit).

Developer Experience

Xprove provides real-time progress tracking and structured error codes to help developers build reliable, auditable verification systems.

Progress Callbacks

Both prove() and verify() operations support onProgress callbacks for tracking long-running proof generation and verification, especially useful for Tier 4 zero-knowledge proofs.

import { prove, verify } from '@private.me/xprove';

// Generate proof with progress tracking
const proofResult = await prove({
  tier: 4,
  circuit,
  witness,
  onProgress: async (event) => {
    switch (event.stage) {
      case 'hashing':
        console.log('Computing commitment tree...');
        break;
      case 'proving':
        console.log(`Generating proof ${event.current}/${event.total}...`);
        break;
      case 'complete':
        console.log('Proof generated successfully');
        break;
    }
  }
});

// Verify with progress tracking
const result = await verify(proofResult.value, {
  onProgress: async (event) => {
    if (event.stage === 'verifying') {
      console.log(`Checking proof constraint ${event.current}...`);
    }
  }
});

Structured Error Handling

Xprove uses a Result<T, E> pattern with detailed error structures. Every error includes a machine-readable code, human-readable message, actionable hint, and documentation URL.

interface ErrorDetail {
  code: string;         // e.g., 'PROOF_FAILED'
  message: string;      // Human-readable description
  hint?: string;        // Actionable suggestion
  field?: string;       // Field that caused the error
  docs?: string;        // Documentation URL
}

Error Categories

Xprove organizes 5 error codes across distinct verification failure modes:

The Problem

xCompute produces answers. But answers without proof require trust. In regulated industries, trust is not enough.

Multi-party computation lets organizations compute on private data without revealing it. But the output arrives with a fundamental question: how do you know the computation was done correctly?

Today, the participants must either trust each other, trust the compute infrastructure, or re-run the computation themselves (which defeats the purpose of delegation). In regulated industries — insurance, healthcare, finance, government — a third party (regulator, auditor, court) needs assurance that the result is correct, without accessing the underlying data.

This is the verifiable computation gap: the space between "we computed this privately" and "here is cryptographic proof the computation was honest."

Without xProve

Use Cases

Xprove enables verifiable computation across regulated industries where auditors, regulators, and counterparties need cryptographic proof that private computations were performed correctly.

How It Works

Xprove provides four verification tiers, each offering different tradeoffs between proof size, generation cost, and security guarantees. All tiers verify that xCompute circuits were evaluated correctly.

Verification Tiers

Choose the tier that matches your threat model and performance requirements:

Integration

Xprove integrates directly with xCompute circuits. Enable verification by specifying a tier in your compute configuration.

import { createCircuit } from '@private.me/xcompute';
import { prove, verify } from '@private.me/xprove';

// Define circuit (fraud detection example)
const circuit = createCircuit({
  inputs: { claimA: 256, claimB: 256 },
  gates: [
    { type: 'XOR', in: ['claimA', 'claimB'], out: 'diff' },
    { type: 'POPCOUNT', in: ['diff'], out: 'distance' }
  ],
  output: 'distance'
});

// Execute computation with Tier 3 verification
const result = await circuit.evaluate({
  claimA: data1,
  claimB: data2,
  tier: 3  // Enable IT-MAC proofs
});

// Generate proof
const proofResult = await prove({
  tier: 3,
  circuit,
  witness: result.witness,
  publicOutput: result.value
});

// Auditor verifies (no access to inputs)
const verification = await verify(proofResult.value, {
  circuit,
  publicOutput: result.value
});

if (verification.ok) {
  console.log('Computation verified: result is correct');
}

Proof Bundle Structure

All tiers produce a ProofBundle that can be serialized and sent to external verifiers:

interface ProofBundle {
  tier: 1 | 2 | 3 | 4;
  circuitHash: Uint8Array;    // SHA-256 of circuit structure
  publicOutput: Uint8Array;   // Final result (revealed)
  proof: Uint8Array;          // Tier-specific proof data
  metadata?: {
    timestamp: number;
    sessionId: string;
    proofSize: number;
  };
}

Security Properties

Each verification tier provides different security guarantees. Understand the threat model before selecting a tier.

