Zero-Knowledge Proof (ZKP)

If the statement is true and both parties follow the protocol honestly, an honest verifier will always be convinced by an honest prover. This property guarantees the protocol functions correctly under normal operation.

• Mechanism: The prover possesses a valid witness (secret input) that satisfies the circuit's constraints.
• Practical example: A prover who knows the preimage of a SHA-256 hash can always generate a valid proof that convinces the verifier.
• Failure mode: A protocol lacking completeness would reject valid proofs, making it useless for real-world applications like private identity verification.

A malicious prover cannot convince an honest verifier of a false statement, except with negligible probability. This is the security property that prevents forgery.

• Computational soundness: Relies on cryptographic assumptions (e.g., discrete log hardness). A computationally bounded adversary cannot forge proofs. Used in ZK-SNARKs.
• Statistical soundness: Holds against unbounded adversaries. Used in ZK-STARKs for post-quantum security.
• Knowledge soundness: A stronger variant where an extractor algorithm can recover the witness from a convincing prover, proving the prover actually knows the secret.

The verifier learns nothing beyond the validity of the statement. No information about the secret witness is leaked during the interaction.

• Simulation paradigm: A simulator can generate transcripts indistinguishable from real protocol interactions without knowing the secret, proving no knowledge is extracted.
• Perfect zero-knowledge: The simulated and real distributions are identical.
• Computational zero-knowledge: The distributions are computationally indistinguishable, sufficient for most practical applications like private transactions on ZK-Rollups.

The proof size is small (ideally constant or logarithmic) and verification time is fast relative to the computation being proven. This property is not universal to all ZKPs but defines the practical subclasses ZK-SNARK and ZK-STARK.

• ZK-SNARK: Proof size is constant (a few hundred bytes) regardless of computation complexity. Verification takes milliseconds.
• ZK-STARK: Proof size scales polylogarithmically with computation size. Larger than SNARKs but requires no trusted setup.
• Practical impact: Succinctness enables on-chain verification of complex off-chain computations, the foundation of ZK-Rollup scalability.

The proof is a single message from prover to verifier with no back-and-forth communication. This is essential for blockchain and asynchronous applications.

• Fiat-Shamir heuristic: Converts interactive protocols into non-interactive ones by replacing the verifier's random challenges with the output of a cryptographic hash function applied to the transcript.
• Common Reference String (CRS): Some non-interactive systems require a shared random string generated during a Trusted Setup Ceremony.
• Advantage: Proofs can be generated once and verified by anyone at any time, enabling decentralized verification networks.

ZKPs enable selective disclosure of attributes without revealing the underlying data. A user can prove they are over 18 without showing their birth date, or prove citizenship without revealing a passport number. This is the foundation of self-sovereign identity systems.

• Polygon ID uses ZK-SNARKs for verifiable credentials
• Worldcoin employs ZKPs to prove unique humanness without linking biometric data
• Anonymous voting systems use ZKPs to prove eligibility while preserving ballot secrecy

A verifier receives a cryptographic proof that a statement about a credential is true, learning nothing else about the credential itself.

ZK-Rollups batch thousands of off-chain transactions and generate a single validity proof posted to Ethereum. The L1 chain verifies this tiny proof instead of every transaction, inheriting the rollup's security without the computational burden.

• StarkNet uses STARKs for general-purpose smart contract execution
• zkSync Era employs SNARKs for EVM-compatible scaling
• Polygon zkEVM generates proofs for Ethereum-equivalent bytecode

This architecture reduces gas fees by orders of magnitude while maintaining the security guarantees of the underlying L1 blockchain.

zkML proves that a specific model produced a specific output from a given input without revealing the model weights or the input data. This solves the black-box oracle problem in decentralized AI.

• A medical diagnosis model can prove it used the certified version without exposing proprietary weights
• DeFi protocols verify that an AI agent's trading decision came from the agreed-upon model
• Content authenticity systems prove an image was classified by a specific detector

Projects like EZKL and Giza compile neural networks into ZK circuits, generating proofs of correct inference that anyone can verify.

ZKPs enable confidential transactions where amounts and counterparties remain hidden while still allowing network validators to verify that no inflation or double-spending occurred.

• Zcash pioneered shielded transactions using zk-SNARKs to hide sender, receiver, and amount
• Tornado Cash used ZKPs to break on-chain links between deposit and withdrawal addresses
• Aztec Network implements a programmable privacy layer where smart contract state remains encrypted

Financial institutions are exploring ZKPs for interbank settlement where transaction details must remain confidential but settlement finality must be publicly verifiable.

