LibraryPrivacy2016Design paperCorpus record
Efficient Zero-Knowledge Arguments for Arithmetic Circuits in the Discrete Log Setting
Inner-product arguments. Jonathan Bootle, Andrea Cerulli, Pyrros Chaidos, Jens Groth and Christophe Petit.
The paper compresses an inner-product argument so a circuit proof can be logarithmic without a trusted setup, in the discrete-log model.
A reading of the public paper. Not a copy, not a benchmark, and not a claim about any later network.
When someone says the proof has no setup, ask whether they mean this family or a hash-based STARK. The assumptions are different.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 3
- Records linked
- 4
Code
Source, repository, and what is actually hosted
- ePrint 2016/263https://eprint.iacr.org/2016/263
- The source URL is not a GitHub repository. No code remote is invented.
- Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
- Add to a reading list
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
The defect
Pairing-based SNARKs were short and needed a setup. Discrete-log arguments were transparent and too large.
Claim 02 · Paper model
The proposal
The paper compresses an inner-product argument so a circuit proof can be logarithmic without a trusted setup, in the discrete-log model.
Claim 03 · Paper model
No structured reference string.
The prover and verifier pay in group operations.
Claim 04 · Paper model
The bound
Logarithmic is not constant size. Groth16 is still shorter.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 The defect
Observation
What the study says
Pairing-based SNARKs were short and needed a setup. Discrete-log arguments were transparent and too large.
Model
What has to hold
The discrete-log assumption is the one that fails against a quantum adversary.
Falsifier
What would retire it
Is there a trusted setup?
02 The proposal
Observation
What the study says
The paper compresses an inner-product argument so a circuit proof can be logarithmic without a trusted setup, in the discrete-log model.
Falsifier
What would retire it
Is there a trusted setup?
03 No structured reference string.
Observation
What the study says
The prover and verifier pay in group operations.
Falsifier
What would retire it
Which assumption does soundness use?
04 The bound
03 Sequence
One action, as an operating tape
- 01Commit to vectors.
- 02Recurse on the inner product by folding the vectors in half.
- 03The verifier checks a logarithmic transcript against the discrete-log assumption.
- 04How does the proof grow with the circuit?
04 Load-bearing
The argument, and where a pitch drops it
What the paper is for
The cut
When someone says the proof has no setup, ask whether they mean this family or a hash-based STARK. The assumptions are different.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
A later client, parameter or reward formula is a different object from this paragraph.
What happened after
The cut
Bulletproofs cite this compression. Later folding schemes are a further branch, not this paper.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
A later client, parameter or reward formula is a different object from this paragraph.
05 Register
What has to be true
06 Divergence
What happened after the paper
Bulletproofs cite this compression. Later folding schemes are a further branch, not this paper.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 3 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
Pairing-based SNARKs were short and needed a setup. Discrete-log arguments were transparent and too large.
What the design proposes
- No structured reference string.
- The prover and verifier pay in group operations.
- The argument is what Bulletproofs later specialised for ranges.
How the mechanism is specified
- Commit to vectors.
- Recurse on the inner product by folding the vectors in half.
- The verifier checks a logarithmic transcript against the discrete-log assumption.
What this page does not treat as proven
Why the desk still reads it
When someone says the proof has no setup, ask whether they mean this family or a hash-based STARK. The assumptions are different.
09 Lexicon
Terms, opened into the record
- Inner product
- A sum of pairwise products. The argument proves it without sending the vectors.
- Discrete log
- The assumption that a group element does not reveal its exponent.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
Concepts
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.