ZK/SEC Research notes from zkSecurity
All series
Series

Variants of KZG

5 parts April 2025 – August 2026 65 min in total Varun Thakore
  1. Part 1

    Variants of KZG: Part I, Univariate

    In this blog post, we dive into the world of polynomial commitment schemes (PCS), which are crucial for constructing most practical SNARKs. We cover the basics of how PCS works, focusing on KZG10, known for its efficiency in proof size and verification time. You'll learn about the essential properties of binding and hiding and explore technical concepts like homomorphism, batching, and unconditionally hiding. We break down various methods to achieve these features, offering insight into how PCS maintains the security and privacy of polynomials in cryptographic systems. Get ready to understand these powerful concepts and their applications in modern cryptography!

    Varun Thakore April 28, 2025 17 min Read →
  2. Part 2

    Variants of KZG: Part II, Multilinear Commitments with PST

    In this blog post, we extend the ideas behind univariate KZG commitments to multilinear polynomials through the PST commitment scheme. We derive the multilinear quotient identity, explain how PST commits to and opens multilinear polynomials using a specialized multilinear setup and walk through its opening protocol. We conclude by examining the proof size, prover and verifier costs, and the limitations that motivate other multilinear polynomial commitment schemes.

    Varun Thakore July 28, 2026 7 min Read →
  3. Part 3

    Variants of KZG: Part III, Multilinear Commitments with Zeromorph

    In this blog post, we extend univariate KZG commitments to multilinear polynomials through Zeromorph. We introduce the univariatization map, encode the multilinear quotient identity as a univariate identity, and explain why the quotient encodings require degree checks. We then show how Zeromorph batches these checks into a single degree-bounded KZG opening and walk through its end-to-end opening protocol. We conclude by examining its proof size, prover cost, and verifier cost.

    Varun Thakore August 04, 2026 19 min Read →
  4. Part 4

    Variants of KZG: Part IV, Multilinear Commitments with Gemini

    In this blog post, we extend univariate KZG commitments to multilinear polynomials through Gemini. We introduce recursive partial evaluations, derive the split-and-fold identity and express each fold as a univariate identity that can be checked using KZG openings. We then walk through the end-to-end opening protocol. We conclude by examining its proof size, prover cost, and verifier cost.

    Varun Thakore August 12, 2026 8 min Read →
  5. Part 5

    Variants of KZG: Part V, Multilinear Commitments with Mercury

    In this final post of the series, we extend univariate KZG commitments to multilinear polynomials through Mercury. Building on Gemini, we fold half of the variables at once, use polynomial division to bind this large fold to the original commitment and reduce the remaining multilinear evaluations to a batched inner product check. We then walk through the end-to-end opening protocol. We conclude by examining its proof size, prover cost and verifier cost.

    Varun Thakore August 17, 2026 14 min Read →
Other series see all →
1 part zkvmBlast August 2026 3 parts zkao February 2026 – July 2026 10 parts Proof is in the Pudding October 2024 – July 2026 3 parts AI meets Cryptography July 2026