zk-SNARKs

Imagine proving to a border guard that your passport is valid — without letting them read your name, nationality, or photo. That impossibly sounds like magic. In 2013 it became engineering.

zk-SNARKs — Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge — are cryptographic proofs with three extraordinary properties at once:

• Zero-knowledge: the proof leaks nothing about the secret beyond the bare fact that it exists.
• Succinct: the proof is tiny (a few hundred bytes) and verifies in milliseconds, regardless of how hard the computation was.
• Non-interactive: there is no back-and-forth dialogue — the prover sends one message and the verifier is done.

The theoretical foundations were laid by Goldwasser, Micali and Rackoff (1989) in their landmark paper on interactive zero-knowledge proofs, work that earned them the Turing Award in 2012. The "succinct non-interactive" variant that powers today's blockchains was made practical by Groth (2016) and the Zcash team.

These proofs sit squarely inside the crypto complexity class — proven secure under plausible hardness assumptions, requiring a one-time trusted setup, and transforming any NP statement into a compact, verifiable secret.

This demo captures the spirit of a zk-SNARK using a simple analogy: Sudoku-style commitment. You pick a secret number, commit to it with a hash, then prove your committed value satisfies a constraint — without ever revealing the number itself.

<p class="hint">{{hint}}</p>
<div class="panel">
  <label>{{secret_label}} <input id="secret" type="number" min="1" max="20" value="4" /></label>
  <button id="commit" type="button">{{btn_commit}}</button>
</div>
<div class="panel" id="commitOut" style="display:none">
  <div class="tag">{{tag_commitment}}</div>
  <code id="hashDisplay"></code>
  <div class="tag" style="margin-top:.6rem">{{tag_verifier_sees}}</div>
</div>
<div class="panel" id="provePanel" style="display:none">
  <button id="prove" type="button">{{btn_prove}}</button>
</div>
<div class="panel" id="proofOut" style="display:none">
  <div class="tag">{{tag_proof}}</div>
  <code id="proofDisplay"></code>
</div>
<div class="panel" id="verifyPanel" style="display:none">
  <button id="verify" type="button">{{btn_verify}}</button>
</div>
<div class="status" id="status"></div>
<div class="panel" id="explainPanel" style="display:none">
  <div class="tag">{{tag_learned}}</div>
  <div id="explain"></div>
</div>
<button id="reset" type="button" class="ghost" style="margin-top:.8rem">{{btn_reset}}</button>

* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; padding: 14px; }
.hint { font-size: .88rem; color: #444; margin: 0 0 .8rem; line-height: 1.5; }
.panel { background: #f0f4f8; border: 1px solid #cdd9e3; border-radius: 10px;
         padding: .65rem .85rem; margin-bottom: .55rem; }
.tag { font-size: .75rem; font-weight: 700; color: #5a7088; text-transform: uppercase;
       letter-spacing: .04em; margin-bottom: .3rem; }
label { font-size: .9rem; display: flex; align-items: center; gap: .5rem; flex-wrap: wrap; }
input[type=number] { width: 4rem; padding: .3rem .4rem; font-size: .9rem;
                     border: 1px solid #adb1b8; border-radius: 6px; }
code { font-family: ui-monospace, monospace; font-size: .78rem; word-break: break-all;
       color: #1d3557; display: block; }
.status { font-size: 1rem; font-weight: 700; min-height: 1.5em; margin: .4rem 0; }
.status.ok { color: #0a7d33; }
.status.bad { color: #c92f3c; }
#explainPanel { font-size: .85rem; line-height: 1.5; }
#explainPanel b { color: #1d3557; }
button { font: 600 14px system-ui, sans-serif; padding: .45rem .9rem;
         border: 1px solid #1d3557; background: #1d3557; color: #fff;
         border-radius: 8px; cursor: pointer; margin-top: .4rem; }
button.ghost { background: #fff; color: #1d3557; }

// Code not found

Notice the key asymmetry. The verifier sees only your commitment (a hash) and your proof response. They can confirm you know a valid secret — but they learn nothing about which secret you chose. That is zero-knowledge in action: the proof is computationally sound (you can't fake it) yet perfectly private (the verifier gains no information beyond "yes, it works").

