A battle of titans: Cairo vs Noir
Welcome to the wonderful world of ZK DSLs! Here we’ll stage an epic battle between two recent ZK DSLs: Cairo and Noir.
Ok, not a battle. And maybe it’s not so epic. But at least we’ll have Cairo and Noir!
Just in case you’re not sure what that means: this post will be about comparing various DSLs (Domain Specific Languages) for writing proof circuits for Zero Knowledge systems. Well, that’s a mouthful.
We’re not going to measure performance or present user adoption figures. This is also not a deep technological analysis of how the languages work. The aim is to give a general overview of how the languages are used, what their differences are and, most importantly, where they can be used.
So why these DSLs?
There are plenty more ZK DSLs out there, such as Circom, Zokrates or Cairo version 0. However, I consider those to belong to an earlier generation of ZK DSLs. The languages shown here are at a different abstraction layer and somewhat more interesting.
The problem with earlier languages is that you need to understand quite much about how the underlying ZK system works. For example, with Circom, you need to explicitly distinguish between constraint generation and variable assignment — and most people have no idea what that even means. Modern languages abstract out most of the ZK-specific issues, so the developer mostly doesn’t even need to know that they’re writing code for a ZK circuit.
Since this post is being written by a somewhat real human, instead of an AI, the author has only limited experience using various ZK DSLs. It makes sense to choose DSLs with which the author has experience. But honestly, Cairo1 and Noir also seem to be the two main emerging languages.
But first, a bit of history
Despite their young age, the languages already have some interesting histories. Let’s have a peek!
The Cairo language (version 0) was first introduced by StarkWare in 2020. In the beginning, it was used to write circuits for StarkEx products — those are each app-specific, isolated L2 networks. It was all based on a Python compiler, and the language itself was heavily Pythonic. Around the middle of 2022, a new version of Cairo (version 1) was announced: a total revamp of the old language into a Rust-like syntax, supporting most regular language functionalities, such as loops.
Noir was introduced by Aztec in 2022 to write stand-alone circuits. It’s also very Rust-like and supports most regular language functionalities. The first version was used for stand-alone ZK programs, but the language is rapidly evolving to support more use cases.
Basic usage
The basic use for all ZK DSLs is to write circuits for stand-alone programs. Circuits are programs that generate circuit-specific proofs for arbitrary inputs.
A stand-alone ZK program can be used, for example, to prove that you have correctly computed some complicated calculation. Such programs don’t interact with any external data besides their explicit inputs. Both of our languages support this kind of use.
Modern DSLs, Cairo1 and Noir included, compile into an intermediary format. With Cairo, intermediary format is designed to be an abstraction layer for a Stark-based system. Noir has a similar intermediary layer, but it enables wider usage than Cairo: circuits written in Noir can be reused with any Snark-based proving system. Sweet!
Privacy
Now we’re getting somewhere — privacy is one of the main differences.
Zero Knowledge technology can be used for different purposes. In a blockchain environment, one of the uses is to scale computation (transaction throughput). Another use is privacy. So utilizing Zero Knowledge technology doesn’t magically add privacy to all interactions — privacy is a feature that requires extra effort.
Cairo program executions can be batched and proved together to greatly boost the throughput of the system. This is the main use of Cairo: to enable its respective L1 (Ethereum) to scale. Cairo by itself doesn’t provide much privacy.
Noir, on the other hand, has privacy built in by default. You can declare any inputs as private or public, and this applies also to circuits used in the future, interoperable Aztec network. Furthermore, Noir circuit executions can also be batched for efficiency.
Ecosystems
This is where things get really interesting. Stand-alone ZK programs are boring. We should have them interact with each other!
For Cairo, there is a Layer 2 network called Starknet, introduced in 2021. Data inside Starknet is public. Contracts can interact asynchronously with the underlying L1 network (Ethereum).
Aztec is knee-deep in developing its own Aztec network, which allows Noir contracts to interact with each other. A public testnet is expected towards the end of 2023 and all data can be declared public or private. Contracts can interact synchronously with the underlying L1 network (Ethereum).
But wait. Did you notice the one letter difference between how the two ecosystems interoperate with their L1? Asynchronously vs synchronously. It’s a huge difference. A Noir contract in the Aztec network can, for example, call a L1 DeFi contract to execute a trade and receive the assets back — all in one transaction. Now that’s cool!
Developer experience
Since both languages are Rust-based, the code should look mostly familiar if you’re fluent in Rust. But since we’re living in the ZK land, traditional Rust tools, such as syntax highlighters, are useless. Fortunately, for Visual Studio Code, there exist a custom highlighter for both languages.
Noir comes with its own package manager (Nargo) which manages quite a few phases of the development process. It even generates a Solidity verifier contract for you, if needed. You can then deploy the verifier contract on any EVM blockchain to verify your proofs.
Since both languages (or, more precisely, their interoperability networks) are bound to the L1 EVM, some of the available tooling is already familiar to EVM developers. For example, Hardhat can be used with both languages, to some extent.
Noir seems to rely quite heavily on its in-house-built Nargo library, and there aren’t as many external tools available as there are in the Cairo ecosystem. Cairo has multiple external tools available to manage packages, unit testing, local test networks, and so on.
Production readiness
Cairo1 can be used in Starknet mainnet (which uses L1 mainnet), although the language itself is still under heavy development.
Noir is similarly under heavy development, but its Aztec network isn’t ready yet. Therefore, only the stand-alone variant of Noir can currently be used in production.
That being said, I would currently be very cautious about using either of these languages in production. Audit companies have very little experience auditing these new languages, and new features are added to the languages at fast intervals. It’s tempting to always just wait a little bit longer to get the next cool feature in use before freezing your code.
Final thoughts
All ZK DSLs are new. The whole field is new. Everything is still a bit rusty (or, Rusty), but things are improving at a rapid speed.
I also have to apologize that I didn’t include Mina’s JavaScript-based ZK DSL here, or Aleo’s new Leo ZK DSL. Both are super cool, but at least Leo is still in its very early stages. And there are plenty of other modern languages out there — I just don’t have any experience using them.
We’re sure to see more new ZK languages in the near future, and possibly some existing ones will slowly die out. One has to stay super sharp to keep up with all the recent developments — no napping!
About the author
The author started with EVM development some 5+ years ago and started fiddling with the first versions of Cairo in 2021. After that, moved to research various other ZK ecosystems (such as Aztec) and to try out their languages.
Questions? Comments? Bashing? Feel free to poke in Twitter or Telegram.
