As one of the most widely used zk-SNARK algorithms for Ethereum Layer 2 and privacy-preserving applications, Groth16’s key advantage is its extreme succinctness: no matter how complex the statement being proved, the Proof it generates always consists of just 3 elliptic curve points (about 128 bytes), making on-chain verification extremely fast with a constant Gas fee!
Its four core stages are:
1️⃣ Program Flattening: Break complex business logic down into a basic arithmetic circuit containing only【addition, subtraction, multiplication, and division】.
2️⃣ Rank-1 Constraint System (R1CS): Convert each computational step into a matrix constraint equation (As) x (Bs) = C*s, ensuring the prover cannot “cheat.”
3️⃣ Polynomial Compression (QAP): Use Lagrange interpolation to compress and combine millions of scattered matrix equations into【one unified polynomial equation】, dramatically reducing the computational load.
4️⃣ Trusted Setup and Bilinear Pairing: At project launch, cryptographic parameters are generated through a “trusted setup ceremony”; the prover ultimately outputs points [A], [B], and [C]; and the on-chain contract uses bilinear pairing (Pairing) to verify just one equation, confirming the proof’s validity without revealing any private information!
⚠️ Note: This relies on an initial trusted setup (the secret random numbers used to generate the parameters must be destroyed, or there is a risk of forged proofs).
Its four core stages are:
1️⃣ Program Flattening: Break complex business logic down into a basic arithmetic circuit containing only【addition, subtraction, multiplication, and division】.
2️⃣ Rank-1 Constraint System (R1CS): Convert each computational step into a matrix constraint equation (As) x (Bs) = C*s, ensuring the prover cannot “cheat.”
3️⃣ Polynomial Compression (QAP): Use Lagrange interpolation to compress and combine millions of scattered matrix equations into【one unified polynomial equation】, dramatically reducing the computational load.
4️⃣ Trusted Setup and Bilinear Pairing: At project launch, cryptographic parameters are generated through a “trusted setup ceremony”; the prover ultimately outputs points [A], [B], and [C]; and the on-chain contract uses bilinear pairing (Pairing) to verify just one equation, confirming the proof’s validity without revealing any private information!
⚠️ Note: This relies on an initial trusted setup (the secret random numbers used to generate the parameters must be destroyed, or there is a risk of forged proofs).