← → Print all
01 — Proof system · Proof system

STIR and WHIR

Hash-based low-degree tests

In one paragraph

STIR and WHIR: Hash-based low-degree tests. Setup: None. Proof size: Markedly smaller than FRI at equal security. On-chain verification: Impractical directly. PQ: Plausibly. Recursion: Inherits FRI approaches. Maturity: Research maturing into implementation. Prover cost profile: Comparable to FRI; the WHIR prover is somewhat heavier. Peak prover memory: As FRI. Off-chain verifier: Sub-millisecond for WHIR in the authors' reported settings. Implementations and maintainers: Reference implementations by the authors; integrations into production hash-based stacks under way. Where it is measured: Authors' comparisons only; measure on your own parameters. Choose it when: Replacing FRI where hash-based proof size or verifier latency is the binding constraint, for teams who will follow the literature.

By MarketComp Updated v1.3 About the authors Changelog
Setup
None
Proof size
Markedly smaller than FRI at equal security
On-chain verification
Impractical directly
PQ
Plausibly
Recursion
Inherits FRI approaches
Maturity
Research maturing into implementation
Selection matrix · as STIR / WHIR · see the row in context
Prover cost profile
Comparable to FRI; the WHIR prover is somewhat heavier
Peak prover memory
As FRI
Off-chain verifier
Sub-millisecond for WHIR in the authors' reported settings
Implementations and maintainers
Reference implementations by the authors; integrations into production hash-based stacks under way
Where it is measured
Authors' comparisons only; measure on your own parameters
Prover profile · as STIR / WHIR · see the row in context

What it is

Two successors to FRI from the same research lineage. STIR reduces query complexity by recursively improving the rate of the tested code; WHIR builds on constrained Reed–Solomon codes to give very fast verification, and doubles as a polynomial commitment.

Strengths and tradeoffs

Strengths
  • Concretely smaller proofs than FRI at equal security — roughly half, in the authors' reported comparisons
  • WHIR verification is reported in hundreds of microseconds where prior hash-based verifiers took milliseconds
  • Public reference implementations exist and integration into production stacks is under way
Tradeoffs
  • Newer analyses and fewer independent implementations than FRI
  • The most aggressive parameterisation relied on an up-to-capacity conjecture disproved for large fields in late 2025; Johnson-bound parameters are unaffected but the optimistic discount is not available as originally stated
  • Requires a team able to track fresh cryptanalysis

Choose it whenReplacing FRI where hash-based proof size or verifier latency is the binding constraint, for teams who will follow the literature.

Maintained implementations

Arnon, Chiesa, Fenzi and Yogev (2024). Reference implementations by the authors; integrations at several hash-based zkVM teams

Maturity: Research maturing into implementation · License: n/a (construction) · eprint.iacr.org ↗

How to decide
Other proof systems in §01
Groth16PLONK and the PLONKish familyFRI-based STARKsHalo2 with IPA, and Halo2 with KZGNova, SuperNova and HyperNovaBinius and binary-field systemsGKR-based systemsSpartanBulletproofsLookup arguments: Plookup, LogUp, cq, Lasso/Shout/Twist

Sources cited on this page · 2

  1. STIR — Reed–Solomon proximity testing with fewer queriespaper
  2. WHIR — Reed–Solomon proximity testing with super-fast verificationpaper

All 40 sources for §01 are listed on the section page →

Cite this page 
MarketComp (2026). STIR and WHIR. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/proof-systems/stir-whir/
@misc{zkfieldmanual-stir-and-whir,
  title        = {STIR and WHIR — The ZK Field Manual},
  author       = {MarketComp},
  year         = {2026},
  version      = {1.3},
  howpublished = {\url{https://zkpick.com/proof-systems/stir-whir/}},
  note         = {Accessed: YYYY-MM-DD}
}