VincentC

Notes on the Composability of ZK Proof Systems

Thu, 10 Sep 2026 00:00:00 GMT

When people say a proof system is “composable” they rarely mean the same thing. Sometimes they mean that a proof can verify another proof. Sometimes they mean that many proofs can be merged into one. And sometimes they mean something closer to what smart-contract developers mean: that independent parties can build on each other’s statements without coordinating. These are three different properties, with three different costs, and conflating them leads to confused designs.

Three meanings of “composable”

Proof composition. A proof $\pi_2$ attests that a verifier accepted an earlier proof $\pi_1$ . This is recursion, and it is what makes incrementally verifiable computation possible.¹
Accumulation. Instead of verifying each proof, the expensive part of verification is deferred and merged into a running accumulator that is checked once, at the end.
Application-level composition. Statements refer to other statements. A proof about a rollup’s state transition can be consumed by a bridge, which is consumed by an exchange, and none of the three teams needs to know about the others in advance.

The first two are properties of a proof system. The third is a property of how statements are designed, and no amount of recursion will give it to you for free.

Recursion: a verifier inside a circuit

To prove “I verified $\pi_1$ ”, the verifier $V$ of the inner proof system has to be expressed as a circuit of the outer one. If the computation being proved has size $|F|$ and the verifier circuit has size $|V|$ , every step of an incremental computation pays for $|F| + |V|$ constraints, so the quantity that matters is the overhead ratio $|V| / |F|$ .

One step of incrementally verifiable computation: the step circuit applies $F$ and, alongside it, verifies the proof of all previous steps.

For pairing-based SNARKs the verifier is dominated by a few pairings, which are expensive to arithmetise because the pairing’s field is not the circuit’s native field. Cycles of elliptic curves avoid the non-native arithmetic, at the price of either giving up pairings on at least one curve of the cycle or using pairing-friendly cycles whose fields are very large.²

A proof system composes well when verifying a proof inside another proof is cheap compared to the computation being proved. Everything else is engineering around that ratio.

Accumulation and folding

The observation behind accumulation schemes is that the verifier does not have to be run inside the circuit; it is enough to postpone its expensive part.³ In Halo this is the linear-time check of an inner-product argument; each step adds the claim to an accumulator with a random linear combination, and only the final accumulator is checked by a “decider”.⁴

Folding schemes push this further. Nova folds a fresh R1CS instance, with witness commitment $\bar{W}_2$ and public input $\mathbf{x}_2$ , into a running relaxed instance using one random challenge $r \gets \F$ and the commitment $\bar{T}$ to a cross term sent by the prover. The per-step cost of recursion becomes a constant number of group operations rather than a verifier circuit:⁵

(\bar{E},\, u,\, \bar{W},\, \mathbf{x}) \;=\; (\bar{E}_1 + r\,\bar{T},\;\; u_1 + r,\;\; \bar{W}_1 + r\,\bar{W}_2,\;\; \mathbf{x}_1 + r\,\mathbf{x}_2).

Approach	Carried from step to step	Prover’s recursion overhead	Final check
Full recursion	a complete proof	a full verifier circuit	one proof verification
Accumulation	a proof and an accumulator	the cheap half of the verifier	one verification and one decider
Folding	a running instance	a few group operations	one proof for the folded instance

The table hides an important asymmetry: in the last two rows the object that comes out of step $i$ is not yet a succinct proof. Succinctness is restored only at the very end, by a final SNARK.

Application-level composition

A proof composes with the outside world through its public inputs, in the same way a function composes through its signature. If the public input of a state-transition proof is a pair of state roots $(\mathsf{root}_{\text{old}}, \mathsf{root}_{\text{new}})$ , anyone can chain proofs, aggregate them, or build a bridge on top. If instead the statement hard-codes a verification key, a fixed batch size, or a particular hash of the calldata, every consumer must be redeployed when the producer changes.

Two design rules follow:

Treat the public-input layout as an API. Version it, document it, and keep it small.
Separate aggregation (many proofs, one verification, no semantic relationship) from composition (one statement refers to another). The former is an optimisation and can be changed at will; the latter is a contract between systems.

What it costs

Recursion is not free even when the prover overhead is small. Knowledge soundness of a recursive proof is argued by extracting witnesses layer by layer, and the extractor’s running time can grow exponentially with the depth of the recursion, which is why the classical guarantees are stated for constant depth.⁶ Deployed systems recurse far deeper than that and rely on the absence of known attacks.

