0% read
Last updated:
Zero-Knowledge Proof (ZKP)
Zero-knowledge proof (ZKP) is a cryptographic method that allows one party (the prover) to convince another party (the verifier) that a statement is true without revealing any information beyond the truth of the statement itself.
ZKPs enable parties to prove possession of secret information or the correctness of a computation while keeping the underlying data hidden, which makes them useful for privacy protection and security in areas such as authentication, digital identity, and blockchain systems.[1]
Overview
A proof of knowledge is a cryptographic proof in which a prover convinces a verifier that it knows some information, such as a secret key, without revealing the information itself. The prover is the entity or program that creates the cryptographic proof, while the verifier is the entity or program that checks the proof.
Zero-knowledge proofs (ZKPs) are a special class of proofs of knowledge with the additional property that the verifier learns nothing beyond whether the statement is true. In an ideal zero-knowledge protocol, if a statement is true and the prover follows the protocol correctly, the verifier becomes convinced but gains no usable information about the witness or secret used to construct the proof.[7][11]
ZKPs are used in a range of systems that require privacy-preserving verification, including authentication protocols, digital identity schemes, and blockchain-based applications such as private transactions and scalable rollups.[14][1]
History
The formal concept of zero-knowledge proofs was introduced in 1985 by Shafi Goldwasser, Silvio Micali, and Charles Rackoff in the paper “The Knowledge Complexity of Interactive Proof-Systems,” which defined interactive proofs and showed how a prover could convince a verifier of a statement’s truth without revealing the underlying witness.[11] Early constructions were mainly of theoretical interest because they were too inefficient for practical deployment.
In the 2010s, more efficient non-interactive zero-knowledge systems such as zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge) enabled practical applications. The privacy-focused cryptocurrency Zcash launched in 2016 as one of the first large-scale deployments of zk-SNARKs, using them to allow shielded transactions that are fully encrypted on-chain yet still verifiable under the network’s consensus rules.[8][12]
Subsequent work introduced zk-STARKs (Zero-Knowledge Scalable Transparent Arguments of Knowledge), which avoid trusted setup and aim for better scalability, as well as other proof systems such as Bulletproofs used for confidential transactions in coins like Monero.[9][13] Major smart contract platforms, including Ethereum, adopted support for ZKP-friendly cryptographic primitives, helping drive the emergence of zk-rollups, zkEVMs, and other scaling solutions that rely on ZKPs to verify off-chain computation.[14][15]
Recent research focuses on improving proof generation speed, verifier efficiency, and composability, including recursive proof systems that can aggregate many proofs into one and zk-virtual machines (zkVMs) that can prove the correct execution of general-purpose programs.[15]
How It Works
At a high level, a zero-knowledge proof involves two roles: a prover, which possesses some secret information or has performed a computation, and a verifier, which wants assurance that a statement about that secret or computation is true. The prover encodes its knowledge into a proof, using randomness and cryptographic commitments, and sends this proof (and possibly some public inputs) to the verifier, which then runs a verification algorithm to check whether the proof should be accepted.[2]
Most ZKP constructions can be described in terms of proving statements about computations: a prover shows that it correctly executed a program on some (possibly hidden) inputs and obtained a certain output. Modern systems encode the computation as an arithmetic circuit or constraint system, then generate a succinct proof that these constraints are satisfied without revealing the underlying inputs. The verifier checks the proof using public parameters and the claimed outputs; if the proof verifies, the verifier accepts the statement as true.
Zero-knowledge proofs are typically designed to satisfy three core properties. Completeness means that if the statement is true and the prover follows the protocol correctly, an honest verifier will be convinced. Soundness means that if the statement is false, no cheating prover can convince the verifier except with negligible probability. Zero-knowledge means that the verifier learns nothing other than the fact that the statement is true, often formalized by requiring that the verifier’s view of the interaction can be simulated without access to the witness.[14]
Modern proof systems also focus on efficiency and composability. Succinct systems like zk-SNARKs and zk-STARKs aim for very short proofs and fast verification, enabling use on blockchains where on-chain computation is expensive. Recursive proof techniques allow a proof to attest to the validity of other proofs, which is important for scaling rollups and aggregating many transactions or computations into a single succinct proof.[7][15]
Types
There are several major types of zero-knowledge proofs, which differ in how interaction works, how efficiency is achieved, and what assumptions they rely on:
- Interactive ZKPs: These involve a series of challenges and responses between the prover and the verifier. The verifier sends randomness or challenges, and the prover responds in multiple rounds, after which the verifier decides to accept or reject.[3][4]
- Non-interactive ZKPs: These require only a single message from the prover to the verifier. Non-interactive proofs are often constructed using common reference strings or public randomness and are convenient for blockchain and distributed systems where interaction is costly.[4][5]
- Sigma protocols: These are three-move interactive proofs (commit, challenge, response) that provide zero-knowledge for discrete-log-style statements and serve as building blocks for more complex protocols.[6]
- zk-SNARKs: Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge are non-interactive proofs that are very short and fast to verify, making them suitable for proving statements about complex computations. Many blockchain privacy protocols and zk-rollups use zk-SNARKs to prove transaction validity or off-chain execution.[8][7]
- zk-STARKs: Zero-Knowledge Scalable Transparent Arguments of Knowledge are non-interactive proofs that emphasize scalability and transparency. They avoid trusted setup by relying on publicly verifiable randomness and are designed to support very large computations with comparatively efficient verification.[9][7]
