What is zero-knowledge proof? Privacy and Extensibility Analysis

Zero-knowledge proof: Principles, applications and limitations

Zero-knowledge proof is a cryptographic technique that allows one party to prove to the other that a statement is true without revealing any information beyond the authenticity of the statement itself. It is the core technology behind blockchain privacy protection, scalability Rollup and the growing number of authentication systems.

Overview

Zero-knowledge proof allows a prover to prove to a verifier that the calculation has been performed correctly without revealing the underlying data, achieving privacy and scalability on the blockchain.

The two main types of zero-knowledge proofs used in blockchain are: zk-SNARKs (requiring an initial trusted setting ceremony) and zk-STARKs (requiring no trusted setting, but the generated proof is larger).

Ethereum second-layer Rollup, such as zkSync, Scroll and Polygon zkEVM, uses zero-knowledge proof to compress thousands of transactions into a single proof and verify it on the main chain, reducing Gas fees by 90% or more.

Vitalik Buterin introduced the GKR protocol at the end of 2025, aiming to accelerate the verification of Ethereum zero-knowledge proof and enable the technology to be applied on a large scale in daily scenarios.

Zero-knowledge proof is mathematically reliable, but it is not magic. They rely on specific cryptographic assumptions, require a large amount of computing resources, and have been put into large-scale production in less than three years.

Core Three Attributes

Zero-knowledge proof must satisfy three mathematical attributes:

Completeness : If the statement is true and both the prover and the verifier follow the agreement, the verifier will always accept the certificate.

Reliability : If the statement is false, no cheating prover will be able to get the verification to accept it unless there is a negligible probability.

Zero-knowledge : The verifier will not learn anything other than knowing whether the statement is true.

The third attribute is the most counter-intuitive. How to verify the correctness of calculations without knowing what they are doing? The answer lies in proving the structure of the system. The prover encodes the calculation into a polynomial equation, commits to the polynomial using a cryptographic commitment scheme, and then responds to a random challenge posed by the verifier. The verifier checks the response against the promise without having to look at the polynomial itself.

In the non-interactive zero-knowledge proof used in blockchain, random challenges are replaced by applying a hash function to commitments. This is called the Fiat-Shamir heuristic, and it allows the prover to generate a complete proof without having to communicate back and forth. The final proof is a compact string of data that anyone can independently verify.

Its mathematical foundation depends on the difficulty of certain computational problems. For zk-SNARKs, security is based on the difficulty of calculating discrete logarithm on an elliptic curve. For zk-STARKs, security is based on the collision resistance of the hash function, which is considered a weaker and more conservative assumption. If either of these two assumptions is proved wrong, the corresponding proof system will collapse. This is why when choosing between zk-SNARKs and zk-STARKs, there is more than just the size of the proof and the speed of the verification.

zk-SNARKs: Trusted settings, proving small

zk-SNARK stands for "zero-knowledge concise non-interactive knowledge demonstration." "Concise" is the key difference: the zk-SNARK proof is very small, usually only a few hundred bytes, and verification can be completed in milliseconds no matter how complex the underlying calculations are.

The price for this simplicity is trusted settings. Most zk-SNARK constructions require an initial ritual that generates a set of structured reference strings. These strings are used together by provers and verifiers. If the random values used in the generation process are not properly destroyed, anyone who retains these values can forge a certificate that appears to be valid. This is sometimes referred to as "toxic waste".

Modern trusted setting rituals use a multi-party computing protocol, with hundreds or thousands of participants each contributing randomness. The security guarantee is that the setting is safe as long as at least one participant honestly destroys his random contribution. Zcash pioneered this approach through its Powers of Tau ceremony, which was improved on by subsequent projects.

Newer zk-SNARK constructs, such as PLONK and its variants, use universal and updatable trusted settings, which means that the same setting can be used for different circuits, and subsequent participants can enhance settings over time without having to start from scratch. This alleviates concerns about trusted settings, but does not completely eliminate them. The fundamental trade-off remains: trade a one-time trust assumption for a smaller, faster proof.

zk-STARKs: No trusted settings are required to prove large

zk-STARK stands for "zero-knowledge extensible transparent knowledge demonstration." Among them,"transparency" means no need for trusted settings. The reference string is generated from publicly verifiable randomness, completely eliminating the "toxic waste" problem. "Scalable" means that proof time increases quasi-linearly with the scale of the calculation, making STARKs suitable for very large calculations.

