I keep a spreadsheet of prover benchmarks. Not price charts, not funding rounds — cycle counts, joules per proof, and thermal decay curves, measured on hardware I physically own. The gap between what a zero-knowledge roadmap claims and what a handset can actually sustain is where a surprising number of industry assumptions quietly die, and almost nobody publishes the second column.
The row that matters this month reads as follows. A BN254 Groth16 prover over a 2^18-constraint circuit, running on an A17 Pro. Cold wall clock: 8.4 seconds. Sixty-eight percent of retired cycles sat in multi-scalar multiplication. Nineteen percent sat in the number-theoretic transform. Then I logged energy draw through a USB-C meter and taped a thermocouple to the chassis, and the decomposition inverted. The NTT burned roughly a third of the joules, because it keeps the memory controller and the clock tree saturated and never lets the SoC fall out of its boost state. MSM, which stalls constantly on memory, spends most of its wall clock waiting and drawing near-idle power.
That inversion is the entire story of Apple's A20 Pro as it pertains to cryptography. The industry is about to celebrate a process node. Almost nobody is modeling what a process node does to a workload that is bandwidth-starved and thermally capped.
Context: what is being announced, and which parts of it touch your protocol
Apple is expected to announce the A20 Pro — the first Apple silicon on TSMC's N2 process — alongside the iPhone 18 Pro family. The reported specifications are unremarkable in the way that all leading-edge specifications are unremarkable. A nanosheet gate-all-around transistor architecture replaces FinFET. Logic density rises. The claimed numbers land where TSMC has been guiding: an iso-power performance gain in the mid-teens, and an iso-performance power reduction somewhere around thirty percent. The genuinely interesting variant is the one shipping backside power delivery, where the power rail moves beneath the transistor layer and frees routing resources above it.
That is the three-part narrative circulating in the trade press: 2nm redefines mobile efficiency, it lifts the Mac line to new performance ceilings, and it sets a new standard for foldable device performance. All three claims are about consumer workloads. None of them describe what happens when you point a handset at a proving circuit, and that gap is where I want to spend the next several thousand words.
For anyone building protocols rather than phones, exactly four surfaces on this die matter. The general-purpose CPU cluster. The memory subsystem. The secure element. The neural engine. Everything else — display pipeline, image signal processor, baseband — is irrelevant to the crypto stack, with one caveat: the baseband determines whether your light client can sync from a moving vehicle, and that is a radio problem, not a compute problem.
There is a reason this lands differently in 2026 than it would have in 2019. The crypto stack has spent a decade pushing computation away from the user's device. Exchanges hold keys. Sequencers order transactions. Prover pools prove. RPC providers serve state. The bull market that has run through 2025 and into 2026 produced a rhetorical counter-movement — self-custody, account abstraction, on-device verification, verifiable agents — that assumes the handset can absorb the work. That assumption was already shaky on N3. N2 will be used to market it as settled.
It will not be settled. Here is the arithmetic.
Core: the memory wall gets deeper, not shallower
Start with the scaling law everybody skips. Transistor density and DRAM bandwidth are manufactured on entirely independent roadmaps by entirely independent companies. TSMC's N2 improves logic density, capacitance, and drive current. It does not touch the LPDDR PHY, and it does not touch the DRAM die, which Micron, SK Hynix, and Samsung build on their own cadence.
The A17 and A18 generations ship LPDDR5X at 8533 MT/s over a 64-bit bus, which works out to roughly 68 GB/s of theoretical peak and something closer to 48–55 GB/s of achievable streaming bandwidth once you account for refresh, bank conflicts, and the coherency traffic the rest of the SoC is generating. LPDDR6 begins sampling with per-pin rates in the 10.6–14.4 Gbps range, and if Apple moves to a 96-bit or 128-bit bus — plausible on a Pro-class part with an on-package memory controller — a theoretical 120–170 GB/s becomes reachable. That number, not the node, is the one to track.
Now the algorithm. Multi-scalar multiplication is not floating-point-bound and it is not even integer-arithmetic-bound in the way people assume. Pippenger's bucket method reads and writes a bucket array of elliptic curve points in a pattern whose locality degrades as the window size grows. On a desktop with 64 MB of L3 the working set mostly fits. On a phone, with a system-level cache measured in the tens of megabytes, the bucket array spills to DRAM almost immediately, and throughput becomes a function of how many outstanding memory requests the memory controller can keep in flight. The core count is nearly irrelevant. I have run the same circuit pinned to a single core and to all six, and the delta at 2^18 constraints was under twelve percent, because the bottleneck was already off-die.
