Glossary

Groth16

A pairing-based zkSNARK protocol known for producing the smallest proof sizes and fastest verification times, but requiring a circuit-specific trusted setup.

Get in touch Learn more

Knowledge engineer constructing knowledge base on laptop, document hierarchy visible, casual office setup.

PAIRING-BASED ZKSNARK

What is Groth16?

Groth16 is a pairing-based zkSNARK protocol that produces the smallest proof sizes and fastest verification times in the field, but requires a circuit-specific trusted setup ceremony.

Groth16 is a Zero-Knowledge Succinct Non-Interactive Argument of Knowledge that generates proofs consisting of only three group elements, making it the most compact zkSNARK construction for on-chain verification. The protocol relies on a circuit-specific trusted setup to generate a Common Reference String from a Rank-1 Constraint System, enabling a prover to convince a verifier of correct computation without revealing the private witness.

Its verification algorithm requires a constant number of pairing checks, making it exceptionally fast and gas-efficient on blockchains like Ethereum. However, the security of Groth16 is contingent on the integrity of its trusted setup ceremony; if the toxic waste from the multi-party computation is not destroyed, an adversary can forge proofs. This makes it ideal for applications with static, well-defined circuits where proof size is paramount.

PROTOCOL CHARACTERISTICS

Key Features of Groth16

Groth16 is a pairing-based zkSNARK that sets the standard for minimal proof size and fastest verification. Its efficiency comes from a circuit-specific trusted setup that produces a structured Common Reference String (CRS).

Minimal Proof Size

Groth16 produces the smallest proof sizes of any zkSNARK construction. A proof consists of only 3 group elements (2 in G1, 1 in G2), totaling approximately 128 bytes on the BN254 curve. This compactness makes it ideal for on-chain verification where storage and calldata costs are paramount. The proof size remains constant regardless of circuit complexity, a property known as succinctness.

~128 bytes

Proof Size on BN254

Group Elements

Fastest Verification Time

Verification in Groth16 is constant-time and extremely fast, requiring only a small number of elliptic curve pairings and exponentiations. The verifier checks a single pairing equation, making it the gold standard for applications where proofs are verified by many parties, such as on a blockchain. This efficiency is a direct result of the protocol's tight cryptographic construction and the precomputation enabled by the verification key.

< 10 ms

Typical Verification

O(1)

Complexity

Circuit-Specific Trusted Setup

Groth16 requires a trusted setup ceremony to generate a Common Reference String (CRS) that is specific to a single circuit. Any change to the circuit logic requires a new ceremony. The security relies on the honest destruction of the toxic waste—the random values used to generate the CRS. If at least one participant in the multi-party computation (MPC) ceremony is honest, the protocol remains sound. This is a key trade-off compared to universal setup systems like Plonk.

1-of-N

Honest Participant Assumption

Quadratic Arithmetic Program (QAP) Backend

Groth16 encodes computations as a Quadratic Arithmetic Program (QAP). The circuit is first flattened into a Rank-1 Constraint System (R1CS), which is then transformed into a QAP over a finite field. This encoding allows the prover to demonstrate constraint satisfaction by proving they know a polynomial that is divisible by a target polynomial. The QAP representation is what enables the protocol's extreme succinctness and efficient pairing-based verification.

Linear Prover Complexity

The prover's computational cost scales linearly with the circuit size, specifically O(n) where n is the number of multiplication gates. While this is asymptotically efficient, the prover must perform a multi-scalar multiplication (MSM) over the entire circuit, which can be memory-intensive for large computations. This contrasts with folding schemes like Nova, which achieve sub-linear prover work through incremental computation, but at the cost of larger proofs.

O(n)

Prover Complexity

Pairing-Based Cryptography

Groth16 relies on bilinear pairings over pairing-friendly elliptic curves like BN254 or BLS12-381. A pairing is a map e: G1 × G2 → GT that enables the verification equation to check relationships between committed values without revealing them. The security of Groth16 is reducible to the q-power Knowledge of Exponent Assumption (q-PKE) and the q-power Diffie-Hellman (q-PDH) assumption in the generic group model, providing strong cryptographic guarantees.

PROTOCOL COMPARISON

Groth16 vs. Other zkSNARK Protocols

A feature-level comparison of Groth16 against other prominent zkSNARK constructions for verifiable computation and privacy-preserving machine learning.

Feature	Groth16	Plonk	Halo2	Nova
Proof Size	~128 bytes (constant)	~400-600 bytes	~1-2 KB	~10 KB (folded)
Verification Time	< 1 ms	~3-5 ms	~5-10 ms	~10-20 ms
Prover Time	O(n log n)	O(n log n)	O(n log n)	O(n) per step
Trusted Setup	Circuit-specific	Universal	Transparent	Transparent
Post-Quantum Security
Recursive Proofs
Circuit Flexibility	Fixed per CRS	Plonkish arithmetization	Plonkish + custom gates	R1CS relaxed
Verification Key Size	~192 bytes	~256 bytes	~1 KB	~10 KB

GROTH16 DEEP DIVE

Frequently Asked Questions

Explore the technical nuances of Groth16, the pairing-based zkSNARK protocol renowned for its minimal proof sizes and constant-time verification, but requiring a circuit-specific trusted setup.

