A tiny proof that a computation was done correctly, which anyone can check in milliseconds, even without seeing the inputs.
The idea: First the computation is rewritten as a set of polynomial equations that hold only if every step was done right. The prover commits to those polynomials, and the verifier checks them at a random secret point hidden in curve points from the setup. Two different polynomials almost never agree at a random point, so passing the check there convinces the verifier that the equations hold everywhere, and a pairing makes the check take milliseconds. Extra randomness mixed in hides the inputs.
Why it matters: Powers private payments and the "zk" rollups that scale blockchains.
On the map: Groth16, PLONK (FS: PLONK only)
Succinct non-interactive arguments of knowledge: a tiny proof (Groth16: three curve points, 128 bytes on BN254 compressed or 256 uncompressed)[1] that a computation was done correctly, checkable in milliseconds and able to hide secret inputs (zero knowledge).
Groth16 needs a trusted setup per circuit. PLONK needs one universal setup (KZG)[2]. PLONK is made non-interactive with Fiat-Shamir[3] (the FS tag). Groth16 is non-interactive by design. Security proofs use the generic or algebraic group model, and Gentry and Wichs (2011)[4] showed that no such succinct argument can be proven secure from standard falsifiable assumptions by black-box reductions, so some idealized model is unavoidable.
Where you meet it: Zcash[5], zk-rollups, private identity and voting systems.
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.