> For the complete documentation index, see [llms.txt](https://thias-organization.gitbook.io/p256-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thias-organization.gitbook.io/p256-documentation/zero-knowledge-proofs.md). # Zero Knowledge Proofs In this page, we attempt to breakdown what ZKPs are ## Properties of ZKPs A Zero-Knowledge Proof (ZKP) is a method where the **Prover** can prove to the **Verifier** that a given statement is true without conveying any information beyond the validity of the statement itself. > *Imagine you have a secret recipe for the best cookies in the world. A Zero-Knowledge Proof (ZKP) allows you to prove to your friend that you have this recipe (you possess the knowledge) without actually revealing the recipe itself (keeping it secret).* 1. Completeness: If the Prover is telling the truth, then it will eventually convince the Verifier 2. Soundness: The Prover can only convince the Verifier if it is actually telling the truth 3. Zero-Knowledgeness: The Verifier does not learn anything about the Prover's solution ## Interactive ZKPs Interactive ZKPs are done through a series of interactions or challenges between the Prover and Verifier. Through these interactions, the Verifier becomes convinced of the truth of the statement without learning anything else. The proof is only valid for the original verifier and no other verifiers can trust the same proof since: * the Verifier can collude with the prover * the Verifier can generate fake proofs * the Verifier has to store secret parameters until all relevant proofs are verified which makes it vulnerable to leakage and attacks Therefore, there is a need for Non-Interactive ZKPs. ## ZK-SNARK Zero-Knowledge Succinct Non-Interactive Argument of Knowledge is a cryptographic proof that enables one party to validate information **without going through lengthy repetitive** computations and disclosing that information. ### Key Features 1. High data availability but linear scalability 2. ZK-SNARK security depends on the Common Reference String (CRS) setup. Any error in the setup would affect all circuits and generate false proofs. 3. Involve non-interactive computation 4. The compact proof sizes and consistent verification time make ZK-SNARK implementation cost-effective for L1 verification in ZK-rollups. A detailed (and highly mathematical) read for how ZK-SNARK works can be found in [this paper](https://arxiv.org/pdf/1906.07221). ## ZK-STARK Zero Knowledge Scalable Transparent Argument of Knowledge, shares similarities with ZK-SNARK, except that it offers a myriad of advantages, such as **heightened scalability and transparency**, and **robust defense mechanisms against security threats** without compromising the computational integrity. ### Key Features 1. Highly scalable, especially when it comes to handling extensive data. 2. No initial trusted setup is required 3. Larger proof sizes result in increased verification costs. 4. Highly resistant to quantum computing threats

Comparison between ZK-SNARK and ZK-STARK (source)

## Illustration of how ZKP works In the context of user authentication, ZKP reduces to “proving I know the correct password, without revealing the password or anything else directly connected to the password such as the password hash”. 1. First the application generates a (cryptographic) commitment to the password provided by the user. This commitment scheme binds the user to the password without revealing what the password is and is shared publicly with the user. 2. Then the application generates a random challenge and sends it to the user. 3. The user generates a response to the challenge by constructing a ZKP that demonstrates his knowledge of a password that satisfies the commitment without revealing the password. 4. The ZKP can be polynomial or [arithmetic circuit ](https://medium.com/web3studio/simple-explanations-of-arithmetic-circuits-and-zero-knowledge-proofs-806e59a79785)based: * the user can construct a polynomial where the coefficients represent the characters of the password and generate commitments to these coefficients using a commitment scheme. The ZKP requires user to demonstrate their knowledge of the polynomial without revealing the coefficients. This could be done using techniques like polynomial interpolation. * another approach could be constructing an arithmetic circuit that performs a password verification logic, and the user needs to demonstrate their knowledge of inputs that satisfy the circuit’s constraints without revealing the inputs. This could be done using techniques like constraint satisfaction and inner products, similar to zk-SNARK. 5. The application verifies the ZKP provided by the user to determine if it is valid.