Groth16 is a pairing-based Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zkSNARK) protocol that enables a prover to generate a single, constant-size proof attesting to the correct execution of an arithmetic circuit. It works by encoding the circuit's constraints into a Quadratic Arithmetic Program (QAP) , where the prover computes a proof consisting of only three group elements (A, B, C). The verifier checks a single pairing equation: e(A, B) = e(α, β) * e(C, γ), where α, β, and γ are elements from the Common Reference String (CRS) . This elegant mathematical structure results in the smallest proof sizes (around 128 bytes for BLS12-381 curves) and the fastest verification times (a few milliseconds) of any zkSNARK construction, making it ideal for on-chain verification in blockchain applications like Zcash and Tornado Cash.

Enabling Efficiency, Speed & Accuracy

Intelligent Analysis, Decision & Execution

We build AI systems for teams that need search across company data, workflow automation across tools, or AI features inside products and internal software.

Talk to Us

Search across company data

Give teams answers from docs, tickets, runbooks, and product data with sources and permissions.

Useful when people spend too long searching or get different answers from different systems.

Enterprise searchRAGPermissions

Automate internal workflows

Use AI to route work, draft outputs, trigger actions, and keep approvals and logs in place.

Useful when repetitive work moves across multiple tools and teams.

AI agentsWorkflow automationGovernance

Add AI to products and internal tools

Build assistants, guided actions, or decision support into the software your team or customers already use.

Useful when AI needs to be part of the product, not a separate tool.

AI integrationDecision supportModel routing

ZERO-KNOWLEDGE PROOF ECOSYSTEM

Related Terms

Explore the foundational protocols, cryptographic primitives, and computational representations that interact with Groth16 in the zero-knowledge proof landscape.

zkSNARK

The broader class of Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge to which Groth16 belongs. zkSNARKs are defined by their constant-size proofs and fast verification, making them ideal for blockchain scalability and verifiable computation. Groth16 is a specific, highly optimized instantiation of a zkSNARK that minimizes proof size to just three group elements.

~128 bytes

Groth16 Proof Size

< 10 ms

Typical Verification Time

Rank-1 Constraint System (R1CS)

The standard arithmetic representation used to encode computations for Groth16. An R1CS transforms a program's logic into a set of quadratic constraints over a finite field. The prover must demonstrate knowledge of a witness that satisfies every constraint simultaneously. Groth16's efficiency stems from its direct pairing-based verification of these R1CS matrices.

EXPLORE

Trusted Setup Ceremony

A multi-party computation protocol required by Groth16 to generate its Common Reference String (CRS). The security of every proof depends on the destruction of the 'toxic waste' generated during this phase. If a single participant destroys their secret randomness, the system is sound. This circuit-specific requirement is Groth16's primary trade-off compared to transparent systems like zkSTARKs.

1-of-N

Honesty Assumption

Plonk

A universal zkSNARK that addresses Groth16's main limitation: the need for a circuit-specific setup. Plonk uses a Universal Setup—a single, one-time ceremony that works for any circuit up to a bounded size. While Plonk proofs are larger than Groth16's, the trade-off is operational flexibility, eliminating the need for a new ceremony for every application.

Arithmetic Circuit

The computational model underlying Groth16. A program is compiled into a directed acyclic graph of addition and multiplication gates over a prime field. Groth16's prover evaluates this circuit with private inputs to generate the proof. The efficiency of the proof generation is directly tied to the number of multiplication gates, making circuit optimization a critical engineering task.

zkML

The application of zero-knowledge proofs to machine learning, where Groth16 is a popular backend. zkML enables a prover to cryptographically attest to the correctness of a model's inference without revealing the model weights or input data. Groth16's small proof size is critical here, as it allows on-chain verification of complex neural network computations.

EXPLORE

About the author

Prasad Kumkar

CEO & MD, Inference Systems

Prasad Kumkar is the CEO & MD of Inference Systems and writes about AI systems architecture, LLM infrastructure, model serving, evaluation, and production deployment. Over 5+ years, he has worked across computer vision models, L5 autonomous vehicle systems, and LLM research, with a focus on taking complex AI ideas into real-world engineering systems.

His work and writing cover AI systems, large language models, AI agents, multimodal systems, autonomous systems, inference optimization, RAG, evaluation, and production AI engineering.

Limited slotsGet a Free AI Consultation

How We Work

Custom AI workflows for your Business

One-fit-all AI don't work for modern businesses. At Inferensys, we aim to understand your business & custom requirements; which we use to define most efficient agentic workflows, the data, and the tools for your business.