# Miden verifier
This crate contains a light-weight verifier for proofs of program execution generated by Miden VM.
While the [Miden](../miden-vm) crate also contains verifier functionality, this crate may be more
appropriate for projects that only need verification.
## Usage
Use `Verifier::new().verify(&claim, &proof)` to verify a deferred or complete `ExecutionProof`
against its `ExecutionClaim`. The claim contains the program information and public stack inputs and
outputs. The VM STARK authenticates the precompile root in either state. For a deferred proof, the
verifier evaluates the portable witness and checks its root. The outcome exposes the
authenticated root and VM security parameters. For a complete proof, the verifier also checks the
aggregate precompile STARK when present and returns its security parameters.
Use `Verifier::new().verify_precompile(&proof, expected_root)` to validate a `PrecompileProof`
without first attaching it to an execution proof. It checks the expected-root membership and full
ordered aggregate statement, verifies the precompile STARK, and returns its authenticated security
parameters.
Stack inputs are in push order (the last value is on top), while stack outputs are in pop order (the
first value is on top).
`Verifier::verify` returns a `VerificationOutcome` containing the authenticated security parameters
of each STARK component actually verified. Use
`Verifier::new().with_min_conjectured_security_level_per_stark(required_bits)` to require a minimum
conjectured security level for each STARK, including standalone `verify_precompile` calls. The VM's
authenticated parameters are checked before native deferred-witness evaluation; complete proofs
also check the precompile STARK's authenticated parameters. A level equal to the minimum is
accepted. Insufficient security returns
`VerificationError::InsufficientSecurityLevel { actual, required }`.
This per-STARK minimum is not an end-to-end security guarantee. For example, a proof with two
96-bit STARKs provides about 95 bits under the union bound. Callers that require 96 bits for the
complete proof need extra margin.
By default, no minimum is enforced. Successful results always retain the actual authenticated
parameters, so callers can estimate the corresponding security levels themselves. Deferred
verification exposes the authenticated obligation through
`outstanding_precompile_root()`; complete verification returns no outstanding root. See the
[deferred-proof semantics](../docs/src/design/deferred/semantics.md) for the full proof policy.
## Crate features
Miden verifier can be compiled with the following features:
* `std` - enabled by default and relies on the Rust standard library.
* `no_std` does not rely on the Rust standard library and enables compilation to WebAssembly.
* Only the `wasm32-unknown-unknown` and `wasm32-wasip1` targets are officially supported.
To compile with `no_std`, disable default features via `--no-default-features` flag.
## License
This project is dual-licensed under the [MIT](http://opensource.org/licenses/MIT) and
[Apache 2.0](https://opensource.org/license/apache-2-0) licenses.