ZK/SEC Research notes from zkSecurity
All posts
Proof is in the Pudding · Part 10 of 11

Archetype x zkSecurity - Proof is in the Pudding: Groth16

ZK/SEC July 23, 2026 2 min educative · zk · groth16

For the 10th session of Proof is in the Pudding, we tackled Groth16. It's nearly ten years old and still one of the most widely used proof systems out there: 128-byte proofs, constant-size verification, deployments everywhere.

Tip

Prefer reading? This session is the video companion to Groth16, Intuitively, the written version with all the equations spelled out. Pick whichever format you prefer, or use both.

We started with why Groth16 is still used and the downsides that come with it, then recapped the arithmetization and turned a pile of R1CS constraints into a single polynomial identity, with vanishing polynomials and the Schwartz-Zippel lemma explaining why checking at one random point is enough. From there we looked at why the protocol needs pairings (you have to multiply two hidden commitments, and nothing else will do it), how random linear combinations stop the prover from using a different witness in each place, and how the CRS acts as a set of Lego pieces where the separating factors gamma and delta restrict which pieces can be snapped together. We finished by enforcing the quotient polynomial, merging the separate checks into the final equation, and enforcing public inputs.

If you enjoy this video, check out our previous episodes:

Have a topic you'd like us to cover in a future session? Let us know on Twitter/X!

Keep reading
Latest

Checking the Checkers and Auditing the Ironwood FV

Cryptographic software is error-prone and failures are catastrophic, therefore formal verification is a powerful and increasingly practical tool for greatly improving the assurances of our cryptographic software. But who verifies the formal verification? Formal verification itself is software too, what is proved, under which assumptions and its relation to the real-world implementation lie beyond the scope of the machine-checked proof. In this post, we want to give some insights into our three-week audit of the Ironwood formalization and some of the common pitfalls that formal verification more broadly can encounter.

Mathias Hall-Andersen · October 05, 2026

Archetype x zkSecurity - Proof is in the Pudding: zkML

In Session 11 of "Proof is in the Pudding," we look at what it takes to prove model inference. We cover transformer computation, sumcheck, GKR, lookup arguments, quantization, and KV caching, then discuss scaling and possible uses for verifiable ML.

ZK/SEC · September 30, 2026

Intro to Clean for Devs.

We think that Clean is the future of circuit development, so we created a programmer-first introduction to show circuit developers who have never used formal verification how they can build circuits faster, safer and better.

Mathias Hall-Andersen · September 29, 2026
Recommended

Groth16, Intuitively

Groth16 is still the gold standard for succinct SNARKs: 128-byte proofs, constant-size verification, and a decade of real-world deployment. But despite its ubiquity, almost nobody explains *why* it works the way it does. In this post, we build Groth16 from the ground up, starting from R1CS and QAPs, then layer in pairings, trusted setup parameters, and the separator tricks (α, β, γ, δ) that make the scheme sound. By the end, you should have an intuitive grasp of every term in the final verifier equation.

David Wong · May 01, 2026

Archetype x zkSecurity - Proof is in the Pudding: ZK on Bitcoin

In Session 09 of "Proof is in the Pudding," we explore the intersection of zero-knowledge proofs and Bitcoin. We break down Bitcoin's UTXO model and Script limitations, then dive deep into approaches for verifying ZK proofs on Bitcoin, from MPC-based techniques to BitVM's optimistic verification with fraud proofs. We cover timelocks, the statelessness problem and Lamport signatures for state, Taproot, simulated covenants, BitVM 3 with hashlocks and garbled circuits, cut-and-choose security, and witness encryption (BABE).

ZK/SEC · April 02, 2026

Archetype x zkSecurity - Proof is in the Pudding: Privacy in Payment Networks

In Session 08 of "Proof is in the Pudding," we explore how different networks have approached privacy over the years. From E-Cash and Monero to MobileCoin and Zether, we break down blind signatures, Pedersen commitments, stealth addresses, ring signatures, and more. This session provides a comprehensive tour of the techniques used to break linkability, hide addresses, and obscure transaction data in the name of privacy and safety.

ZK/SEC · January 16, 2026
More to explore

Public report of Lighter ZK circuits

We recently teamed up with Lighter to dive deep into their custom ZK circuits used for a verifiable orderbook matching on a Layer 2 exchange. Our findings show solid and well-structured code, thanks to their cooperative engineering team. The post gives a fascinating look into how Lighter’s ZK rollup ensures valid state transitions on Layer 1 through zero-knowledge proofs and the innovative structure of their order book matching process. It explains the roles of the main operation and exit hatch circuits, while also touching on how users can exit in emergencies. It's a great read if you're curious about how these systems maintain security and efficiency in decentralized finance.

ZK/SEC · April 24, 2024

Do in secret. Assert in public. Don't under-constrain your prover's witness computation in ZK programs

Curious about diving into zero-knowledge (ZK) application development? Our blog post is here to guide you through the common security pitfalls and mindset shifts essential for tackling ZK programming. We reflect on our journey from the early days of Mina Protocol to the dynamic space today, filled with tools like SnarkyJS and newer approaches to split the prover and verifier roles effectively. Discover the errors to avoid, like under-constraining data and letting divisors slip through unchecked, and learn how a solid review and audit process can save your ZK applications from disastrous security issues. Dive in to get the insights you need to navigate the ZK landscape confidently!

Brandon Kase · June 01, 2023

10 Must-Read Papers That Shaped Modern Zero-Knowledge Proofs

Zero-knowledge proofs have come a long way in 40 years, thanks to groundbreaking work from many brilliant minds. We're taking you on a tour of the key milestones in this fascinating journey, from the foundational concepts in 1985 by Goldwasser, Micali, and Rackoff, to modern applications and innovations like STARKs and zkVMs. You'll get a taste of major papers and projects that have pushed these proofs from theoretical curiosity to practical and scalable solutions. Dive into the history, understand the evolution, and see how these cryptographic marvels continue to shape the future of secure computation!

ZK/SEC · November 12, 2024