What is a zk-SNARK?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 6 min
In short
A zk-SNARK is a zero-knowledge proof that is tiny and verifies almost instantly. The trade-off is that most constructions need a trusted setup, and if the secret randomness from that ceremony survives, someone can forge proofs. zk-SNARKs are the workhorse of Ethereum's ZK rollups.
Key points
- Proofs are a few hundred bytes and verify in milliseconds
- Most constructions require a trusted setup
- Leftover setup secrets allow forged proofs
- PLONK-style schemes reuse one universal setup
Definition
Short for Zero-Knowledge Succinct Non-interactive ARgument of Knowledge: a family of zero-knowledge proofs that are compact and require no back-and-forth with the verifier.
The acronym describes the properties. Succinct means the proof is small; non-interactive means the prover sends it once with no dialogue. Both matter enormously when the verifier is a smart contract paying gas for every byte. Groth16 proofs, for instance, are on the order of 200 bytes.
The catch is the trusted setup. Launching a proof system generates shared parameters, and the randomness used — the 'toxic waste' — must be destroyed. If it survives, its holder can produce proofs of false statements. In practice setups are run as multi-party ceremonies with hundreds or thousands of participants, safe as long as a single honest participant deleted their share.
Groth16 needs a fresh ceremony per circuit. Newer schemes such as PLONK and Marlin use a universal setup that can be reused when the circuit changes. ZK rollups like zkSync and Scroll rely on SNARK-family proofs to submit the correctness of their state transitions to Ethereum.
Watch out for
- · If a project will not publish its ceremony participants and transcript, you cannot rule out forgery
- · A small proof says nothing about whether the circuit encodes the right rules
- · Zero knowledge does not automatically mean anonymous; what is hidden is a design choice