Plonky2 deep dive: the proof system behind Polygon zkEVM
Thread899 words
Primer on SNARKs and STARKs, then how plonky2 combines PLONK with FRI to remove the trusted setup, support recursion, prove on CPUs and keep Ethereum verification cheap by wrapping the final proof in a pairing-based proof.
Key claims
Plonky2 proof generation takes about 170 ms on a MacBook Pro
The wrapped pairing-based proof costs roughly 180k gas to verify on Ethereum
Over 90% of L2 fees are calldata costs
0/ at the core of each #zk rollup is the zero knowledge proof system that the rollup uses to generate the validity proofs that ensure execution correctness ⚙️
so today, we'll dive into plonky2, the proof system used by @0xPolygon's #zkEVM 🟣
a 🧵 (0/25)
1/ this 🧵 provides a deep dive into the advanced plonky2 proof system used by @0xPolygon's #zkEVM for its validity proofs. But before we dive in, let's take a moment to explore what #SNARKs and #STARKs are, and how they differ from each other
2/ zero knowledge proofs (ZKPs) are cryptographic techniques that allow a party to prove a statement is true without revealing any information other than the statement’s validity. In the world of #crypto, these proof systems become particularly intriguing
3/ non-interactive zero knowledge proofs (NIZKPs) are #ZKPs variant that do not necessitate interaction between the prover and verifier. They hinge on a Common Reference String (CRS), generated in a publicly verifiable trusted setup ceremony
4/ the CRS underpins the #NIZKPs and facilitates the verification of statements sans interaction. However, the system's security hinges on the trusted setup ceremony's integrity, which generates the CRS, inciting some security concerns
5/ the trusted setup ceremony crafts a CRS consisting of cryptographic parameters for generating #NIZKPs. The design challenge for NIZKPs is balancing security, efficiency, and CRS size. Various techniques have been proposed to achieve this equilibrium
6/ #zkSNARKs are a popular form of zero-knowledge proofs, first debuted by the @ZCash protocol in 2012. #SNARKs (Succinct Non-interactive ARguments of Knowledge) are #ZKPs, enabling the validation of a statement without divulging any data about the statement.
7/ @ZCash’s #zkSNARK proofs allow the network to verify transactions without jeopardizing user privacy. This privacy enhancement is also (at least partially) supported by #zk-rollups, making these tools critical for user anonymity & transaction confidentiality
8/ @ZCash's recent #Halo proof system was pioneering, being the first zero knowledge proof system ever discovered to support two key features:
🔹 no trusted setup
🔹 recursion
9/ no trusted setup implies that the system's security isn't dependent on the integrity of a setup ceremony, thus reducing vulnerability to exploitation. This also fosters protocol agility and novel zero knowledge protocols development
10/ for an example of a trusted set up ceremony (@MantaNetwork), check here 👇
x.com/expctchaos/status/1612957984354668545
11/ recursion means the protocol can prove increasingly complex facts, making it a general-purpose protocol fit for a wide range of zero-knowledge applications (zkApps). This feature allows proofs to validate other proofs, enabling recursive rollup structures (rollup on rollup)
12/ for more info on recursion, have a look here 👇
x.com/expctchaos/status/1677709129929093120
13/ #STARKs (Scalable Transparent ARguments of Knowledge), a recent development in proof technology, has been gathering attention too
14/ the key benefit of #STARKs is the removal of the need for a trusted setup, similar to advanced #SNARK proof systems like Halo and post-quantum security
15/ however, both #SNARKs & #STARKs come with limitations & trade-offs. While the former often require a trusted setup, STARKs have significant computational overheads for proof generation & verification, limiting their use
16/ @0xPolygon #zkEVM doesn't utilize the #Halo proof system or a pure #STARK proof system but amalgamates elements from both in a state-of-the-art zk proof system, plonky2, which is PLONK-based
17/ #PLONK, introduced in 2019, has undergone various improvements and extensions since its release, culminating in plonky2. This system offers the versatility of a general-purpose zero-knowledge proof scheme, with improvements such as a universal and updatable trusted setup
18/ however, plonky2 even goes a step further and eliminates the need for a trusted setup altogether. By combining #PLONK and FRI (used in STARKs), it couples #STARKs' strengths with #SNARKs' benefits, such as support for recursion and low #Ethereum verification costs
19/ with plonky2, proving can be accomplished using CPUs rather than GPUs. Given CPUs' cost advantage, this has been an important optimization for @0xPolygon. Even with a rapid prover, CPUs can offer comparable latency to GPUs but at a lower cost
20/ what is impressive, is that proof generation only takes 170 milliseconds on a Macbook Pro! This speed is largely due to the use of FRI, which enables the use of smaller fields, crucial for some complex computations
21/ In addition, @0xPolygon uses recursive #SNARK proofs to verify the validity of STARK proofs. By encapsulating a final plonky2 proof in a pairing-based proof, which costs only 180k to verify on-chain, the cost of verifying proofs on #Ethereum is significantly reduced
22/ this cost reduction is vital as most #L2 fees (>90%) are calldata costs. The proof cost is spread across all transactions in a proven batch. As such, plonky2 has been touted as the fastest and cheapest system for proof verification on #Ethereum
23/ more on calldata & rollup cost👇
x.com/expctchaos/status/1661794274206445569
24/ pretty sick right?
what's even better though is that plonky3 is coming very soon already! Plonky3 will use different hash functions and 32bit fields for better hardware compatibility and increased efficiency 🚀
another quantum leap by @0xPolygon's stellar research team 🌟
25/ I hope you got an idea of why plonky2 (and 3) are so sick 🤓
& stay tuned for a comparison of the different zk proof systems that the leading zk rollups are currently using (dropping this week) 👀
tagging zk chads to follow 🫡👇
@0xSalazar
@Louround_
@0xkhan_
@thesaint_
@Flowslikeosmo
@wacy_time1
@DeFiMinty
@ShivanshuMadan
@chilla_ct
@kunalgoel
@splinter0n
@hmalviya9
@georgethms1
@poopmandefi
@0xDinoEggs
@Haylesdefi
@jbaylina
@MihailoBjelic
@dlubarov
@_khanhamzah
1 image on X
What came next · since 11 Jul 2023
Since then
Zero has written 3 more pieces on Polygon since this one.