What the Billion-Credential Prototype Actually Shows

The PRC-based anonymous-credential revocation system makes an unusually large scale claim, but the claim has several layers. This chapter separates what the prototype directly measured from what follows from the protocol's complexity, what was calculated from a pricing model, and what was extrapolated from comparisons that could not run at the largest database size. That separation gives the reader a defensible judgment about feasibility without turning a controlled experiment into a production guarantee.

What was actually measured

The authors implemented the basic PRC construction for single-bit records in Rust. The evaluation used an AMD Ryzen AI 7 PRO 350 machine with 64 GB of RAM and emulated multiple PRC servers on that one machine. Experiments ran in a single-core setting, used TCP for communication, and shaped the network round-trip time to 20, 40, or 80 milliseconds. The protocol's computation time was reported as user plus system time. These choices make the experiment repeatable and expose the cost of the protocol under controlled conditions, but they are not the same as operating independent authorities across a continent.

The measured latency is the most visible result. The private computation uses six rounds in the evaluated flow. For databases reaching one billion records, the reported response latency remains below 400 milliseconds across the tested network conditions. The authors say latency is dominated by network delay rather than by the number of credentials, the number of servers, or the computation cost. That result follows from the shallow protocol: the one-hot conversion has a depth that grows with the logarithm of the index size, and the final retrieval adds one interactive layer. A protocol can therefore touch a large database while keeping the number of sequential network turns limited.

The server computation tells a different part of the story. At one billion credentials, the prototype reports less than 25 milliseconds of computation per revocation authority in the tested single-core setting. The database work is still linear in the number of records for the binary status case. What makes that work practical is the representation: the implementation packs eight status bits into each byte and uses AVX2 vectorized bitwise operations. One CPU core can process many logical bit operations in parallel. The result is impressive engineering, but it is not an asymptotic claim that server computation stops growing as the database grows.

The communication result is what the protocol's square-table retrieval is designed to improve. In the paper's accounting, a client query contains 32 bytes of randomness and 4 bytes of index material for each of n authorities, while a server's response includes a 64-byte signature and an 8-byte timestamp. The commitment need not be sent back because the client knows the randomness and candidate record and can compute it locally. The total is reported as 36n + 72 bytes; in a two-authority setting, the conclusion gives 144 bytes of transfer.