ZK/SEC Research notes from zkSecurity
All posts
Proof is in the Pudding · Part 10 of 10

Archetype x zkSecurity - Proof is in the Pudding: Groth16

ZK/SEC July 23, 2026 2 min educative · zk · groth16

For the 10th session of Proof is in the Pudding, we tackled Groth16. It's nearly ten years old and still one of the most widely used proof systems out there: 128-byte proofs, constant-size verification, deployments everywhere.

Tip

Prefer reading? This session is the video companion to Groth16, Intuitively, the written version with all the equations spelled out. Pick whichever format you prefer, or use both.

We started with why Groth16 is still used and the downsides that come with it, then recapped the arithmetization and turned a pile of R1CS constraints into a single polynomial identity, with vanishing polynomials and the Schwartz-Zippel lemma explaining why checking at one random point is enough. From there we looked at why the protocol needs pairings (you have to multiply two hidden commitments, and nothing else will do it), how random linear combinations stop the prover from using a different witness in each place, and how the CRS acts as a set of Lego pieces where the separating factors gamma and delta restrict which pieces can be snapped together. We finished by enforcing the quotient polynomial, merging the separate checks into the final equation, and enforcing public inputs.

If you enjoy this video, check out our previous episodes:

Have a topic you'd like us to cover in a future session? Let us know on Twitter/X!

Keep reading
Latest

The Year Finding and Exploiting Bugs Became Cheap, and What to Do About It

The economics of security have changed. AI has made finding and exploiting bugs cheaper, including in cryptographic and zero-knowledge code, while validation and remediation remain slow. Here is our view of what happened, what comes next, and how teams should change the way they secure their stack to defend against AI-assisted attackers.

Stefanos Chaliasos · September 07, 2026

Variants of KZG: Part V, Multilinear Commitments with Mercury

In this final post of the series, we extend univariate KZG commitments to multilinear polynomials through Mercury. Building on Gemini, we fold half of the variables at once, use polynomial division to bind this large fold to the original commitment and reduce the remaining multilinear evaluations to a batched inner product check. We then walk through the end-to-end opening protocol. We conclude by examining its proof size, prover cost and verifier cost.

Varun Thakore · August 17, 2026

Variants of KZG: Part IV, Multilinear Commitments with Gemini

In this blog post, we extend univariate KZG commitments to multilinear polynomials through Gemini. We introduce recursive partial evaluations, derive the split-and-fold identity and express each fold as a univariate identity that can be checked using KZG openings. We then walk through the end-to-end opening protocol. We conclude by examining its proof size, prover cost, and verifier cost.

Varun Thakore · August 12, 2026
Recommended

Groth16, Intuitively

Groth16 is still the gold standard for succinct SNARKs: 128-byte proofs, constant-size verification, and a decade of real-world deployment. But despite its ubiquity, almost nobody explains *why* it works the way it does. In this post, we build Groth16 from the ground up, starting from R1CS and QAPs, then layer in pairings, trusted setup parameters, and the separator tricks (α, β, γ, δ) that make the scheme sound. By the end, you should have an intuitive grasp of every term in the final verifier equation.

David Wong · May 01, 2026

Archetype x zkSecurity - Proof is in the Pudding: ZK on Bitcoin

In Session 09 of "Proof is in the Pudding," we explore the intersection of zero-knowledge proofs and Bitcoin. We break down Bitcoin's UTXO model and Script limitations, then dive deep into approaches for verifying ZK proofs on Bitcoin, from MPC-based techniques to BitVM's optimistic verification with fraud proofs. We cover timelocks, the statelessness problem and Lamport signatures for state, Taproot, simulated covenants, BitVM 3 with hashlocks and garbled circuits, cut-and-choose security, and witness encryption (BABE).

ZK/SEC · April 02, 2026

Archetype x zkSecurity - Proof is in the Pudding: Privacy in Payment Networks

In Session 08 of "Proof is in the Pudding," we explore how different networks have approached privacy over the years. From E-Cash and Monero to MobileCoin and Zether, we break down blind signatures, Pedersen commitments, stealth addresses, ring signatures, and more. This session provides a comprehensive tour of the techniques used to break linkability, hide addresses, and obscure transaction data in the name of privacy and safety.

ZK/SEC · January 16, 2026
More to explore

zkSecurity x Bain Capital (Whiteboard Session): Unveiling the Power of Multi-Party Computation

We're thrilled to share that we're featured in Bain Capital Crypto's Whiteboards series! In the first episode, David and Guillermo Angeris dive deep into the intriguing world of Multi-Party Computation (MPC). Join them as they break down complex concepts like additively-shared secrets and Shamir Secret Sharing, making the cutting-edge tech behind MPC accessible and engaging. Check out the full episode for some engaging insights and reach out to us if you're looking for MPC stack auditors!

ZK/SEC · June 04, 2024

Breaking Jolt’s Verifier with an Unbound Uni-Skip Claim

We found a critical soundness bug in Jolt’s transparent verifier that allowed a forged proof for an invalid execution to verify. The issue was fixed quickly after disclosure, and the full PoC and write-up are available in the linked repository.

Minsun Kim · May 09, 2026

Bug Hunt: Zero-Knowledge, Full-Paranoia, and the AI That Stares Back

Over the past year, we've been diving into whether AI can effectively identify bugs in zero-knowledge circuits and applications, sparking questions about the future of auditing. This led us to develop SnarkSentinel, an AI-powered auditing tool. We'll share what worked, what didn’t, and how our journey with AI could impact auditing. From early challenges with Circom to innovative methods like retrieval-augmented generation and agent-led probing, we'll give you a peek into our findings, including both successes and setbacks with bug detection. Discover how AI might enhance or change the landscape of auditing and what this means for developers and security pros alike.

ZK/SEC · July 03, 2025