Zero Knowledge Proofs Explained | Computerphile

Zero Knowledge Proofs (ZKPs) are cryptographic methods that enable proving statements are true without revealing underlying information, offering significant benefits for blockchain privacy and scalability; zk-SNARKs provide succinct, non-interactive proofs with fast verification but historically required trusted setups, while zk-STARKs offer quantum-resistant, transparent proofs without trusted setups but with larger proof sizes (10-100x bigger), and Mina Protocol leverages recursive zk-SNARKs to maintain constant computational overhead regardless of chain growth.

SNARKs (Succinct Non-interactive Arguments of Knowledge) and STARKs (Scalable Transparent Arguments of Knowledge) are two prominent cryptographic methods for implementing ZKP. SNARKs generate incredibly small and efficient proofs that are fast to verify but require a one-time trusted setup. STARKs generate larger proofs but are transparent and require no trusted setup, relying only on publicly verifiable cryptography.

Zero knowledge proofs (ZKPs) are cryptographic protocols that allow one party (the prover) to prove the validity of a statement to another party (the verifier) without revealing the statement itself; these proofs come in two main types—interactive proofs, which require multiple rounds of back-and-forth communication between parties to build confidence through repeated challenges and responses (demonstrated through the Alibaba Cave Story), and non-interactive proofs, which require only a single round of communication where the prover sends a single response containing both the challenge and answer; the two most common implementations in blockchain are ZK-SNARKs (smaller, faster to verify but requiring a trusted setup with 'toxic waste' keys) and ZK-STARKs (larger but more scalable and transparent, with no trusted setup and plausibly post-quantum secure).

Modern ZK SNARKs consist of four abstraction layers: circuit arithmetization (representing programs as algebraic relations), Polynomial Interactive Oracle Proofs (PIOP) for validating circuit correctness, polynomial commitment schemes (error-correcting code, hash-based, or additive group), and folding schemes for proof composition. Ultra Plonk implements this architecture using Plonk with gates and lookup tables for efficient range checks, multilinear polynomials for faster linear-time evaluation, Xeromorph multilinear polynomial commitment schemes, Protostar folding schemes, and Goblin Flunk as a folding accelerator. This enables proving a million constraints in under five seconds on consumer hardware with 1GB RAM, meeting the unique requirements of privacy-preserving Layer 2 networks.

Zero-knowledge proofs are cryptographic protocols that allow one party to prove they know a piece of information without revealing what that information actually is, possessing three key properties: completeness (honest provers can convince honest verifiers), soundness (dishonest provers cannot convince verifiers of false statements), and zero knowledge (verifiers learn nothing beyond the truth of the statement). ZK-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge) are a specific type of zero-knowledge proof used in modern blockchain technology that enables proving the validity of computations without revealing the underlying data, consisting of three algorithms: a key generator (G) that creates proving and verification keys from confidential inputs, a prover (P) that generates proofs from private statements, and a verifier (V) that validates proofs without knowing the secret information.

ZKP addresses computational complexity in distributed systems by enabling verification without disclosure. Practical applications include privacy-preserving payments where manufacturers prove supplier payments without revealing details, and smart contracts executing with hidden code. Layer 2 scaling solutions integrate ZKP to achieve 100x transaction throughput while maintaining security. The fundamental challenge is balancing privacy with security—implementation flaws can enable attacks like the 2017 Zcash incident where a single symbol error allowed creating infinite money. This demonstrates that theoretical soundness alone cannot guarantee practical security.

Zero-knowledge proofs (ZKPs) have three primary applications: privacy protection, succinctness for efficient verification, and fairness in random processes. When comparing optimistic rollups (requiring 1-2 week fraud challenge periods) with ZK rollups (providing near-instant finality), ZK rollups offer significant time efficiency advantages. The trade-off involves balancing transaction speed against fraud risk, with optimistic rollups requiring collateral or liquidity providers to mitigate risks, while ZK rollups can achieve security without such mechanisms.

Zero knowledge proofs are computationally expensive to verify, with individual proofs potentially costing $100 on Ethereum. ZK rollups solve this scalability problem by aggregating many private transactions into a single verification circuit. Users deposit and withdraw cryptocurrency from the rollup, with all private transactions hidden from the world. Withdrawals are not linkable to depositors, enabling high privacy even for public applications. The recursive architecture uses a tree-like structure where circuits aggregate 32 transactions, scaling to extremely large volumes. This enables practical private transactions on public blockchains while maintaining strong anonymity guarantees.

Zero-knowledge proofs enable transformative applications across privacy, scalability, and security domains. In privacy, ZKPs allow verification without data exposure: age verification proves someone is over 18 without revealing birth date, and ring signatures hide transaction details in privacy coins like Zcash. In scalability, SNARKs enable transaction aggregation where thousands of transactions are verified through a single proof, potentially providing thousands of times faster verification. In security, ZKPs enable private cloud computing where untrusted servers process encrypted data while providing proof of correct computation. In state verification, ZKPs can prove complex state machine transitions (like financial transactions) without revealing underlying data. These applications demonstrate how ZKPs balance privacy with verification, enabling applications where data confidentiality is essential but proof of correctness is required.

ZK verification applications: (1) ZK rollups for scaling; (2) Private transactions; (3) Account abstraction; (4) Quantum-resistant signatures; (5) Simplification of Bitcoin script; (6) The goal is to leverage ZKPs to enhance Bitcoin's capabilities while maintaining its core properties.