Beyond these categories, modern systems introduce general-purpose proof frameworks such as zk-virtual machines (zkVMs), which can prove correct execution of arbitrary programs written in mainstream languages, and recursive proof systems that can aggregate many smaller proofs into a single succinct proof. These approaches are used extensively in scalable rollups and verifiable computation services.[14][15]
Examples
- Schnorr signature: A cryptographic signature scheme that allows users to prove they own a private key without revealing the key itself. An algorithm leveraging elliptic curve cryptography known for its simplicity, Schnorr signatures were historically proposed as an upgrade on Bitcoin’s technology roadmap from the Elliptic Curve Digital Signature Algorithm (ECDSA) and were later activated on Bitcoin in November 2021 as part of the Taproot soft fork. Schnorr is often described as simple, with provable security properties and linearity, and requires fewer computations than ECDSA, which makes it suitable for cryptocurrency transactions.[10]
- ZK-SNARKs: A type of non-interactive ZKP that uses advanced cryptography to prove complex statements efficiently. The acronym ZK-SNARK stands for Zero-Knowledge Succinct Non-Interactive Argument of Knowledge and refers to a proof construction where one can prove possession of certain information, such as a secret key, without revealing that information and without any interaction between the prover and verifier. Zcash was one of the first widespread applications of zk-SNARKs, using them so that shielded transactions can be fully encrypted on the blockchain yet still be verified as valid under the network’s consensus rules.[8][12]
- ZK-STARKs: Another type of non-interactive ZKP that is based on polynomial commitments and designed for better scalability and transparency than many zk-SNARK constructions. Ethereum and related projects support ZKP protocols such as zk-SNARKs and zk-STARKs to enable private transactions, verifiable off-chain computation, and scaling solutions on the network.[9][14]
- Bulletproofs: Monero upgraded the code for its Bulletproofs ZKP system to the Bulletproof+ solution. Bulletproofs are non-interactive ZKPs that, among other uses, can prove that a payment amount lies in a valid range without revealing the actual amount. This helps ensure that no one can trace the sender, receiver, or amount of each transaction, except for the parties involved and those they authorize.[13]
Use Cases and Applications
ZKPs have a wide range of applications wherever it is useful to prove a fact or computation result without revealing the underlying data. In privacy-preserving authentication, users can prove they know a password or possess a credential without sending it to the service, reducing the risk of credential theft. In anonymous credential systems, users obtain verifiable credentials from an issuer and later prove properties about those credentials (such as age or membership) without revealing their full identity.[1]
In secure voting schemes, ZKPs can help voters demonstrate that their vote was formed correctly and counted, without revealing how they voted. Similar techniques apply to privacy-preserving surveys and auctions, where participants need assurance of correct tallying or clearing prices without exposing individual bids or answers.[1]
In blockchain systems, ZKPs underpin both privacy coins and scaling solutions. Privacy-oriented cryptocurrencies such as Zcash and Monero use ZKPs to hide transaction details (amounts and addresses) while still allowing public verification that no coins are created or destroyed. On smart contract platforms like Ethereum, zk-rollups and zkEVMs batch many transactions off-chain, generate a succinct proof that all state transitions were computed correctly, and post this proof to the main chain, improving scalability while preserving security. Related designs like validium and volition store data off-chain or optionally on-chain while using ZKPs to prove validity of state updates, trading off data availability, cost, and privacy.[14][15]
ZKPs are also used in digital identity and regulatory compliance scenarios. Users can prove attributes such as nationality, age, or accreditation status without disclosing full identity documents, which is relevant for know-your-customer (KYC) and anti-money-laundering (AML) regimes that seek to minimize data exposure. Central bank digital currency (CBDC) designs and privacy-preserving payment systems explore ZKPs to allow regulators necessary visibility while shielding routine transaction details from broad disclosure.[1]
Beyond finance, ZKPs support verifiable computation and data integrity use cases. In cloud computing, a server can prove it executed a client’s computation correctly (for example, a machine learning model evaluation) without the client needing to re-run the computation. In data-sharing and AI pipelines, ZKPs can attest to properties of datasets or model training—such as adherence to certain constraints or provenance requirements—without revealing raw data, which is important for sensitive or proprietary information. These patterns extend to supply-chain tracking, medical research, and other domains where entities must verify claims over confidential data.[14]
Challenges
While ZKPs offer significant benefits, they also face several challenges that affect adoption and design choices. Many constructions are computationally intensive, especially on the prover side, which can make generating proofs expensive or slow for complex statements or large-scale applications. Although modern systems and hardware acceleration have improved performance, reducing proving time remains an active area of research, particularly for blockchain rollups and verifiable computation services.[15]
Another challenge is standardization and interoperability. There is no single standard for ZKPs, and different protocols (such as zk-SNARKs, zk-STARKs, Bulletproofs, and zkVM-based systems) make different trade-offs in terms of trust assumptions, performance, and proof size. This variety can hinder composability across platforms and slow down the development of common tooling and libraries.[6]
Security and trust assumptions are also important considerations. Some constructions rely on a trusted setup ceremony to generate public parameters; if this process is compromised, the soundness of the system can be at risk. Implementations must also handle subtle cryptographic and protocol-level vulnerabilities, as ZKPs are complex and errors can be difficult to detect. Finally, ZKP systems can be challenging to understand and integrate for developers and users, creating usability and education barriers that tools and documentation efforts aim to reduce.[14]
See something wrong?
