You are reading an excerpt from our free but shortened abridged report! While still packed with incredible research and data, for just $20/month you can upgrade to our FULL library of 50+ reports (including this one) and complete industry-leading analysis on the top crypto assets.
Becoming a Premium member means enjoying all the perks of a Basic membership PLUS:
- Full-length CORE Reports: More technical, in-depth research, actionable insights, and potential market alpha for serious crypto users
- Early access to future CORE ratings: Being early is sometimes just as important as being right!
- Premium Member CORE+ Reports: Coverage on the top issues pertaining to crypto users like bridge security, layer two solutions, DeFi plays, and more
- CORE report Audio playback: Don’t want to read? No problem! Listen on the go.
ZK Proofs (ZKPs)
In general, a ZK/validity proof is a cryptographic method of transaction verification in which a prover develops a proof for specific information, and a verifier validates the proof. A ZKP allows someone to publicly verify that they possess specific information without revealing the specifics or details of that information. As a result, Zero-Knowledge cryptographic proofs provide phenomenal privacy features as well as reduce the computing and storage resources for validating the block by reducing the amount of data held in a transaction (since zero knowledge of the entire data is needed).
The "witness" is the knowledge shared (the data) between a prover and a verifier. The prover must prove that they know the witness accurately, and the verifier must be able to assess whether the proponent has knowledge of the witness.
Validity proofs are complex and rely on polynomial commitments. In polynomial commitments, information from each stage of a verification calculation is encoded as polynomials. By checking the polynomial equations, you indirectly ascertain the numerical calculations, but the process for hashing these polynomials is challenging. The top three polynomial hashing algorithms for polynomial commitments are:
- Bulletproofs (Monero)
- KZG (Kate) Polynomial Commitments (most ZKRs)
- FRIs (Polygon)
Shafi Goldwasser, Silvio Micali, and Charles Rackoff invented ZKPs in 1985. Since then, ZKPs have been one of the most actively researched topics in cryptography, thanks to the privacy benefits they offer. Moreover, they have recently had a substantial impact on real-world applications, particularly concerning blockchain technology and cryptocurrencies. ZCash, a pioneering privacy-focused blockchain project, uses ZKPs to create financial transaction anonymity. Specifically, ZCash uses an optimized form of ZKPs known as zkSNARKs, along with shielded transactions that obfuscate transaction details across its public blockchain network, providing anonymity and fungibility.
ZK proofs can be used for various purposes: a) anonymous payment service, b) allowing access to services without revealing personal data, c) proving statements on personal data, and d) enabling trustless computing services.
ZK-rollups are (theoretically) faster and more efficient than Optimistic rollups, but they suffer from friction and compatibility issues when migrating smart contracts to Layer 2. This is because Ethereum was not originally designed to support ZKPs. The EVM and opcode are not zero-knowledge proof-friendly, making their development as a L2 scaling solution an arduous task for developers.
The method for creating a ZKP is incredibly complex, requiring the transformation of program logic into a mathematical circuit that also includes hash and smart contract operations, as well as logical operations such as "with," "or," and "not." However, a mathematical circuit consists only of simple operations such as addition and multiplication, making it very hard to emulate sophisticated algorithms with such few resources.
While validity proofs are complex and expensive (relative to Optimistic fraud proofs), verification by the L1 is simple, making them—even still—cheaper than a regular L1 transaction. However, due to the complex computation involved in the validity proofs, special-purpose hardware may be needed to run a node, creating a centralizing effect and a less open network.
There are two important actors in a ZK-rollup: provers and validators/verifiers. “Provers” are a small set of nodes that run this specialized hardware, compute all the transactions, and compile them into a much smaller ZK proof. Typically, they are not very transparent and/or auditable, but users can sleep easy because, thanks to the cryptography involved, it is mathematically impossible to forge an invalid ZK proof. Validators are a much larger, easier-to-run set of nodes that verify the validity of the ZK proof submitted by the provers. This group serves to hold the provers accountable and ensure censorship resistance.
Instead of a lengthy challenge model with fraud proofs, as is the case for Optimistic rollups (ORs), ZKRs involve a quicker validation period through their validity proof security model, which generates the proof up front as soon as blocks are submitted. From there, the proof can be quickly verified on the L1, allowing for fast user withdrawals. Provers work as aggregators for ZKRs.
Source: ZK Whiteboard Sessions - Module One, by Prof. Dan Boneh
What is zkSNARK?
zkSNARK stands for “Zero-Knowledge Succinct Non-Interactive Argument of Knowledge.” Alessandro Chiesa, a professor from UC Berkeley, co-authored a paper where the term “zkSNARK” was first used. Breaking down the acronym further:
- Zk: “zero knowledge,” used for protecting user’s privacy
- S: “succinct” proofs, referring to data compression, which can be verified in only a few milliseconds. This means that, rather than the Ethereum mainnet validating nodes needing to verify every transaction individually, validators will just verify a small proof to ensure the validity of the transactions. Typically, proofs have a set number of group elements (consider transactions), although the actual proof size is significantly smaller.
- N: Non-Interactive signifies that the prover just needs to send a single message to the verifier instead of exchanging messages back and forth. Non-interactivity is necessary because the prover may generate a single proof that can be verified by anyone, anywhere, without ever requiring information sharing with the prover
- ARK: generate off-chain trusted proofs
zkSNARK is used to construct a proof that allows one party (prover) to prove that the statement is true to the other party (verifier) without revealing any information. ZCash, a privacy-preserving protocol, implemented zkSNARK in 2016 to enable anonymous payments. ZCash is one of the most famous and widely used applications using zkSNARK.
