zero-knowledge-proofs

Zero-Knowledge Proofs

Deep authority on ZK proof system design and implementation: circuit authoring in Circom and Halo2, proof generation and on-chain verification, system tradeoffs (Groth16 vs PLONK vs STARKs), and ZK rollup architectures. Use this skill when building ZK circuits, integrating provers into applications, or reasoning about ZK-EVM equivalence levels.

Core Concepts

Proof System Tradeoffs

Groth16 dominates when proof size and on-chain verification cost are paramount and the circuit is stable (Tornado Cash, Semaphore). PLONK/UltraPLONK is preferred for systems needing a single trusted setup across many circuits. STARKs are mandatory when quantum resistance is required or a trusted setup is politically impossible (Starknet).

Circom Circuit Authoring

Circom compiles to R1CS (Rank-1 Constraint System). Every computation must be expressed as quadratic constraints a * b = c.

pragma circom 2.1.6;

include "node_modules/circomlib/circuits/poseidon.circom";
include "node_modules/circomlib/circuits/comparators.circom";

// Prove knowledge of a preimage that hashes to a public commitment
// without revealing the preimage
template PrivateSetMembership(DEPTH) {
    // Public inputs
    signal input root;
    signal input nullifierHash;
    signal input recipient;

    // Private inputs
    signal input secret;
    signal input nullifier;
    signal input pathElements[DEPTH];
    signal input pathIndices[DEPTH];

    // Recompute the leaf commitment
    component leafHasher = Poseidon(2);
    leafHasher.inputs[0] <== nullifier;
    leafHasher.inputs[1] <== secret;

    // Nullifier hash to prevent double-spend
    component nullifierHasher = Poseidon(1);
    nullifierHasher.inputs[0] <== nullifier;
    nullifierHasher.out === nullifierHash;  // constrain public output

    // Merkle path verification
    component hashers[DEPTH];
    signal levelHashes[DEPTH + 1];
    levelHashes[0] <== leafHasher.out;

    for (var i = 0; i < DEPTH; i++) {
        hashers[i] = Poseidon(2);
        // pathIndices[i] must be 0 or 1 — enforce binary
        pathIndices[i] * (1 - pathIndices[i]) === 0;

        // Left/right ordering determined by path index
        hashers[i].inputs[0] <== (1 - pathIndices[i]) * levelHashes[i] + pathIndices[i] * pathElements[i];
        hashers[i].inputs[1] <== pathIndices[i] * levelHashes[i] + (1 - pathIndices[i]) * pathElements[i];
        levelHashes[i + 1] <== hashers[i].out;
    }
    root === levelHashes[DEPTH];
}

component main {public [root, nullifierHash, recipient]} = PrivateSetMembership(20);