The price is the proof size. The zk-STARK proof is usually tens to hundreds of kilobytes, while zk-SNARK is only a few hundred bytes. On blockchain, where data storage is expensive, this difference is crucial. The verification time of STARKs is also slightly longer, but it is still fast enough for practical applications.

StarkWare, the company behind Starknet, is the main business advocate of zk-STARKs. They believe that transparency and the quantum resistance of relying solely on hash functions rather than elliptic curves make STARKs a better long-term choice, even at the cost of proving larger size. Whether quantum computers will truly threaten elliptic curve cryptography within the relevant time frame remains controversial, but this conservative security stance is attractive for application scenarios where long-term robustness is more important than immediate efficiency.

ZK Rollup: The killer application of scalability

The most important practical application of zero-knowledge proof in blockchain today is ZK Rollup. Rollup executes transactions offline, packages them, generates a zero-knowledge proof that all transactions are valid, and then publishes the proof and compressed transaction data to the main chain. The main chain verifies the certificate, which costs several orders of magnitude less than executing each transaction individually.

This architecture allows the Ethereum Layer 2 network to process thousands of transactions at the cost of a single proof verification. In practice, ZK Rollup, built on Ethereum infrastructure, reduces Gas fees by 90% or more compared to executing the same transaction directly on the main network.

As of mid-2026, the major ZK Rollup projects that are in production or in advanced development stages include: zkSync Era, Scroll, Polygon zkEVM, Linea and Taiko. Each project uses a different attestation system, making different tradeoffs between EVM compatibility, attestation speed, and degree of decentralization. zkSync uses a custom virtual machine and is based on PLONK certification. Scroll is committed to using the zk-SNARK prover to achieve byte-level EVM equivalence. Polygon zkEVM uses a combination of STARK and SNARK proofs in a recursive architecture.

Competition between these projects is driving rapid innovation in the field of proof generation. In the past two years, the certification time has been shortened from hours to minutes to seconds. Vitalik Buterin's introduction of the GKR protocol for Ethereum is another step towards making ZK proof verification a routine operation rather than a computing bottleneck.

Privacy applications beyond Rollup

Zero-knowledge proof was originally developed for privacy rather than scalability. Launched in 2016, Zcash is the first mainstream blockchain to use zk-SNARKs to implement private transactions. In Zcash's blocked transactions, the sender, recipient and amount are hidden from the public, while the certificate ensures that no new coins have been created out of thin air and that no double payments have occurred.

Privacy applications have gone beyond financial transactions. Zero-knowledge proof can verify identity attributes without revealing underlying data. Users can prove that they are 18 years old without revealing their date of birth, that they are a citizen of a country without revealing their passport number, or that they hold a certificate without revealing the issuing authority.

Projects such as Worldcoin and Polygon ID have implemented ZK-based authentication systems. Worldcoin uses zero-knowledge proof to verify whether a person has been scanned by its iris scanning device without having to associate the scan results with any specific identity. Ethereum ecosystem projects are increasingly integrating ZK-based authentication as a raw feature in addition to financial transactions.

Privacy use cases face regulatory resistance. Financial regulators in multiple jurisdictions have expressed concern that fully private transactions could contribute to money laundering, sanctions evasion and terrorist financing. The tension between privacy as a fundamental right and transparency as a regulatory requirement is one of the most decisive policy debates in the cryptocurrency space, and zero-knowledge proof is at the heart of this debate.

Areas that cannot be covered by zero-knowledge proof

Zero-knowledge proof guarantees computational integrity: that is, a specific calculation has been performed correctly. They do not guarantee that the inputs to a calculation are correct, that the calculation itself is worth executing, and that the system built around proof is free of loopholes.

ZK Rollup can prove that a batch of transactions comply with Rollup's rules, but cannot prove that the rules themselves are correct. Vulnerability in Rollup smart contracts or attestation circuits may cause invalid state transitions to be generated as a valid attestation. During the deployment of the Audit and Test Network, multiple ZK Rollup projects have disclosed and patched critical vulnerabilities in their circuits.

Zero-knowledge proof also does not eliminate the need for data availability. In ZK Rollup, certification informs the main chain of state transitions is effective, but users still need to access the underlying transaction data to rebuild state and verify that their funds are intact. Without data availability, users must trust Rollup operators, which to some extent violates the original intention of the demonstration.