Nothing about N2 changes that. A 2^20-constraint Groth16 proving key for BN254 runs into the hundreds of megabytes. A PLONK-style system with a 2^22 evaluation domain across five or six columns produces witness and intermediate polynomials in the same range. A production zkVM trace is worse by an order of magnitude. You cannot cache your way out of a working set that exceeds the cache by two orders of magnitude; you can only shorten the stalls.
So here is a falsifiable prediction, and I want it on the record before the announcement trailers land. An A20 Pro will run an iso-circuit proof roughly six to nine percent faster than an A18 in cold state — not the fifteen to thirty percent the marketing implies. The kernel is memory-bound. Backside power delivery improves the logic layer, and the logic layer is not what is stalling. If someone publishes a benchmark showing a 25 percent improvement on a Groth16 prover at fixed circuit size, check the circuit size first, because they almost certainly changed it.
I have made this mistake in the other direction and learned from it. In 2024 I spent two weeks auditing the Groth16 circuit verification logic for a privacy-preserving DeFi protocol — specifically the challenge-generation phase, where I found a soundness error that permitted duplicate spending under a narrow timing window. I fixed it, but the reason it existed at all is instructive: the team had optimized the constraint count aggressively to fit a proving budget, and the surgical trimming had removed the entropy that made the challenge unpredictable. Circuit size is not a free parameter. Every team that shaves a thousand constraints to fit a handset is making a security decision disguised as a performance decision.
Core: backside power, sustained clocks, and the fact that iOS is the real governor
Backside power delivery is the most genuinely interesting piece of the N2 story, and it is worth being precise about why. In a conventional stack, the power rails and the signal routing compete for the same metal layers, which forces a tradeoff between IR drop and routing density. Moving the rails underneath removes that competition. The practical effect is less voltage droop under bursty load — and proving workloads are maximally bursty, alternating between arithmetic-dense phases and long memory stalls. Less droop means the clock can stay high through the transition instead of sagging into a DVFS state change.
But electrical headroom is not thermal headroom. A phone chassis sustains four to six watts indefinitely, and every milliwatt above that gets clawed back by the thermal governor within seconds. My decay measurements on an A17 Pro are consistent and repeatable: continuous proving at maximum throughput loses twenty-two percent of its baseline rate within ninety seconds, then plateaus around seventy-eight percent of peak for as long as you care to keep the screen off. The die is not throttling because it is badly designed. It is throttling because the entropy has nowhere to go.
N2's thirty percent iso-performance power reduction buys time inside that envelope. My estimate is that the decay knee moves from roughly ninety seconds out to somewhere between 180 and 220 seconds on the A20 Pro, assuming the chassis thermal design does not regress. That sounds like a doubling. It is not, because proving a production circuit is not a ninety-second job. A 2^20 circuit on a handset runs forty to ninety seconds per proof, which means a batch of three proofs puts you past the knee and into the plateau regardless of which node you are on. You do not escape the thermal governor by shrinking the transistors; you just arrive at it later.
And even that understates the problem, because the binding constraint on iOS is not silicon at all. It is the scheduler. Background execution is rationed: a BGProcessingTask budget that is measured in tens of seconds, gated on battery state, thermal state, and whether the device is charging and locked. A daemon that wants to maintain a rolling prover queue competes with photo indexing, model updates, and Spotlight reindexing for the same budget. You can build the fastest prover in the world and still be evicted at second thirty-one. Teams that model on-device proving from first principles of compute tend to discover this constraint last, usually in a TestFlight build, usually after the pitch deck is locked.
Core: the Mac is the actual proving story, and that has a supply-chain consequence
The source narrative gets this half right. The Mac line is where N2 changes something real, for a reason that has nothing to do with the node. Memory bandwidth on Apple's high-end desktop silicon is an order of magnitude above the phone: the M4 Max sits around 546 GB/s, the M3 Ultra around 800 GB/s, and an N2-generation Max with LPDDR6 over a wider bus plausibly reaches the 700–900 GB/s band with a thermal envelope north of 100 watts sustained in a Mac Studio chassis.
