On the Size of Pairing-based Non-interactive Arguments

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

1. Claim 01 · Paper model

   Size is the result

   The paper is about how small a pairing argument can be. Three group elements became the reference that later systems either beat for other reasons or deliberately gave up.

2. Claim 02 · Paper model

   The string is the circuit

   The setup bakes in the program. Change a constraint and the old ceremony does not apply. A team that says we upgraded the circuit and kept the setup has left the proof system.

3. Claim 03 · Paper model

   Toxic waste is literal

   The trapdoor can satisfy the verifier for a false statement. Multi-party ceremonies exist to make one honest deletion enough. A ceremony that nobody can audit is a trusted party with extra steps.

4. Claim 04 · Paper model

   Zero knowledge is optional to the use

   The same argument can prove a public computation. Privacy appears only if the witness stays secret and the circuit does not leak it. A public input can undo the slogan.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

1. 01 Size is the result

   Observation

   What the study says

   The paper is about how small a pairing argument can be. Three group elements became the reference that later systems either beat for other reasons or deliberately gave up.

   Model

   What has to hold

   Knowledge-of-exponent type assumptions hold in the pairing groups.

   Falsifier

   What would retire it

   Which circuit is bound to the reference string?

2. 02 The string is the circuit

   Observation

   What the study says

   The setup bakes in the program. Change a constraint and the old ceremony does not apply. A team that says we upgraded the circuit and kept the setup has left the proof system.

   Model

   What has to hold

   The verifier uses the verification key that matches the circuit the users think is running.

   Falsifier

   What would retire it

   Is a circuit change paired with a new setup?

3. 03 Toxic waste is literal

   Observation

   What the study says

   The trapdoor can satisfy the verifier for a false statement. Multi-party ceremonies exist to make one honest deletion enough. A ceremony that nobody can audit is a trusted party with extra steps.

   Model

   What has to hold

   The trapdoor was destroyed. One party who kept it can forge.

   Falsifier

   What would retire it

   What is a public input, and does it leak the witness?

4. 04 Zero knowledge is optional to the use

   Observation

   What the study says

   The same argument can prove a public computation. Privacy appears only if the witness stays secret and the circuit does not leak it. A public input can undo the slogan.

   Model

   What has to hold

   Public inputs really are the statement. Moving a secret into the public input destroys the privacy claim without breaking the proof.

   Falsifier

   What would retire it

   What is a public input, and does it leak the witness?

03 Sequence

One action, as an operating tape

1. 01Someone writes the statement as an arithmetic circuit.
2. 02A setup produces a proving key and a verification key, and is supposed to destroy the trapdoor.
3. 03The prover, who knows the witness, produces three group elements.
4. 04Anyone with the verification key checks a pairing equation.
5. 05A new circuit requires a new setup before those steps mean anything.

04 Load-bearing

The argument, and where a pitch drops it

1. Tiny proofs moved the trust into the ceremony

   The cut

   The chain is easy to verify and hard to trust if the setup is opaque. PLONK later made the setup universal so one ceremony could serve many circuits. It did not make the ceremony optional. STARKs are the line that refuses the string.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   Do not call a Groth16 deployment trustless. The setup is a trust assumption.

2. A proof of the wrong circuit is a correct proof

   The cut

   Groth16 will happily prove that a weaker program accepted a bad state. Auditing the circuit is not the cryptography's job, and it is most of the actual risk.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   Do not call a Groth16 deployment trustless. The setup is a trust assumption.

05 Register

What has to be true

• Model · Not re-measured

  Knowledge-of-exponent type assumptions hold in the pairing groups.

• Model · Not re-measured

  The trapdoor was destroyed. One party who kept it can forge.

• Cryptography · Not re-measured

  The verifier uses the verification key that matches the circuit the users think is running.

• Cryptography · Not re-measured

  Public inputs really are the statement. Moving a secret into the public input destroys the privacy claim without breaking the proof.

06 Divergence

What happened after the paper

Zcash's Sapling era and many early rollup proofs used Groth16 because the proofs are small. Newer systems moved to PLONK-family or transparent proofs to escape per-circuit setups. A project still on Groth16 in 2026 has to name its ceremony and its circuit. The paper will not do that for them.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

1. Kill test 1Which circuit is bound to the reference string?
2. Kill test 2Who participated in the setup, and how is the transcript checked?
3. Kill test 3What is a public input, and does it leak the witness?
4. Kill test 4Is a circuit change paired with a new setup?
5. 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

09 Lexicon

Terms, opened into the record

Common reference string

The setup output both prover and verifier need. In Groth16 it is specific to one circuit.

Trapdoor

The secret from the setup that can forge proofs if it is kept.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

11 Related

The next papers, as theses

• PLONK · 2019

  PLONK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge

  A SNARK with a universal and updatable structured reference string. One setup can serve many circuits. The proofs are larger than Groth16, and there is still a setup.

• Zexe · 2020

  Zexe: Enabling Decentralized Private Computation

  A model for private computation over records. Each record has a birth predicate and a death predicate. A transaction proves that some records died and others were born, without showing which, or showing the data.

• Bulletproofs · 2018

  Bulletproofs: Short Proofs for Confidential Transactions and More

  Range proofs whose size grows logarithmically, with no trusted setup. They made confidential amounts practical to verify. They are not, by themselves, a private payment system.