educative · zk · plonk

𝒫𝔩𝔬𝔫𝒦: A Hands-On Deep Dive

Martín Ochoa August 05, 2025 1 min

PLONK

Understanding 𝒫𝔩𝔬𝔫𝒦 can be daunting given its multiple building blocks. Selector polynomials, wiring permutations, quotient tests, random challenges, and KZG commitments can be overwhelming at first sight. At zkSecurity, we have created a hands-on tutorial to demystify each piece through a progressive running example: you'll build tables of intermediate values, interpolate low-degree polynomials over the BN254 field, encode gate and wiring constraints, and perform both deterministic and probabilistic zero-tests.

📖 Access the tutorial

Whether you are already familiar with the protocol or curious to learn more about it, this tutorial helps you understand the inner workings of 𝒫𝔩𝔬𝔫𝒦, turning a complex proof system into an accessible, step-by-step learning journey.

Choose how to solve: Download a Jupyter Notebook version of the tutorial and solve with Sage or on Cocalc. But you may also solve in some other programming language, we guide you with test cases along the way!

Deep Dives into building blocks: Each algebraic construction is motivated through the running example, from vanishing polynomials to the grand-product argument, bridging theory and practice.

Progressive Complexity: Start with a simple circuit, then incrementally introduce selectors, quotient polynomials, random challenges, and KZG commitments, culminating in a full non-interactive Fiat–Shamir 𝒫𝔩𝔬𝔫𝒦 proof.

Keep reading

Latest

Archetype x zkSecurity - Proof is in the Pudding: zkML

In Session 11 of "Proof is in the Pudding," we look at what it takes to prove model inference. We cover transformer computation, sumcheck, GKR, lookup arguments, quantization, and KV caching, then discuss scaling and possible uses for verifiable ML.

ZK/SEC · September 30, 2026

Intro to Clean for Devs.

We think that Clean is the future of circuit development, so we created a programmer-first introduction to show circuit developers who have never used formal verification how they can build circuits faster, safer and better.

ZK/SEC · September 29, 2026

Fiat-Shamir Bugs: How One Missing Line Breaks a Proof System

This blog post looks at Fiat-Shamir from a practical security perspective: it explains why something that seems simple in theory can become surprisingly easy to get wrong. By using vulnerabilities found in real-world projects, we give developers and reviewers a better way to think about Fiat-Shamir when designing, implementing, and auditing proof systems.

Giap Vu, David Wong · September 19, 2026

Recommended

Groth16, Intuitively

Groth16 is still the gold standard for succinct SNARKs: 128-byte proofs, constant-size verification, and a decade of real-world deployment. But despite its ubiquity, almost nobody explains *why* it works the way it does. In this post, we build Groth16 from the ground up, starting from R1CS and QAPs, then layer in pairings, trusted setup parameters, and the separator tricks (α, β, γ, δ) that make the scheme sound. By the end, you should have an intuitive grasp of every term in the final verifier equation.

David Wong · May 01, 2026

Learn Sumcheck, MLE, and HyperPlonk: An Interactive Tutorial with SageMath

A new interactive tutorial on Sumcheck, Multilinear Extensions, and HyperPlonk with complete SageMath implementations and exercises. Go beyond the theory and understand how these protocols actually work by implementing them yourself.

Marco Gaglianese · November 22, 2025

Sum-Check as an Algebraic Tensor Reduction: Part I

This post introduces algebraic tensor reductions as a unifying framework for understanding recursive proof protocols, using sum-check as the main motivating example. It walks through one recursive step of sum-check, showing how the prover sends a univariate summary, the verifier checks sum consistency, and the original claim is reduced to a smaller claim with one fewer variable. A small bivariate example illustrates how this “peel off one variable, check, then fold with randomness” pattern works concretely. The post sets up the rest of the series, which will introduce the tensor language needed to recover classical sum-check as an algebraic tensor reduction.

Marco Besier · April 27, 2026

More to explore

Variants of KZG: Part III, Multilinear Commitments with Zeromorph

In this blog post, we extend univariate KZG commitments to multilinear polynomials through Zeromorph. We introduce the univariatization map, encode the multilinear quotient identity as a univariate identity, and explain why the quotient encodings require degree checks. We then show how Zeromorph batches these checks into a single degree-bounded KZG opening and walk through its end-to-end opening protocol. We conclude by examining its proof size, prover cost, and verifier cost.

Varun Thakore · August 04, 2026

10 Must-Read Papers That Shaped Modern Zero-Knowledge Proofs

Zero-knowledge proofs have come a long way in 40 years, thanks to groundbreaking work from many brilliant minds. We're taking you on a tour of the key milestones in this fascinating journey, from the foundational concepts in 1985 by Goldwasser, Micali, and Rackoff, to modern applications and innovations like STARKs and zkVMs. You'll get a taste of major papers and projects that have pushed these proofs from theoretical curiosity to practical and scalable solutions. Dive into the history, understand the evolution, and see how these cryptographic marvels continue to shape the future of secure computation!

ZK/SEC · November 12, 2024

Optimizing Cryptography with AI

Many of us are using AI to generate code. Vibe coding cryptography is especially sensitive - you have to uphold strict mathematical correctness. This can lead to wrong security guarantees and soundness bugs. We will discuss what are some patterns to do it well.

Kobi Gurkan · August 11, 2026