That combination matters because MSM throughput scales roughly linearly with available bandwidth once you are no longer latency-bound, and a desktop is not latency-bound. A Mac Studio on N2 with 900 GB/s is not a toy. My rough model puts it in the neighborhood of one-fifth to one-tenth the throughput of a 4090-class proving server at a small fraction of the wall power, and — this is the part that actually changes protocol design — it runs quiet, unattended, and inside a residential power envelope. That is a credible home-prover node. It is also the first time since the GPU mining era that a consumer machine has been a meaningful participant in a cryptographic work market.
The supply-chain consequence is less comfortable. TSMC's early N2 wafer allocation is reportedly priced in the twenty-five to thirty thousand dollar range per wafer, and it is pre-committed, overwhelmingly, to Apple and to the hyperscaler accelerator programs. That has a direct and under-discussed effect on the zero-knowledge hardware startups — the accelerator shops building MSM and NTT engines in silicon. They are not getting N2 capacity in this cycle. They are on N5, on N4, or on FPGAs, which means the dedicated proving-accelerator roadmap is structurally one to two nodes behind the consumer silicon it is competing against. A phone that improves six percent per generation and an FPGA that improves forty percent per generation will eventually cross, but the crossing is further out than the accelerator pitch decks assume, and the runway between now and then is funded by token emissions rather than by proving revenue.
I spent three months in late 2022 reverse-engineering Celestia's Blobstream light client verification path, comparing its trust assumptions against Ethereum's blob data availability, and I came away with a durable lesson: cryptographic elegance does not survive contact with adoption economics. The same applies here. A proving market whose fastest cheap hardware is a closed, non-upgradable, single-vendor desktop platform has a governance dependency embedded in its physical layer, and no amount of clever proof-system design removes it.
Core: the secure element, and the attestation monoculture nobody is pricing
Regulatory pressure has already pried the A20 Pro's secure element open, at least partially. The DMA-driven requirement to expose NFC and secure-element access to third-party wallet providers means that, in the European Economic Area at minimum, wallet code runs against the SEP under entitlement. That is a genuine capability win for self-custody UX. It is also the beginning of an attestation monoculture.
If your key ceremony, your recovery flow, or your session-binding logic depends on SEP attestation, you have inherited four things you did not vote on: Apple's firmware update cadence, Apple's attestation root of trust, Apple's response time when a vulnerability lands, and Apple's jurisdictional posture, which shifts with antitrust proceedings in Brussels and Washington. Protocol teams that hard-bind to a single vendor's attestation root are writing a governance dependency into their trust model — one that no token holder can vote on and no multisig can revoke.
There is a second-order effect that worries me more. Over the last two years, several L2s and faucets experimented with device attestation as an anti-Sybil primitive: one device, one wallet, hardware-backed. It worked, in the narrow sense that it raised the cost of farming. It also converted a hardware fingerprint into a social identity, at massive scale. The A20 Pro makes that primitive cheaper, faster, and more attractive to product teams under airdrop-sybil pressure. If the pattern generalizes, Sybil resistance becomes a hardware market, and airdrop fairness becomes a function of which vendor's silicon you can afford and which jurisdictions that vendor serves. That is a distributional outcome nobody proposed and everybody will inherit.
Core: the neural engine, and why throughput is the wrong metric entirely
On-device inference at INT4 is going to be the headline capability of the A20 Pro, and the crypto industry has already decided it wants to use it. AI-agent oracles — networks where LLM instances validate off-chain data and reach consensus on the result — are one of the fastest-growing categories of 2026, and the pitch is always the same: more on-device inference means cheaper validation and a wider quorum.
I have a specific problem with that pitch. In 2025 I analyzed an AI-driven oracle network and found a deterministic failure mode in its consensus layer: when multiple agents produced identical but incorrect outputs, because they shared a prompt-injection surface, the verification layer read semantic agreement as correctness and finalized the bad value. I reproduced it on a local inference server. The failure was not probabilistic noise, which the system was designed to tolerate. It was correlated error, which the system could not see.
Now put a faster neural engine in that path. A faster NPU does not improve determinism by even one bit. It produces wrong answers faster, in greater quantity, and with more apparent confidence. Every additional agent you can afford to run on-device is another instance of the same weights, the same tokenizer, and the same injection channel. Throughput is not the axis on which oracle security is decided; the axis is whether the validation step can distinguish agreement from truth, and no process node has ever changed that.
