The Linea prover just got cheaper, faster and lighter.

We’ve reduced proof generation latency, a decisive step toward real-time proving, while significantly cutting RAM requirements. These gains come from a fundamental re-architecture of how we prove Ethereum state, with zero compromise on security. 

By transitioning from 252-bit “Large Fields” to 31-bit “Small Fields,” we’ve replaced heavy, legacy mathematical structures with a streamlined approach that leverages modern CPU architectures, while preserving the security guarantees institutional players require.

The Linea Stack Advantage

The foundational edge of the Linea Stack  lies in its arithmetization: the process of encoding execution traces into mathematical constraints. Historically, Linea utilized the 252-bit scalar field of the BLS12-377 elliptic curve. This choice was driven by historical compatibility and the existence of an efficient “2-chain,” a combination of curves discovered by our cryptography team (Youssef El Housni) that allowed for efficient recursive composition of PLONK proofs. However, these 252-bit elements, which consist of roughly 76 digits, carry significant computational weight. Using a 252-bit field for every basic transaction is the cryptographic equivalent of using a 3,000 page dictionary to look up a three-letter word. The overhead is simply disproportionate to the task.

To unlock vertical performance gains, we are transitioning to 31-bit Small Fields, specifically KoalaBear, a prime field SNARK-friendly thanks to its 2-adicity of 24, which is a critical requirement for accelerating Fast-Fourier Transforms (FFTs) - an operation that constitutes a significant portion of the prover workloads. 

A primary technical challenge in this transition is “Non-Native Arithmetic.” The EVM operates on 256-bit integers for logic and account balances. While a 252-bit field handles these with minimal friction, a 31-bit field requires slicing each 256-bit EVM word into sixteen field elements each storing a 16-bit limb.

While this sounds like more work, modern hardware is designed to handle 32-bit operations out-of-the-box. By leveraging AVX-512 instruction sets and vectorized MulHi/MulLo operations, we process these sixteen chunks in parallel.

There’s another, more fundamental advantage to Small Fields: field arithmetic scales super-linearly with field size. Doubling the size of a field more than doubles the cost of every multiplication. Shrinking from 252 bits to 31 bits therefore delivers performance gains far greater than the raw size ratio suggests.

Transitioning to small fields would have been prohibitively complex and time-consuming had we had to re-write the arithmetization (i.e. the constraints) from scratch to account for the new field and its reduced “capacity”. Avoiding a full re-write meant teaching our constraints-generating and tracing backend go-corset new tricks. We developed zkASM, a deep upgrade to our constraints writing language, which allows us to efficiently write high level constraints in a field agnostic way from the get-go. That is to say: from one implementation zkASM can generate constraints for any prime-field. For the remaining modules where a re-write was out of the question, we developed a solution allowing us to re-interpret existing constraints (so-called legacy constraints) for the chosen target field.

Who Benefits from Small Fields?

Small Fields will allow all those using Linea Stack to improve performance through technical optimization that drives the engine of economic value. By streamlining the mathematical foundation of the prover, we provide tangible advantages to every participant in the ecosystem:

⇒ Institutions and Enterprise: Reducing proof generation enables faster cross-layer interactions. This significantly shortens the withdrawal window and improves liquidity efficiency for enterprise-grade settlements.

⇒ Researchers and Developers: The upgrade introduces high-performance benchmarks, shifting hardware requirements toward consumer-grade CPUs and future-proofing the stack for GPU-readiness. The transition from Vortex proofs (optimized for speed) to aggregated PLONK proofs (optimized for size) is now more efficient, supported by a dual Apache/MIT licensing model that encourages open collaboration as it is open source. 

⇒ End Users: The direct benefit for many comes in the form of lower gas fees. Prover costs represented the majority of Linea’s operating expenses. By reducing the “mathematical electricity bill,” we pass those savings directly to the user through higher throughput and lower transaction costs.

Small Fields to Decentralize the Prover

Proving costs are the single largest line item in Linea’s operational budget. Reducing these costs is not merely about efficiency, it’s about decentralizing the prover role. The transition to Small Fields reduces the memory footprint of proof generation, enabling migration from expensive, centralized high-memory instances to a decentralized network of smaller, more accessible machines.

Using Small Fields poses a challenge to keep the proof system secure: as for other systems, the proof system of Linea internally relies on sampling random field elements as challenges for the prover. Using a random challenge from a field of ~256 bits provides enough guarantee that the prover cannot succeed by luck. However, this is not the case for a 31-bit as succeeding with probability >= 1/2³¹ is not low enough for cryptographic application.

To solve this without sacrificing the speed of 31-bit arithmetic, Linea employs field extensions. Today, we use a quartic extension, with a sextic extension planned further down the road. These extensions virtually recreate a much larger field at the verification stage, preserving the security level required for a multi-billion dollar network and institutional expectations.

By accelerating the finalization process and reducing hardware barriers, we are reinforcing our mission to scale Ethereum with no concessions on security or performance.