ZKPs resolve the tension between transparency and privacy in regulated industries. An institution can prove compliance with rules without exposing sensitive business data to competitors or regulators.

• Prove solvency by showing assets exceed liabilities without revealing account balances
• Demonstrate tax compliance by proving correct calculation without disclosing revenue streams
• Verify KYC/AML checks were performed without exposing customer identity to every counterparty

ING Bank has demonstrated ZKP-based KYC where a customer proves their identity once and reuses that proof across institutions without sharing raw documents.

Decentralized Oracle Networks like Chainlink use ZKPs to prove that off-chain data was fetched correctly and computation was performed honestly before delivering results to smart contracts.

• DECO (Chainlink) uses ZKPs to prove web server responses are authentic without revealing session keys
• ZK-OCR generates validity proofs for oracle committee consensus, reducing on-chain verification costs
• Cross-chain bridges employ ZKPs to prove state on one chain to a contract on another without trusted relayers

This eliminates the need to trust individual oracle nodes, replacing trust with cryptographic verification.

A Zero-Knowledge Succinct Non-Interactive Argument of Knowledge that produces a small, constant-size proof verifiable in milliseconds. SNARKs require a trusted setup ceremony to generate a common reference string, which introduces a potential security risk if the ceremony is compromised. The proof size is typically a few hundred bytes regardless of computation complexity.

• Proof size: ~200-300 bytes
• Verification time: ~10-20ms
• Key primitive: Bilinear pairings over elliptic curves
• Popular implementations: Groth16, Plonk, Marlin
• Trade-off: Smallest proofs but requires trusted setup

A Zero-Knowledge Scalable Transparent Argument of Knowledge that eliminates the trusted setup requirement by relying on collision-resistant hash functions instead of elliptic curve pairings. STARKs offer post-quantum security and scale efficiently for large computations, though proofs are larger than SNARKs (typically 40-200KB).

• Security basis: Hash function collision resistance
• Quantum resistance: Inherently post-quantum secure
• Proof size: 40-200KB (larger than SNARKs)
• Proving speed: Faster for large witness sizes
• Key component: FRI protocol for polynomial commitment

A zero-knowledge virtual machine that executes arbitrary programs and generates a cryptographic proof of correct execution. zkVMs abstract away circuit design, allowing developers to write verifiable programs in high-level languages like Rust or C++ rather than manually constructing arithmetic circuits.

• RISC Zero: Built on RISC-V ISA using STARKs with recursive proof composition
• SP1: Succinct Labs' high-performance zkVM optimized for speed
• Jolt: Uses a novel lookup-based approach for faster proving
• Key benefit: General-purpose verifiable computation without circuit expertise
• Use case: Proving ML inference, blockchain state transitions, off-chain computation

A Layer 2 scaling solution that bundles hundreds or thousands of off-chain transactions into a single batch and posts a validity proof to the Layer 1 blockchain. Unlike optimistic rollups, ZK-rollups provide instant finality because the proof mathematically guarantees correctness.

• Data availability: Transaction data posted to L1 (or off-chain in Validium variant)
• Finality: Immediate upon proof verification (no challenge period)
• Throughput: 2,000-10,000+ TPS depending on implementation
• Examples: zkSync Era, StarkNet, Polygon zkEVM, Scroll
• Cost reduction: Amortizes gas costs across thousands of transactions

A technique where a zero-knowledge proof attests to the validity of one or more previous proofs, enabling compression of multiple proofs into a single constant-size proof. This is the cryptographic equivalent of taking a photo of a photo—each layer of recursion verifies the previous proof's correctness.

• Proof aggregation: N proofs compressed into 1 constant-size proof
• Infinite recursion: Enables unbounded computation verification
• Key enabler: Proof-Carrying Data (PCD) for distributed systems
• Application: zkRollup block compression, zkVM continuation
• Latency trade-off: Recursive proving adds computational overhead

A cryptographic primitive allowing a prover to commit to a polynomial and later reveal evaluations at specific points without disclosing the entire polynomial. This is the mathematical engine underlying most modern ZKP systems.

• KZG Commitment: Constant-size proofs using bilinear pairings; requires trusted setup
• FRI Protocol: Hash-based scheme used in STARKs; transparent setup, larger proofs
• IPA (Inner Product Argument): Used in Bulletproofs; logarithmic proof size without pairings
• Key property: Binding (can't change polynomial) and hiding (polynomial remains secret)
• Role in ZKPs: Enables efficient verification of circuit satisfiability