Every ZKP system consists of two basic components: a method of writing a program within an arithmetic circuit and a polynomial commitment plan (PCS). This is the cryptographic toolset that enables us to create succinct proofs. zkSNARK uses elliptic curves for its security. Due to the usage of elliptic curves, zkSNARK proofs are not quantum-resistant.
Many ZKRs utilize a KZG commitment scheme, but it is not without drawbacks. One concern with KZG is that the result is dependent on elliptic curve encryption, but Ethereum does not natively support the elliptic curves optimized for recursion (explained further below). In addition, elliptic curves necessitate the use of bigger finite fields (at least 256 bits) that are less efficient on contemporary CPUs.
They also require a trusted setup for the creation of keys used to create the proofs required for verification. If someone has access to private keys, they can create false proofs and steal funds.
What is zkSTARK?
zkSTARK stands for “Zero-Knowledge Scalable Transparent Arguments of Knowledge.” Eli Ben-Sasson, Michael Riabzev, Iddo Bentov, and Yinon Horeshy published a paper in 2018 titled “Scalable, transparent, and post-quantum secure computational integrity,” where the term “STARK” was coined. STARKs are widely used by StarkEx and StarkNet, scaling solutions built by Starkware team.
zkSTARKs use cryptographic proofs and algebra to impose privacy of computations on blockchains. It allows blockchains to move the computation to an off-chain prover, and then an on-chain verifier can verify the validity of computations.
ZkSTARK offers various improvements over zkSNARK. A trusted setup is not required, so there’s no problem of malicious actors getting access to private keys. It uses a hash function for security and is quantum-resistant. As zkSTARKs are new, documentation, tools and libraries are not yet developer friendly.
zkSTARK provides a solution to the two major drawbacks of zkSNARK. ZkSTARK proofs are also faster and cheaper than zkSNARK. The major problem with zkSTARKs is that they have a larger proof size and take a long time to verify the proofs.
Source: msfew.eth
What is PLONK?
PLONK stands for “Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge.” PLONK was built by Ariel Gabizon, Zac Williamson, and Oana Ciobotaru. Ariel and Zac have also co-founded a privacy-focused rollup called ‘Aztec.’ PLONK requires a trusted setup procedure, but is more secure due to its design than the zkSNARK, which also requires a trusted setup. Due to having a single trusted setup, a PLONK’s proof size is bigger, and proof verification time takes longer.
There are two differences in design that make PLONK trusted setup more secure:
- No need for a separate trusted setup for every program. Instead, one trusted setup is used for the whole scheme. The scheme can be used with any program.
- Multiple parties can participate in a trusted setup, and as long as any one party is honest, the setup remains secure.
PLONK uses KZG commitments based on a trusted setup and elliptic curve pairings. PLONK also allows swapping schemes, such as FRI (where PLONK will turn into a kind of a STARK), or DARK. This means PLONK can be used for various applications as the scheme is compatible with any trade-offs between security and proof sizes.
What is Plonky 2?
Plonky2 is another proving system, originally developed by the Mir team that was later bought by Polygon, that aims to combine the benefits of both SNARKS and STARKs. Plonky 2 is an implementation of recursive SNARK that uses the combination of PLONK and FRI for getting fast proofs with no trusted setup. It also supports the recursion approach, making the process less resource-intensive.
How does the recursion approach work in ZK proofs?
"Recursion" simply refers to the use of a single proof to prove a collection of different proofs. Recursion is a crucial aspect of utilizing ZKPs for blockchain scaling since it allows us to combine a large number of transaction proofs into a single proof, thus decreasing the cost of transaction validation.
Suppose there’s a batch of 1,000 valid transactions. To generate a single proof for 1,000 transactions would be resource-intensive and time-consuming. In a recursive approach, 1,000 machines can be used parallelly to generate 1,000 proofs, one machine for each transaction. These proofs can then be recursively aggregated, with each one verifying two transaction proofs. This process will be repeated again and again until there’s just a single proof.
Plonky 2 is so much more efficient that it takes just 170 milliseconds on a Macbook Pro to create a proof. It’s 100 times faster than other alternatives. It allows us to have fast proofs that are big (meaning it costs a lot to verify on Ethereum), or you can have slower proofs, and it will be inexpensive to verify on Ethereum. Both of these options provide flexibility, and any option can be used according to the application’s requirements.
The cost to verify a Plonky 2-size optimized proof on Ethereum is 1 million gas. If EIP-4488 is implemented, the cost to verify a Plonky 2-size optimized proof on Ethereum can drop to 170k - 200k Gwei.
What is Halo?
Halo is a recursive proof composition that allows blockchains to scale. Sean Bowe, an engineer and cryptographer at Electric Coin Company, discovered this technique. Halo is the first recursive and trustless ZK proof.
After a significant upgrade in May 2022, ZCash has started using Halo. Since Halo doesn't require a trusted setup, anyone can check whether the system is computationally secure. Removing the need for a trusted setup improves the security of the protocols using ZK proofs. It provides a stronger framework for the use cases like digital payments.
Halo 2 is now shared under the MIT license. The Ethereum Foundation uses Halo 2 for its various projects, including the zero-knowledge EVM project.
Ethereum Co-Founder Vitalik Buterin shared his views on Halo 2 and the work done by the ZCash development team: “The Zcash (ECC) team’s work on Halo is both an amazing work of mathematical and cryptographic genius and a significant advancement in the security and efficiency properties that zero-knowledge proof protocols can have. I look forward to seeing more work and more applications in and on top of the Ethereum protocol and the crypto spaces as a whole using Halo code and technologies!”