Performance

Benchmark results for fraud detection circuit (256-bit claim comparison, 512 AND gates). Measured on M1 Pro (8-core, 16GB RAM). All timings in milliseconds.

Scaling Characteristics

Honest Limitations

Xprove is production-ready for regulated industries, but has known limitations you should understand before deployment.

1. Proof Generation Cost (Tier 4)

Zero-knowledge proofs (Tier 4) are 10–40x slower to generate than IT-MAC proofs (Tier 3). For large circuits (>10K gates), proof generation can take seconds to minutes. If your threat model does not require full zero-knowledge, use Tier 3 — it provides malicious security and verifier privacy at much lower cost.

2. Circuit Preprocessing

All tiers require the circuit to be converted to a Boolean gate representation (AND/XOR/NOT). Arithmetic circuits (e.g., range checks, comparisons) incur overhead during this conversion. For arithmetic-heavy workloads, consider plonky2 or similar prime-field proof systems — they handle arithmetic natively.

3. No Universal Proving

Xprove does not support universal proving (one-time setup, prove any circuit). Each circuit requires its own proof generation. If you need to prove arbitrary programs without circuit specification, consider VM-based proof systems (e.g., RISC Zero, SP1).

4. Verification Time (Tier 1–3)

Tiers 1–3 verification time is linear in circuit size — O(n) for n gates. For very large circuits (>100K gates), verification can take hundreds of milliseconds. Tier 4 offers O(log n) verification but at the cost of slower proof generation.

5. Soundness Error (Tier 3)

Tier 3 IT-MAC has statistical soundness with error probability 2⁻⁴⁰. This is sufficient for most regulated use cases but not for cryptographic applications requiring 128-bit security. For higher soundness, use Tier 4 with KKW (computational soundness 2⁻¹²⁸).

Enterprise CLI

Self-hosted verification server. Docker-ready. Air-gapped capable. Port 3400. 68 tests. Part of the Enterprise CLI Suite.

@private.me/xprove-cli provides a production-grade verifiable computation server with full REST API, proof generation, verification, and tier-based proof mode selection (T1-T4). Integrates the complete @private.me/xprove package for enterprise deployments.

CLI Commands

# Start the Xprove verification server
xprove serve --port 3400
  → HTTP server on :3400 with proof generation + verification

# Generate a Tier 3 proof (IT-MAC)
xprove prove --circuit "circuits/transfer.json" --witness "witness.json" --tier 3
  → Generates IT-MAC proof, returns serialized proof bundle

# Verify a proof
xprove verify --proof "proof.json" --circuit "circuits/transfer.json"
  → Verifies proof, returns true/false + timing

# Generate KKW zero-knowledge proof (Tier 4)
xprove prove --circuit "circuits/audit.json" --witness "witness.json" --tier 4 --zkmode "kkw"
  → Generates ~50KB KKW proof (vs 880KB ZKBoo)

# Benchmark proof generation
xprove benchmark --circuit "circuits/compliance.json" --tiers "1,2,3,4"
  → Runs proof generation for all tiers, reports timings

# Validate circuit format
xprove validate --circuit "circuits/risk-check.json"
  → Checks circuit structure, gate types, input/output bindings

Docker Deployment

# Pull and run the Xprove verification server
docker compose up -d xprove

# Verify health
curl http://localhost:3400/health
# {"status":"ok","version":"0.1.0","uptime":42}

# Air-gapped deployment
docker save private.me/xprove-cli > xprove-cli.tar
# Transfer to air-gapped environment
docker load < xprove-cli.tar
docker compose up -d

Full ACI Surface

Xprove exposes 5 primary functions. All functions return Result<T, E> and support optional progress callbacks.

Error Taxonomy

Xprove defines 5 error codes across configuration and tier-specific verification failures. All errors include actionable hints and documentation URLs.

Error Detail Structure

All errors include structured metadata for debugging and user-facing error messages:

{
  "code": "PROOF_FAILED",
  "message": "ZKBoo proof verification failed",
  "hint": "Computation may be incorrect. Request new proof from prover.",
  "field": "proof",
  "docs": "https://private.me/docs/packages/xprove#tier4"
}

Codebase Statistics

Xprove is a focused verification library. All 4 tiers plus KKW variant implemented in 2,839 lines of TypeScript across 8 source files.

Module Breakdown