A zk-SNARK is not one trick — it is a chain of beautiful reductions:

Step 1 — Arithmetize the statement. Any NP computation can be written as a circuit of addition and multiplication gates over a finite field. The prover must convince the verifier that they know an input making every gate consistent.

Step 2 — Flatten to a QAP. The circuit is encoded as a Quadratic Arithmetic Program (introduced by Gennaro, Gentry, Parno & Raykova, 2013). Gate satisfiability becomes a polynomial divisibility check: does a polynomial h(x) times a target polynomial t(x) equal p(x)? If yes, all gates are consistent.

Step 3 — Evaluate blindly via elliptic curves. The prover needs to evaluate those polynomials at a secret random point τ — but must do it without knowing τ. This is where the trusted setup (or ceremony) comes in: it computes encrypted powers of τ on an elliptic curve and destroys τ afterward. Anyone who keeps τ can forge proofs — this is the notorious "toxic waste" problem.

Step 4 — Pair-based verification. Using bilinear pairings on elliptic curves (the same mathematical tool that enables identity-based encryption), the verifier checks the polynomial relationship in encrypted form. The full proof is just a handful of curve points — under 200 bytes for Groth16.

The catch — trusted setup: the ceremony must be run honestly by at least one participant. The Zcash team ran a multi-party ceremony in 2016 with six geographically separated participants; if even one destroyed their share, the setup is safe. Newer systems like PLONK (2019) use a universal trusted setup reusable across many programs, while STARKs eliminate the setup entirely (at the cost of larger proofs).

The security rests on the knowledge-of-exponent assumption and the hardness of the discrete logarithm problem on the chosen curve — well-studied assumptions, though not reduction-proved from a classical hardness result.

zk-SNARKs started in cryptography theory and have become critical infrastructure:

• Private cryptocurrencies: Zcash was the first blockchain to use zk-SNARKs (Groth16) so that transaction amounts and addresses are hidden on-chain. You can prove you spent a coin you owned without revealing which coin.
• Ethereum scaling (zkRollups): zkSync, StarkNet, Polygon zkEVM and others bundle thousands of transactions into a single zk-proof, post it to Ethereum, and inherit Ethereum's security — at a fraction of the gas cost. Rollups are now the dominant Ethereum scaling path.
• Digital identity: zk-proofs can attest "this person is over 18" or "this passport is valid" without transmitting the underlying data — the dream of privacy-preserving KYC.
• Verifiable computation: outsource heavy computation to an untrusted server and get a proof that the result is correct, verified cheaply on your phone.
• Zero-knowledge machine learning: prove a machine-learning model produced a certain output (useful for audits) without revealing the model weights.

The connection to complexity theory is direct: because zk-SNARKs work for any NP statement, they can prove anything you can check efficiently. The gap between P and NP is, paradoxically, what makes them useful — verifying is easy, so the proof is small; finding a witness remains hard, so the prover cannot bluff.

zk-SNARKs are one of the most surprising ideas in modern computer science: they turn the hardness of NP into a privacy guarantee. Because finding a witness is hard but verifying one is easy, a prover can commit to a witness and then demonstrate — without revealing it — that the witness makes a statement true.

The math is deep (elliptic curves, bilinear pairings, polynomial commitments), but the core intuition is simple: you can prove you know a secret by showing its effects, not the secret itself.

From Zcash's shielded transactions to Ethereum's rollup revolution, zk-SNARKs are quietly becoming the privacy infrastructure of the internet. And as trusted-setup requirements shrink (PLONK, STARKs) and hardware accelerators make proving faster, the boundary between "cryptographic curiosity" and "everyday tool" is dissolving fast.

The next time an app tells you it verified your age without storing your birthday, there is a good chance a zk-SNARK is behind it — a tiny proof, carrying a secret it will never reveal.