- Groth16 remains a popular proof system due to its small 128-byte proofs, constant-size verification, and widespread deployments.
- The session covered Groth16’s advantages and downsides, followed by a recap of arithmetization and conversion of R1CS constraints into a polynomial identity.
- Vanishing polynomials and the Schwartz-Zippel lemma explain why checking at one random point verifies the polynomial identity.
- Pairings are required because the protocol needs to multiply two hidden commitments, and random linear combinations prevent the prover from using different witnesses.
- The CRS acts as Lego pieces with separating factors gamma and delta to restrict which pieces can be combined.
- The session finished by enforcing the quotient polynomial, merging checks into the final equation, and enforcing public inputs.
- Previous episodes covered arithmetization, zkTLS, false proofs, post-quantum SNARKs, trusted execution environments, data availability sampling, offchain keys, privacy in payments, and ZK on Bitcoin.