What is zero-knowledge proof (zk-proof)?

A cryptographic proof that a statement is true without revealing the data behind it, such as proving a batch of transactions is valid without publishing every one.

The idea comes from academic cryptography in the 1980s, in work by Goldwasser, Micali and Rackoff, and sat mostly theoretical for decades. What changed is that modern constructions became efficient enough to verify on a blockchain, which is an environment where every verifier repeats the work and space is expensive.

The name misleads. In most blockchain uses the valuable property is not privacy at all. It is that a proof can be far smaller and cheaper to check than the computation it attests to.

How it works

A proof system has a prover and a verifier. The prover knows something, a set of transactions, a private key, a date of birth, and produces a proof that a stated claim about it holds. The verifier checks the proof and learns only whether the claim is true.

Three properties define the construction. Completeness means a true statement can always be proved. Soundness means a false one cannot be, except with negligible probability. Zero knowledge means the proof reveals nothing beyond the truth of the statement.

Blockchains care about a fourth property that is separate from all three: succinctness. A succinct proof is small and checkable in roughly constant time no matter how large the underlying computation was. That is what makes a zk rollup possible, because a base chain can verify that thousands of transactions executed correctly without executing any of them.

The families differ in their tradeoffs. A zk snark produces very small proofs and usually needs a trusted setup, a one-time ceremony producing public parameters whose secret must be destroyed. A zk stark needs no setup and relies only on hash functions, at the cost of larger proofs.

Example

Illustrative, and deliberately not about blockchains. A venue needs to know you are over 18. The ordinary approach is to show a document, which reveals your name, address, exact date of birth, and document number.

A zero-knowledge proof lets you prove the single statement "my date of birth is before this date" from a credential issued by an authority. The venue verifies the proof and learns one bit: yes. It learns nothing else, and cannot correlate you with anyone else who proved the same thing.

The blockchain version substitutes "these 5,000 transactions were executed correctly against this prior state" for the age claim, and a base chain contract for the venue.

Why it matters when you buy

You are unlikely to interact with a proof directly, and you will use chains built on them. Layer 2 networks using validity proofs settle withdrawals in minutes rather than the multi-day window optimistic designs require, which changes how quickly funds move back to an exchange or a base chain. The chain pages cover settlement behavior by network, and the guide on layer 1 versus layer 2 covers the categories.

Related terms

• zk snark: succinct proofs with a trusted setup
• zk stark: hash-based proofs without one
• validity proof: the rollup application of these systems
• zk rollup: the layer 2 design built on them
• shielded transaction: the privacy application
• privacy coin: assets using proofs to hide amounts

Questions

Does a zk-rollup keep my transactions private?

Generally no. Most publish transaction data on the base chain so anyone can reconstruct the state. The zero-knowledge machinery is used for compression and verification rather than for hiding anything.

What is a trusted setup?

A one-time ceremony generating public parameters for certain proof systems. If the secret used to create them is retained, false proofs become possible, which is why setups are run as multi-party ceremonies where only one participant needs to be honest.

Are these proofs quantum resistant?

Hash-based systems such as STARKs are considered post-quantum candidates. Pairing-based SNARKs are not, which is one reason the two families continue to coexist.