Groth16
A widely used zk-SNARK proving system known for producing very small, fast-to-verify proofs, at the cost of requiring a separate trusted setup for each specific circuit.
Groth16 is a specific zk-SNARK (see Kaavon's "zk-SNARK" glossary definition) proving system, named for its creator and publication year, known for producing exceptionally small proof sizes and very fast verification times compared to many alternative proving systems, which made it an early popular choice for privacy-focused blockchain applications where on-chain verification cost matters a great deal.
Groth16's main drawback is that it requires a separate trusted setup (see Kaavon's "Trusted Setup" glossary definition) ceremony for each distinct computation circuit it's used with, rather than a single reusable, universal setup that could support many different circuits — meaning any change to the underlying circuit logic requires an entirely new trusted setup ceremony. This limitation is a key reason newer proving systems like PLONK (see Kaavon's "PLONK" glossary definition), which support a universal, reusable setup, have gained adoption for applications needing more flexibility to update their circuits over time.
Examples
- A privacy protocol using Groth16 benefits from very fast, cheap on-chain proof verification, but must run an entirely new trusted setup ceremony if it ever needs to meaningfully change its underlying circuit.
- Groth16's circuit-specific trusted setup requirement is a key tradeoff compared to newer universal-setup proving systems that support changing the circuit without a new ceremony.