For the 10th session of Proof is in the Pudding, we tackled Groth16. It's nearly ten years old and still one of the most widely used proof systems out there: 128-byte proofs, constant-size verification, deployments everywhere.

We started with why Groth16 is still used and the downsides that come with it, then recapped the arithmetization and turned a pile of R1CS constraints into a single polynomial identity, with vanishing polynomials and the Schwartz-Zippel lemma explaining why checking at one random point is enough. From there we looked at why the protocol needs pairings (you have to multiply two hidden commitments, and nothing else will do it), how random linear combinations stop the prover from using a different witness in each place, and how the CRS acts as a set of Lego pieces where the separating factors gamma and delta restrict which pieces can be snapped together. We finished by enforcing the quotient polynomial, merging the separate checks into the final equation, and enforcing public inputs.

If you enjoy this video, check out our previous episodes:

• Session 01: Arithmetization - Introduction to converting logical statements into arithmetic circuits
• Session 02: zkTLS - Exploring zero-knowledge TLS and secure oracles
• Session 03: How to Prove False Statements - Fiat-Shamir security and the GKR protocol
• Session 04: Proofs On A Leash - Introduction to post-quantum lattice-based SNARKs with Greyhound
• Session 05: Trust, But Measure - Introduction to Trusted Execution Environments with Intel TDX
• Session 06: Introduction to Data Availability Sampling - How rollups and Ethereum's DA system work
• Session 07: The Other Dark Forest - Offchain public keys with zkLogin, ZK Email, and ZKPassport
• Session 08: Privacy in Payment Networks - From E-Cash and Monero to Zcash and Zether
• Session 09: ZK on Bitcoin - Verifying ZK proofs on Bitcoin, from MPC approaches to BitVM

Have a topic you'd like us to cover in a future session? Let us know on Twitter/X!