Archetype x zkSecurity - Proof is in the Pudding: Groth16 - ZK/SEC Quarterly
Back to all posts
For the 10th session of Proof is in the Pudding, we tackled Groth16 . It's nearly ten years old and still one of the most widely used proof systems out there: 128-byte proofs, constant-size verification, deployments everywhere.
Tip
Prefer reading?<br>This session is the video companion to Groth16, Intuitively, the written version with all the equations spelled out. Pick whichever format you prefer, or use both.
We started with why Groth16 is still used and the downsides that come with it, then recapped the arithmetization and turned a pile of R1CS constraints into a single polynomial identity, with vanishing polynomials and the Schwartz-Zippel lemma explaining why checking at one random point is enough. From there we looked at why the protocol needs pairings (you have to multiply two hidden commitments, and nothing else will do it), how random linear combinations stop the prover from using a different witness in each place, and how the CRS acts as a set of Lego pieces where the separating factors gamma and delta restrict which pieces can be snapped together. We finished by enforcing the quotient polynomial, merging the separate checks into the final equation, and enforcing public inputs.
If you enjoy this video, check out our previous episodes:
Session 01: Arithmetization - Introduction to converting logical statements into arithmetic circuits
Session 02: zkTLS - Exploring zero-knowledge TLS and secure oracles
Session 03: How to Prove False Statements - Fiat-Shamir security and the GKR protocol
Session 04: Proofs On A Leash - Introduction to post-quantum lattice-based SNARKs with Greyhound
Session 05: Trust, But Measure - Introduction to Trusted Execution Environments with Intel TDX
Session 06: Introduction to Data Availability Sampling - How rollups and Ethereum's DA system work
Session 07: The Other Dark Forest - Offchain public keys with zkLogin, ZK Email, and ZKPassport
Session 08: Privacy in Payment Networks - From E-Cash and Monero to Zcash and Zether
Session 09: ZK on Bitcoin - Verifying ZK proofs on Bitcoin, from MPC approaches to BitVM
Have a topic you'd like us to cover in a future session? Let us know on Twitter/X!
Share This Article
Share on X
Share on LinkedIn
Share via Email
zkSecurity offers auditing, research, and development services for cryptographic systems including zero-knowledge proofs, MPCs, FHE, consensus protocols and more.
Learn More →
Latest Posts
AI meets Cryptography 3: What AI Found in Bron Labs's bron-crypto
Stefanos Chaliasos, Hao Pham, False Witness Team<br>July 22, 2026
security
crypto
AI
zkao
audit
mpc
We pointed our AI audit pipeline at bron-crypto, Bron Labs's Go library for MPC and threshold signatures, and confirmed four bugs. All of them are now fixed upstream. This is the third post in our series on bugs our agents found across open source cryptography.
Nine Years to Halve a Hash Function: RFC 9861 Is Out
David Wong<br>July 21, 2026
announcement
cryptography
After nearly a decade in the making, RFC 9861: KangarooTwelve and TurboSHAKE was officially published in October 2025, with zkSecurity among its editors. This post explains why these hash functions deserve to be far more widely used than they are today. Built on the same Keccak permutation as SHA-3 and SHAKE but with the round count halved, they do the same job at the same security level roughly twice as fast. We cover why halving the rounds is safe, what the RFC actually defines, the caveats around FIPS compliance and workload-dependent speedups, and why a standard like this took nine years to land.
Bringing Aleo and Leo into zkao
zk/sec, False Witness team<br>July 20, 2026
announcement
zkao
security
audit
We recently brought Leo and Aleo support to zkao, our AI-powered bug-detection tool, and put it to work on a real engagement with HumanityLink. Getting an LLM to audit a young ecosystem like Aleo turned out to be less about the model and more about what we fed it - custom prompts or skills so it actually recognizes Aleo bug patterns, a harness called cheatVM that turns findings into real end-to-end proofs of concept instead of code that just looks right, and a clear threat model that significantly cut down our false positives.
Recommended Reading
Groth16, Intuitively
David Wong<br>May 01, 2026
educative
zk
groth16
Groth16 is still the gold standard for succinct SNARKs: 128-byte proofs, constant-size verification, and a decade of real-world deployment. But despite its ubiquity, almost nobody explains *why* it works the way it does. In this post, we build Groth16 from the ground up, starting from R1CS and QAPs, then layer in pairings, trusted setup parameters, and the separator tricks (α, β, γ, δ) that make the scheme sound. By the end, you should have an intuitive grasp of every term in the final verifier equation.
Archetype x zkSecurity - Proof is in the Pudding: ZK on...