Computational cryptography › Public-key encryption and key exchange › Classical number theory › Pairing groups: BLS12-381, BN254
COMMITMENTPrimitive

KZG polynomial commitments

In plain words

Seal a huge list of numbers into one tiny value, then prove any single entry with one tiny proof.

The idea: Write the data as a polynomial: a curve passing through all your values. The setup hides a secret point τ inside curve points, so you can compute "the polynomial at τ", hidden, without knowing τ. That one point is the commitment. To prove the value at some position is y, you show that the polynomial minus y divides cleanly by (x - position), which takes one extra point that a pairing can check. Since nobody knows τ, nobody can find a different polynomial matching the same commitment.

Why it matters: Used by zero-knowledge proof systems and by Ethereum to handle rollup data.

The details

Commit to a whole polynomial with one short value, then prove its value at any point with one short proof (Kate, Zaverucha, Goldberg 2010)[1].

It needs a trusted setup (published powers of a secret τ) and q-type assumptions. Where you meet it: PLONK-style zero-knowledge proof systems[2] and Ethereum's blob data (EIP-4844)[3].

Rests on

If any of these breaks, this breaks too.

If it falls

If this breaks, these break with it.

Nothing on the map depends on it: it is an end point, something people use directly.

References

  1. Aniket Kate, Gregory M. Zaverucha and Ian Goldberg. Constant-Size Commitments to Polynomials and Their Applications. Advances in Cryptology - ASIACRYPT 2010. doi:10.1007/978-3-642-17373-8_11
  2. Ariel Gabizon, Zachary J. Williamson and Oana Ciobotaru. PLONK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge. IACR Cryptology ePrint Archive, Paper 2019/953. eprint.iacr.org/2019/953
  3. Vitalik Buterin, Dankrad Feist, Diederik Loerakker et al. EIP-4844: Shard Blob Transactions. Ethereum Improvement Proposals (Final), 2022. eips.ethereum.org/EIPS/eip-4844