KZG Commitments

KZG is the most widely deployed polynomial commitment scheme in production ZK systems. It underlies Groth16, PLONK, and its variants including UltraPlonk and UltraHonk. Understanding how it works mechanically gives you a precise mental model for why SNARKs have the properties they do.

The primitives KZG relies on

KZG is built on two mathematical structures that you need to have a working understanding of before the construction makes sense.

Elliptic curve groups are sets of points that form a mathematical group under a specific addition operation. An elliptic curve group has a generator point g. Any element of the group can be written as g^x, meaning g added to itself x times, where x is a scalar in the corresponding finite field.

The discrete logarithm assumption says that given g and g^x, you cannot efficiently compute x. This one-way property is the foundation of KZG security.

Bilinear pairings are functions e that map two group elements to a target group element:

`` e: G × G → G_T ``

The key property is bilinearity:

`` e(g^a, g^b) = e(g, g)^(ab) ``

This lets you check multiplicative relationships between exponents without knowing the exponents themselves. It is what makes the KZG verification equation work.

The four algorithms

KZG consists of four algorithms: Setup, Commit, Open, and Verify.

Setup generates the structured reference string (SRS), also called the proving key. A trusted ceremony samples a random secret τ (tau) and computes:

`` SRS = [g, g^τ, g^τ², g^τ³, ..., g^τᵈ] ``

Where d is the maximum degree of polynomial the scheme will support. After the ceremony, τ is destroyed. The SRS is public and can be reused by anyone for any circuit up to degree d.

The security assumption is that τ is not recoverable. If someone knows τ, they can construct false proofs. This is the toxic waste problem: the secret must be provably discarded.

Commit takes a polynomial f(x) = Σ cᵢxⁱ and the SRS, and outputs a single group element:

`` com_f = g^f(τ) = Π (g^τⁱ)^cᵢ ``

The prover computes this without knowing τ directly, using only the published SRS elements. The result is one group element, typically 48 bytes on the BLS12-381 curve. The commitment size is constant regardless of the polynomial degree.

Open proves that f(a) = y for a specific evaluation point a. The prover computes the quotient polynomial:

`` q(x) = (f(x) - y) / (x - a) ``

If f(a) = y, then (x - a) divides (f(x) - y) exactly with no remainder. This is a polynomial identity that holds if and only if the claimed evaluation is correct. The prover commits to q(x) the same way:

`` π = g^q(τ) ``

This single group element is the evaluation proof.

Verify checks the proof using the bilinear pairing. The verifier holds com_f, the evaluation point a, the claimed value y, the proof π, and the SRS. The check is:

`` e(com_f / g^y, g) == e(π, g^τ / g^a) ``

Expanding this using the bilinearity property:

The left side evaluates to e(g, g)^(f(τ) - y).

The right side evaluates to e(g, g)^(q(τ) · (τ - a)).

These are equal if and only if f(τ) - y = q(τ) · (τ - a), which is exactly the polynomial identity that holds when f(a) = y. The pairing lets the verifier check this multiplicative relationship over the exponents without knowing τ.

Security assumptions

KZG is computationally hiding under the discrete logarithm assumption: given com_f = g^f(τ), you cannot learn any coefficient of f because recovering f(τ) from g^f(τ) requires solving the discrete log.

KZG is computationally binding under the l-SBDH assumption (Strong Bilinear Diffie-Hellman). This assumption says that given the SRS, you cannot produce a valid opening proof for an incorrect evaluation. If you claim f(a) = y' where y' ≠ y, you cannot construct a valid π that passes the verification equation without breaking a hard computational problem.

Both assumptions are believed to hold but are not proven unconditionally. They are standard assumptions in pairing-based cryptography and are the foundation of the security of Groth16, PLONK, and related systems.

The trusted setup in practice

The requirement that τ be destroyed creates a coordination problem. In practice this is solved through multi-party computation ceremonies.

In an MPC setup ceremony, many participants each contribute their own random value. The final SRS is computed as a function of all contributions. The SRS is secure as long as at least one participant honestly destroyed their contribution and did not collude with others.

Ethereum's KZG ceremony for EIP-4844 had over 140,000 participants. Each participant extended the SRS with their own randomness and published only the result, not their secret input. The probability of the entire ceremony being compromised requires every single participant to have colluded and retained their secret.

For circuit-specific setups like Groth16, the ceremony must be repeated for each new circuit because the SRS encodes circuit-specific structure. For universal setups like PLONK, one ceremony produces an SRS that works for any circuit up to the supported degree bound.

Batching and efficiency

One practical advantage of KZG is that multiple evaluation proofs can be batched into a single proof using a random linear combination. If a prover needs to prove f(a₁) = y₁ and f(a₂) = y₂, they can combine both into a single proof rather than producing two separate proofs.

This is the mechanism that makes PLONK efficient in practice. The prover commits to multiple trace polynomials and then uses batched KZG openings to prove all the constraint equations hold simultaneously at a random challenge point.

Generating N KZG proofs for the same polynomial can be done in O(N log N) time using FFT on the group elements in the SRS, rather than the O(N²) time that a naive approach would require.

Where you will encounter KZG

Groth16 uses a pairing-based construction closely related to KZG. The verification equation is a small fixed number of pairings regardless of circuit size.

PLONK uses KZG explicitly to commit to witness polynomials and prove constraint satisfaction at a random evaluation point chosen by the verifier.

UltraPlonk and UltraHonk are extensions of PLONK with custom gates and lookup arguments. Both use KZG or the Inner Product Argument (IPA) as the underlying commitment scheme depending on the backend.

EIP-4844 blob commitments use KZG to commit to data blobs that rollups post to Ethereum. The commitment scheme allows Ethereum nodes to verify data availability proofs without downloading the full blob.

What you need to take away

KZG produces a constant-size commitment to any polynomial, and a constant-size proof for any evaluation of that polynomial. Verification requires one bilinear pairing check. The scheme requires a trusted setup that must be performed once per circuit for Groth16, or once for any circuit size for universal setups like PLONK.

These properties are why KZG-based SNARKs have small proofs, fast verification, and a trusted setup requirement. The tradeoffs against transparent schemes like FRI follow directly from the underlying mathematics: removing the trusted setup requires larger proof sizes because you lose the algebraic structure that pairings provide.