Proof Systems
PLONK & Groth16 Proving Systems
PLONK and Groth16 are two of the most widely-used proving systems in the zero-knowledge space. Both are zk-SNARK variants but with different approaches and trade-offs. This page explores their characteristics, advantages, and ideal use cases.
Groth16
Groth16, developed by Jens Groth in 2016, has become one of the most widely deployed proving systems due to its efficiency.
Key Characteristics
- Extremely Succinct: Produces very small proofs (typically 192 bytes)
- Fast Verification: Verification requires just a few milliseconds
- Circuit-Specific Setup: Requires a separate trusted setup for each circuit
- Trusted Setup: Uses a multi-party computation (MPC) ceremony to generate proving/verification keys
How Groth16 Works
- The computational problem is expressed as an arithmetic circuit
- The circuit is converted to a set of rank-1 constraint systems (R1CS)
- R1CS constraints are converted to a quadratic arithmetic program (QAP)
- The proving system uses elliptic curve pairings for efficient verification
Advantages
- Currently the most efficient zk-SNARK in terms of proof size and verification time
- Well-studied and battle-tested in production environments
- Supported by multiple programming languages and libraries
Limitations
- Circuit-specific trusted setup means new circuits require new ceremonies
- Not flexible for dynamic computations or circuits that change frequently
- More complex to implement compared to newer systems
PLONK
PLONK (Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge) was introduced in 2019 by Ariel Gabizon, Zachary Williamson, and Oana Ciobotaru.
Key Characteristics
- Universal Trusted Setup: One-time setup can be used for all circuits
- Flexible: Supports dynamic circuits and easier updates
- Reasonable Efficiency: Slightly larger proofs and slower verification than Groth16, but still practical
- Customizable: Supports multiple proof composition approaches
How PLONK Works
- The computation is expressed as an arithmetic circuit
- The circuit is represented as a set of gates with custom constraints
- Uses polynomial commitments and a "permutation argument" to ensure consistency
- Employs a lookup argument for efficient handling of various operations
Advantages
- Universal and updatable trusted setup is more practical for evolving applications
- Better suited for applications with frequently changing circuits
- More flexible programming model compared to Groth16
- Supports recursive proof composition
Limitations
- Larger proof size than Groth16 (typically 1-2 KB)
- Slightly slower proof generation and verification
- More complex mathematical foundation
Choosing Between Groth16 and PLONK
| Factor | Groth16 | PLONK |
|---|---|---|
| Proof size | Smaller (~192 bytes) | Larger (~1-2 KB) |
| Verification time | Faster | Slightly slower |
| Setup flexibility | Circuit-specific | Universal |
| Development workflow | Less flexible for changes | More adaptable |
| Maturity | Highly mature | Relatively newer |
Ideal Use Cases
Groth16 is ideal for:
- Applications with fixed circuits that rarely change
- When minimal proof size and verification time are critical
- Well-established protocols with stable requirements
PLONK is ideal for:
- Development environments with evolving circuits
- Applications requiring frequent updates or modifications
- When setup flexibility is more important than absolute performance
Both systems continue to evolve with ongoing research and optimizations, making them powerful tools in the zero-knowledge ecosystem.