Elliptic curve pairings represent a profound example of how pure mathematics has provided essential tools for cryptography. The story begins with Riemann's work on prime number distribution, leading to the Riemann zeta function and its zeros. Mathematicians then explored function fields (fields of rational functions) and eventually algebraic function fields. Hasse's theorem established bounds on elliptic curve sizes over finite fields, which became foundational for elliptic curve cryptography. Weil's proof of the Riemann hypothesis for algebraic function fields introduced the Weil pairing, which became the mathematical basis for all modern SNARKs, polynomial commitment schemes, and signature schemes. This demonstrates how abstract mathematical research can yield practical cryptographic tools decades later.

Pairing functions in elliptic curve cryptography enable multiplication of two encrypted values, producing a result that depends on the product of the underlying unencrypted values. This operation satisfies: if a×b = c×d, then pairing(a,b) = pairing(c,d); and if a×b ≠ c×d, then pairing(a,b) ≠ pairing(c,d). This non-degenerate property enables verification of polynomial relationships without revealing the actual values, forming the basis for succinct zero-knowledge proofs.

A polynomial commitment is a commitment function where the message being committed to is a polynomial. The two fundamental properties are: (1) Binding - it should be computationally infeasible to find a different polynomial that produces the same commitment, and (2) Hiding - the commitment should not reveal information about the polynomial. For polynomial commitments, the hiding property is optional and depends on the use case: SNARKs don't require hiding since there are no secrets, while ZK-SNARKs do require hiding when secrets are involved. Commitment schemes can support different types of homomorphic operations: additive homomorphism allows computing commitments to sums (G^A × G^B = G^(A+B)), while multiplicative homomorphism (computing commitments to products) is not achievable for standard schemes. Bilinear pairings are special mathematical operations that exist on certain elliptic curves called 'pairing-friendly curves.' These curves have a property that allows efficient computation of a pairing operation E that maps two group elements to another group element. The most popular pairing-friendly curve is BLS12-381. The pairing operation has three key properties: (1) Bilinearity - E(G^a, G^b) = E(G, G)^(a*b), (2) Non-degeneracy - E(G, G) ≠ 1 for G ≠ 1, and (3) Non-degenerate pairing - E(G, G) ≠ 1 for G ≠ 1. These properties enable checking multiplication between commitments without revealing the underlying values.

Polynomial commitment schemes enable provers to commit to polynomials without revealing them, allowing later verification of evaluations at specific points. The KZG scheme (Kate-Zaverucha-Goldberg) uses bilinear pairings and a trusted setup where a secret τ generates global parameters g, g^τ, g^(τ²), ..., g^(τ^d). The prover commits to f(τ) using these parameters, and for evaluation at point u, computes a quotient polynomial q(x) such that f(x)-f(u)=(x-u)q(x), then generates a proof π=g^q(τ). Verification uses pairing to check e(commitment/g^v, g) = e(g^(τ-u), π), ensuring correctness without revealing τ. Security relies on the q-Strong Bilinear Diffie-Hellman assumption. Variants include multivariate extensions, zero-knowledge versions using randomizers, and batch opening protocols. Alternative transparent schemes like Bulletproofs, Hyrax, Dory, and Dark eliminate trusted setup but may sacrifice efficiency.

Five major technologies address privacy-preserving computation across different dimensions: (1) Trusted Computing Environments (Intel SGX) provide hardware-based security for trusted execution; (2) Differential Privacy uses statistical methods with privacy budgets to limit query precision; (3) Edge Computing processes data locally before aggregation; (4) Homomorphic Encryption enables computation on encrypted data but supports limited algorithms; (5) Secure Multi-Party Computation (SMPC) allows any function to be computed across distributed encrypted data with mathematical security guarantees, though computationally expensive.

Homomorphic encryption enables computations on encrypted data without decryption, allowing cloud providers to process encrypted data while maintaining confidentiality. The first practical implementation appeared in 2009, with subsequent generations improving performance. Secure Multi-Party Computation (MPC) allows multiple parties to compute functions over private inputs without revealing those inputs, emerging in the 1980s. The 'Millionaire's Problem' demonstrated this concept, solved by Andrew Yao in 1986. These technologies enable privacy-preserving applications including secure cloud computing, collaborative healthcare research during pandemics, and privacy-preserving machine learning, with industry consortia working to establish standards.

Homomorphic encryption enables computation on encrypted data while maintaining mathematical relationships between encrypted values. For additive homomorphic encryption, encrypted values can be added to produce the encryption of the sum, allowing servers to compute without seeing plaintext. This enables private data processing for AI model evaluation. Secure multi-party computation distributes computation across multiple parties, each holding secret shares without knowing complete data. The trust model assumes attackers can compromise only a threshold of parties. These technologies are combined in practice because fully homomorphic encryption is computationally expensive for large-scale computations, while MPC offers more efficient alternatives in certain settings.

Three key privacy-preserving technologies support federated learning: (1) Secure Multi-Party Computation (MPC) provides security proofs but suffers from 10,000x efficiency overhead; (2) Differential privacy introduces noise to obscure identities but creates accuracy trade-offs and doesn't completely prevent data leakage; (3) Homomorphic encryption preserves mathematical operations on encrypted data but requires approximation for non-linear computations. The Deep Leakage from Gradients attack demonstrated that differential privacy alone cannot prevent data reconstruction, highlighting the need for stronger methods.

Cloud storage creates fundamental privacy challenges because encrypted data cannot be searched or processed by the cloud provider. Traditional encryption prevents computation on encrypted data, creating a tension between data utility and confidentiality. Rivest, Adleman, and Dertouzos proposed in 1978 the concept of homomorphic encryption—computing on encrypted data such that decrypting the result yields the correct plaintext output. Additively homomorphic schemes allow addition operations on ciphertexts, while multiplicatively homomorphic schemes allow multiplication. The breakthrough came in 2009 with fully homomorphic encryption, enabling any function to be computed on encrypted data.