SNARKs at a Glance

A SNARK (Succinct Non-interactive ARgument of Knowledge) is the gold standard for ZK at scale.

Key properties:

• Succinct: proof is tiny (~200 bytes for Groth16) regardless of statement size.
• Non-interactive: one message from prover to verifier.
• Argument of Knowledge: prover knows the witness (computationally sound).
• Zero-knowledge: doesn't reveal the witness.
• Verifier fast: O(1) or O(log n) verification time.

Example: prove "I know inputs that make this 1-million-gate circuit output 1." Proof: 200 bytes. Verification: ~5ms.

Under the hood:

• Statement encoded as an arithmetic circuit (constraints over a finite field).
• Constraints converted to a polynomial (R1CS → QAP for Groth16; AIR for STARKs).
• Polynomial commitment scheme (KZG, FRI) lets prover commit to massive polynomials with O(1) commitment size.
• Verifier sends a few random challenges; prover opens commitments at those points.
• If the polynomial identity holds at random points, it (probably) holds everywhere.

Variants:

• Groth16: tiny proofs, fastest verifier; trusted setup PER CIRCUIT.
• PLONK / Marlin: universal trusted setup (one ceremony, reusable); slightly bigger proofs.
• STARKs: NO trusted setup, transparent; bigger proofs (~50KB).
• zk-STARK + Recursion: Mina's "perpetual ZK proof" — entire blockchain history compressed to one tiny proof.

Trusted setup:

• Some SNARKs require a structured reference string (SRS) — generated in a multi-party ceremony.
• "Powers of tau" ceremonies (Zcash, EthSnarks) had hundreds of participants.
• If ALL participants colluded, they could forge proofs. Only one needed honest → secure.
• "Toxic waste" must be deleted after ceremony.

ZKAttacks:

• "Frozen Heart": implementations of non-interactive ZK that omitted public inputs from the Fiat-Shamir transform.
• Multiple Bulletproofs/PlonK variants had this in 2022 — 0-of-many-can-forge.

We won't fully implement a SNARK (months of math). We'll build sigma + Fiat-Shamir, glimpse the structure.