There is a real use for the neural engine in the crypto stack — witness generation heuristics, constraint solver warm starts, fuzzing harness exploration. I still write Echidna harnesses when a security claim is cheap to test, and an NPU that explores state space faster is genuinely useful there. Just do not confuse search acceleration with verification. Verify, do not infer.
Core: the capital layer where compute becomes collateral
When N2 capacity is oversubscribed by an order of magnitude, the scarcity gets financialized, and it has been. Tokenized claims on compute capacity, GPU and ASIC depreciation schedules, receivables from hyperscaler contracts — this is one of the more credible real-world-asset categories in the current cycle, precisely because the underlying cash flows are contractually visible.
The moment compute becomes collateral, the licensing venue stops being a compliance formality and becomes the product decision. I watched a team work through this in 2025 on a hardware-backed yield product, choosing between a Hong Kong virtual asset trading platform licence and a Singapore framework. The technical architecture was identical in both decks. The difference was a single slide about which regulator's processing timeline put them in front of institutional allocators first, and which one's posture toward hardware-collateralized structures let them syndicate to banks rather than to family offices. The engineering did not change. The venue did. That is the whole game, and anyone modeling these products on the basis of the underlying technology is modeling the wrong variable.
Contrarian: efficiency is not cost, and the attack surface is not where the gains are
Here is the part of the story I expect almost nobody to get right, including the people building on it.
Proving cost per proof is falling. Total proving spend is rising. This is not a paradox; it is elasticity. Every time the cost of a proof drops, circuit designers raise the constraint count, because competitiveness in ZK systems is measured in what you can prove, not in what you can prove cheaply. The trajectory is documented: 2021-era circuits at 2^18, 2024 production systems at 2^22, current zkVM designs pressing toward 2^24 and beyond. If N2 delivers twenty percent more throughput per joule, the headroom is consumed within two upgrade cycles and user-visible proving latency is flat. The efficiency gain is captured by the protocol's competitive dynamics, not by the user, and it is certainly not captured by the proving operator, who is still running the same margin against a larger circuit.
That is why I keep saying proving costs are structurally absurd rather than temporarily high. Hardware improvement does not fix a cost structure that is set by competition. If anything, it accelerates the arms race that produces the cost structure. Operators on a fixed-fee proving contract watch their capital equipment depreciate against a workload that grows faster than the hardware improves. Good silicon makes that worse, not better.
The second blind spot is that none of these gains touch the actual attack surface. Signature verification is microseconds. Keccak is trivial. Secure key derivation is already hardware-accelerated in the SEP and already fast. The expensive parts of the stack — the parts where exploits actually live — are key ceremonies, session handling, oracle semantics, and cross-chain message verification. The A20 Pro improves the part of the stack that was never the bottleneck and leaves the part that is.
And a third, smaller correction. The source material suggests 2nm will set new standards for foldable performance. For proving specifically, foldables are the worst case, not the best. A hinge-constrained chassis has less contiguous thermal mass, worse heat spreading, and a battery split across two cells with additional interconnect losses, while the display itself draws meaningfully more power at the same brightness. If on-device proving ever arrives, it arrives last on a foldable. Anyone building a foldable-first wallet UX on the promise of on-device proving is building on the least favorable thermal budget Apple ships.
Takeaway
My prediction, with a horizon and a falsification condition attached. By the fourth quarter of 2027, no mainstream mobile wallet will generate a general-purpose zero-knowledge proof on-device within a consumer-acceptable latency budget. The architecture that wins will be deliberately split: witness generation and final verification local, proof generation delegated to a remote prover pool under a verifiable outsourcing protocol, with the phone doing the cheap work and the expensive work running somewhere with a power supply. The A20 Pro will be remembered for what it did to on-device agent inference, not for anything it did to cryptography.
I will revise that prediction if two numbers move. The first is shipping LPDDR6 bandwidth on the Pro part — if it lands above 150 GB/s with a memory controller that can sustain it, the memory-wall argument weakens meaningfully. The second is whether Apple ships a verifiable offload primitive for confidential compute, extending the Private Cloud Compute attestation model to third-party workloads. If both move in the same generation, the split architecture collapses into a different one, and I will rewrite the spreadsheet.
Until then, the honest summary of a 2nm phone in a cryptographic context is this: it is a superb device for verifying other people's work, and a poor device for doing its own. Which raises the question nobody at the keynote will ask. When the quorum is a phone, who audits the phone?