KZG Commitment

The defining property of a KZG commitment is that both the commitment to a polynomial and the evaluation proof are a single group element (e.g., 48 bytes), regardless of the polynomial's degree or the complexity of the data. This O(1) size is a massive improvement over Merkle trees, where proof size grows logarithmically with data size. This constant size enables highly efficient on-chain verification and minimal bandwidth usage.

KZG relies on bilinear pairings over elliptic curves. The commitment C = g^P(s) is a single group element that binds the prover to a specific polynomial P without revealing it. The scheme is homomorphic: commitments to two polynomials can be added to get a commitment to their sum. This allows for elegant batch proofs, where a single proof can verify multiple evaluations simultaneously, drastically reducing verification overhead.

KZG is the cryptographic backbone of EIP-4844, which introduces blob-carrying transactions. Rollups post compressed transaction data in blobs, and a KZG commitment to that data is stored on-chain. The consensus layer only verifies that the commitment is correct, not the data itself. This enables Data Availability Sampling (DAS), where light nodes probabilistically verify blob availability using KZG proofs without downloading the full blob.

Beyond data sharding, KZG is used to build Verkle trees, a replacement for Merkle Patricia trees in Ethereum's state. A Verkle tree uses a vector commitment (a KZG commitment to a vector of values) at each node. This allows for extremely compact witnesses—the proof that a specific piece of state is correct. Verkle trees reduce witness sizes from kilobytes to under 200 bytes, enabling stateless clients that can validate blocks without storing the entire state.

A single KZG commitment can be opened at multiple points with a single, constant-size proof using multiproofs. Given a set of evaluation points (z_i, y_i), a prover can generate one proof that attests to all of them simultaneously. The verifier checks this single proof against the original commitment. This amortized verification is critical for scalability, allowing a single on-chain transaction to verify an entire block's worth of data availability proofs.

KZG commitments are the core mathematical primitive inside Verkle trees, which are designed to replace the Merkle Patricia trie in Ethereum's state data structure. A Verkle tree uses a vector commitment scheme to prove the values of sibling nodes in a single, compact proof.

• Efficiency: Unlike a Merkle tree, which requires providing all sibling nodes along a path (a large proof), a Verkle proof is constant-size.
• Goal: This enables stateless clients—validators that can verify blocks without storing the entire global state, dramatically lowering hardware requirements for network participation.

KZG serves as a fundamental building block in modern zk-SNARK proving systems, particularly those based on polynomial interactive oracle proofs (PIOPs) like PLONK and Marlin. The prover commits to the gate polynomials of an arithmetic circuit using a KZG commitment.

• Role: The verifier can query the committed polynomial at a random challenge point, and the prover provides a KZG evaluation proof to show the query was answered correctly.
• Result: This combination yields a universal and updatable structured reference string (SRS), meaning a single trusted setup can be used for any circuit up to a certain size.

In full danksharding, the network must ensure that all blob data was actually published by a block proposer without requiring every node to download everything. KZG commitments enable efficient data availability sampling.

• Process: A node randomly samples a few positions of the blob. The proposer must return the data at those positions along with a KZG proof that the data matches the original commitment.
• Security: The polynomial nature of KZG ensures that if a sufficient fraction of the data is available, the entire blob can be reconstructed via erasure coding, and any attempt to withhold data is cryptographically detectable.

KZG commitments provide a robust method for verifiable secret sharing (VSS). A dealer can commit to a polynomial whose constant term is a secret, then distribute evaluations of this polynomial to participants as shares.

• Verification: Each participant can independently verify that their received share is a correct evaluation of the committed polynomial using the KZG opening proof.
• Advantage: This eliminates the need for a trusted dealer and provides immediate, non-interactive verification of share correctness, which is essential for distributed key generation (DKG) protocols in threshold cryptography.

Several zk-rollup projects utilize KZG-based proving systems to generate their validity proofs. The constant-size proof property is highly desirable for on-chain verification, where every byte of calldata incurs a cost.

• Implementation: A zk-rollup operator executes thousands of transactions off-chain, generates a proof of correct execution using a KZG-based SNARK, and posts only this tiny proof to the Layer 1 chain.
• Impact: This allows the Layer 1 smart contract to verify the integrity of a massive batch of transactions with a single, cheap, constant-time cryptographic check, inheriting the full security of the base layer.