Generating a proof is computationally expensive. Although verification is cheap, proof generation requires a lot of hardware. Running ZK Prover at production scale typically requires servers equipped with hundreds of gigabytes of RAM and dedicated hardware accelerators. This cost creates a natural centralized force that limits who has the ability to run the prover, even though the proof itself can be verified by anyone.

Practical checklist for evaluating ZK projects

When evaluating projects that claim to use zero-knowledge proof, the following questions can help distinguish true implementation from marketing hype.

First, ask if the certification system has been independently audited. Circuit leaks can cause reliability flaws that allow invalid certificates to be accepted as valid. Projects that have not been audited by multiple independent cryptography companies should be treated with caution.

Secondly, ask if the attestation system uses trusted settings, and if so, how the ceremony is carried out. Trusted settings in which only a few participants participate, or settings made by a single company without external verification, represent meaningful trust assumptions.

Third, check whether the project discloses its certification verification contracts and whether these contracts have been verified on-chain. If verification is done off-chain or through a scalable agent contract controlled by multiple signatures, zero-knowledge proof may not provide the security guarantees that users expect.

Fourth, look at data availability solutions. If the project does not publish transaction data to the chain or to a trusted data availability layer, users will not be able to independently verify status and must trust the operator. This is a serious departure from the "no-trust" nature that zero-knowledge proof should achieve.

FAQ

In simple words, what is a zero-knowledge proof?
Zero-knowledge proof is a way to prove that you know something without revealing what you know. In blockchain, it allows one computer to prove to another that a set of transactions is valid without showing the details of those transactions. This achieves both privacy and scalability.

What is the difference between zk-SNARKs and zk-STARKs?
The proof generated by zk-SNARKs is very small (usually a few hundred bytes) and fast verification, but requires a one-time trusted setup ritual. The proof generated by zk-STARKs is large (usually tens of kilobytes), but does not require any trusted settings and is believed to be resistant to quantum computing attacks. Both achieve the goal of verifiable computing under zero-knowledge.

How does ZK Rollup reduce Ethereum Gas fees?
ZK Rollup executes transactions outside the Ethereum main chain, packages them together, and generates a zero-knowledge proof that all transactions are valid. Only the certificate and compressed data were published on Ethereum. The cost of verifying a single certificate is much lower than executing thousands of separate transactions, reducing Gas fees by 90% or more.

Is zero-knowledge proof resistant to quantum computing?
This depends on the proof system. Zk-STARKs relies on hash functions, which are believed to be resistant to quantum computers. Zk-SNARKs rely on elliptic curve cryptography and could theoretically be cracked by a sufficiently powerful quantum computer. However, practical quantum computers capable of cracking elliptic curves do not yet exist and may not appear for decades to come.

Can zero-knowledge proof make all blockchain transactions private?
Technically feasible, but there are trade-offs in practice. Generating certificates for each transaction increases computational costs and complexity. Completely private transactions also face regulatory challenges in jurisdictions that require financial transparency. Projects like Zcash provide optional privacy, while most ZK Rollups use the technology primarily for scalability rather than privacy.

What is a trusted setting and why is it important?
Trusted settings are one-time rituals used to generate cryptographic parameters required by certain attestation systems. If the random values used during the ceremony are not properly destroyed, someone may create false certificates. Modern rituals use multi-party computing, with hundreds of participants contributing randomness, and the setting is safe as long as at least one participant is honest.

Which blockchains use zero-knowledge proofs?
Zcash is the first mainstream blockchain to use zero-knowledge proof to enable private transactions. Ethereum uses ZK certification through two-layer Rollup (including zkSync, Scroll, Polygon zkEVM, Linea and Starknet). Mina Protocol uses recursive ZK proof to maintain a fixed-size blockchain. Several other chains also use ZK technology for specific functions, such as authentication or cross-chain messaging.

How long does it take to generate a zero-knowledge proof?
Proof generation time depends on the complexity of the calculation and the hardware used. For ZK Rollup batches containing thousands of transactions, the current certificate generation time takes seconds to minutes on dedicated hardware. Two years ago, the same certification would take hours. Through hardware acceleration and algorithm improvements, the trend is towards faster proof generation, with the goal of real-time proof.