Groth16 Proofs in Zero-Knowledge Technology
Groth16 is a widely used cryptographic proving system for generating
zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge)
12. It allows a "prover" to demonstrate the validity of a statement to a "verifier" without revealing any underlying sensitive data
2.
Key Characteristics and Advantages
Groth16 is primarily distinguished by its efficiency and succinctness, making it a preferred choice for blockchain environments where storage and computational resources are limited
12.
- Constant Proof Size: Groth16 produces some of the smallest proofs in the zero-knowledge ecosystem, typically around 300 bytes 45.
- Fast Verification: The time required for a verifier to check a proof is constant and extremely fast, regardless of the complexity of the original program .
- Low On-Chain Costs: Due to its small size and simple verification operations, Groth16 is cheaper to verify on Ethereum Virtual Machine (EVM) chains compared to many other systems 4. Verification on Ethereum typically costs approximately 250,000 gas 5.
- Pairing-Based Cryptography: It utilizes pairing-friendly elliptic curves, such as BN254 and BLS12-381, to facilitate secure and efficient verification 5.
The Proving Process
To generate a Groth16 proof, a program must first be converted into a mathematical format that the system can process:
- Arithmetic Circuit: The program is written as an arithmetic circuit or using a Domain Specific Language (DSL) 5.
- Rank-1 Constraint System (R1CS): The circuit is transformed into a system of equations known as R1CS [5.
- Polynomial Encoding: These equations are encoded into univariate polynomials, which are then used to generate the final cryptographic proof 5.
The Trusted Setup Requirement
A significant characteristic of Groth16 is the requirement for a
trusted setup 5.
- Common Reference String (CRS): Before proofs can be generated or verified, a setup ceremony must be performed to create a CRS 6.
- Security Limitation: This setup must be performed for each unique circuit or program 5. If the "toxic waste" (the secret parameters used during the setup) is not destroyed and the setup is compromised, an attacker could potentially forge proofs 6.
- Ceremonies: To mitigate risks, these setups often involve multiple participants in a decentralized ceremony, where the security of the system is maintained as long as at least one participant is honest 6.
Use Cases and Implementations
Groth16 is employed across various privacy and scaling solutions:
- Proof Compression (Wrapping): Systems like ZKsync, Risk Zero, and Polyhedra use Groth16 as a "wrapper" 48. They may use faster systems like STARKs for initial computations and then "wrap" the result into a Groth16 proof to make it small enough for cheap on-chain verification 48.
- Privacy Protocols: ZK Bob uses Groth16 to verify user balances in smart contract wallets privately .
- Cross-Chain Infrastructure: It is used in zkBridge to compress large proofs into a succinct format for EVM blockchains 8.
- Private Payments: Projects on the Stellar network have utilized Groth16 for private payment architectures with built-in compliance 6.