zk-SNARK (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge)

A zk-SNARK (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) is a type of cryptographic proof that lets one party convince another that a statement is true, and that it holds the secret information behind it, without revealing that information. The proof is tiny, quick to check and needs no back-and-forth between the two parties. Blockchains use zk-SNARKs to hide transaction details and to compress large amounts of computation into a single proof that a smart contract can verify cheaply.

zk-SNARKs are one family within the wider field of zero-knowledge proofs. They were first used at scale by Zcash, launched in 2016, and now underpin many ZK-rollups on Ethereum. They are often compared with zk-STARKs, a related design that avoids a trusted setup at the cost of larger proofs.

Imagine a teacher who must mark ten thousand pages of arithmetic. Instead of re-doing every sum, she receives a sealed certificate the size of a postage stamp. A quick glance at the stamp tells her, with near certainty, that every sum in the pile is right. She never sees the working, and she does not need to ask the student any questions.

A zk-SNARK is that stamp. The "zero-knowledge" part means the stamp reveals nothing about the private details. "Succinct" means it stays small however big the job was. "Non-interactive" means it is sent once and checked once, with no conversation. "Argument of knowledge" means whoever made it must genuinely have known the hidden inputs, not just guessed the answer.

The computation to be proven, such as "this transaction spends a coin I own and the totals balance", is first rewritten as an arithmetic circuit: a long list of additions and multiplications over a finite field. The prover runs the circuit on its private inputs and produces a proof that every gate was satisfied. The verifier checks the proof using a short public verification key.

• Setup. Most early schemes need a one-time setup that generates public parameters. Random values used to create them, nicknamed "toxic waste", must be destroyed, otherwise someone could forge proofs.
• Proving. Proof generation is computationally heavy and is the main cost of the system, often taking seconds to minutes on powerful hardware.
• Verification. Checking a proof takes milliseconds and costs a predictable amount of gas on Ethereum, which supports the needed elliptic-curve pairing operations natively in the EVM.

The underlying security rests on number-theoretic assumptions about elliptic curves, part of modern cryptography. Like other pairing-based systems, classic zk-SNARKs are not considered resistant to future quantum computers.

The term SNARK was coined in academic work by Nir Bitansky, Ran Canetti, Alessandro Chiesa and Eran Tromer around 2012, and the 2013 Pinocchio system showed that such proofs could be practical. Several proving systems followed:

• Groth16. Published by Jens Groth in 2016, it produces some of the smallest proofs known, roughly two hundred bytes, but needs a new trusted setup for every circuit.
• PLONK. Introduced in 2019 by Ariel Gabizon, Zachary Williamson and Oana Ciobotaru, it uses a single "universal and updatable" setup that any circuit up to a given size can reuse, which made it popular with rollup teams.
• Halo and Halo 2. Developed by the Electric Coin Company, these use recursive proof techniques that remove the trusted setup altogether.

Zcash traces this history. Its 2016 launch used a six-person setup ceremony; the 2018 Sapling upgrade moved to Groth16 with a much larger multi-party ceremony; and the 2022 NU5 upgrade introduced the Orchard pool, built on Halo 2 with no trusted setup. Zcash's shielded transactions are the best-known use of zk-SNARKs for a privacy coin.

The two main uses are privacy and scaling, though the same tool supports other applications:

• Private payments. Shielded transfers prove that no coin is spent twice and that inputs equal outputs, without publishing sender, receiver or amount. This tackles double spending without exposing the public ledger details.
• Rollups. Layer 2 networks such as ZKsync and parts of the Polygon ecosystem execute thousands of transactions off-chain and post one validity proof to Ethereum, which helps with blockchain scaling.
• Verifiable computing. Newer fields such as zkML and the zkOracle apply the same idea to machine-learning results and off-chain data.
• Compliance proofs. Researchers and some firms have proposed using zero-knowledge proofs for proof of reserves or for showing a customer passed checks without sharing personal data, a form of privacy-enhancing technology.

zk-STARKs (Scalable Transparent Arguments of Knowledge), described by Eli Ben-Sasson and colleagues in 2018, rely only on hash functions rather than elliptic-curve pairings. The trade-offs are summarised below.

Many production systems now mix the two, for example generating a STARK and then wrapping it in a SNARK to shrink the final proof posted on-chain.

A compromised trusted setup would allow undetectable forgery, which is why ceremonies involve many independent participants: the setup is safe if at least one of them destroyed their secret. Circuits are hard to write and audit, and bugs in circuit code have caused real vulnerabilities; in 2019 Zcash disclosed and quietly fixed a flaw in its original parameters that could have allowed counterfeiting. Proof generation is expensive, which pushes work towards specialised provers and raises centralisation concerns. Regulators have also scrutinised privacy uses because hidden transactions complicate blockchain analytics and anti-money-laundering checks.

• Zcash: What are zk-SNARKs?
• ethereum.org: Zero-knowledge proofs