A rough cost checklist

Non-native field arithmetic, or a curve cycle with its own constraints.
Hashing the accumulator or the running instance inside the circuit (Fiat–Shamir in-circuit).
One final “compression” proof, often in a different proof system, to obtain a small proof.
A larger trusted computing base: the verifier circuit is now security-critical code.

Paul Valiant, “Incrementally Verifiable Computation or Proofs of Knowledge Imply Time/Space Efficiency”, TCC 2008. ↩︎
Eli Ben-Sasson, Alessandro Chiesa, Eran Tromer and Madars Virza, “Scalable Zero Knowledge via Cycles of Elliptic Curves”, CRYPTO 2014. ↩︎
Benedikt Bünz, Alessandro Chiesa, Pratyush Mishra and Nicholas Spooner, “Proof-Carrying Data from Accumulation Schemes”, TCC 2020. ↩︎
Sean Bowe, Jack Grigg and Daira Hopwood, “Recursive Proof Composition without a Trusted Setup”, IACR ePrint 2019/1021. ↩︎
Abhiram Kothapalli, Srinath Setty and Ioanna Tzialla, “Nova: Recursive Zero-Knowledge Arguments from Folding Schemes”, CRYPTO 2022. ↩︎
Nir Bitansky, Ran Canetti, Alessandro Chiesa and Eran Tromer, “Recursive Composition and Bootstrapping for SNARKs and Proof-Carrying Data”, STOC 2013. ↩︎

KZG 承诺的同点批量打开：一个引理及其证明

Tue, 02 Jun 2026 00:00:00 GMT

多项式承诺让证明者先承诺一个多项式 $f$ ，之后再令人信服地打开它在任意一点的取值。KZG 方案¹的承诺和打开证明都只有一个群元素，这使它成为 PLONK 等证明系统的基础构件。实际系统里，验证者往往需要在同一个点 $z$ 上同时打开 $t$ 个多项式：逐个验证需要 $2t$ 次配对，而一次随机线性组合可以把它降到 $2$ 次。² 这篇笔记把其中用到的引理单独拿出来，完整地证明一遍。

记号

设 $\G_1, \G_2, \G_T$ 是阶为素数 $p$ 的循环群，生成元分别为 $g_1, g_2, g_T$ ； $e\colon \G_1 \times \G_2 \to \G_T$ 是非退化的双线性映射， $\F = \F_p$ 。对 $a \in \F$ ，记 $\gi{a} = a \cdot g_1$ ， $\gii{a} = a \cdot g_2$ 。

定义（KZG 多项式承诺）

令 $d$ 为次数上界。可信设置选取随机的 $\tau \gets \F$ ，输出

\srs = \bigl(\gi{1},\, \gi{\tau},\, \gi{\tau^2},\, \dots,\, \gi{\tau^d};\;\; \gii{1},\, \gii{\tau}\bigr)

并销毁 $\tau$ 。对任意 $f \in \F[X]$ ， $\deg f \le d$ ：

承诺： $\com(f) = \gi{f(\tau)}$ ，它可以由 $\srs$ 线性地算出；
打开：要证明 $f(z) = v$ ，令 $q(X) = \dfrac{f(X) - v}{X - z}$ ，证明为 $\pi = \gi{q(\tau)}$ ；
验证：接受当且仅当 $e\bigl(C - \gi{v},\, \gii{1}\bigr) = e\bigl(\pi,\, \gii{\tau} - \gii{z}\bigr)$ 。

验证等式之所以成立，是因为 $q$ 是多项式当且仅当 $(X - z) \mid f(X) - v$ ，也就是当且仅当 $f(z) = v$ 。

同点批量打开

设证明者已经承诺了 $f_1, \dots, f_t$ ，承诺为 $C_i = \com(f_i)$ ，并声称对所有 $i$ 都有 $f_i(z) = v_i$ 。协议如下：

验证者发送随机挑战 $\gamma \gets \F$ （非交互的情形下， $\gamma$ 由 Fiat–Shamir 变换得到）；
证明者计算批量商多项式 $h(X) = \sum_{i=1}^{t} \gamma^{i-1} \cdot \dfrac{f_i(X) - v_i}{X - z}$ ，发送 $\pi = \gi{h(\tau)}$ ；
验证者计算 $C_\gamma = \sum_{i=1}^{t} \gamma^{i-1} C_i$ 与 $v_\gamma = \sum_{i=1}^{t} \gamma^{i-1} v_i$ ，接受当且仅当

e\bigl(C_\gamma - \gi{v_\gamma},\, \gii{1}\bigr) = e\bigl(\pi,\, \gii{\tau} - \gii{z}\bigr).

记 $F_\gamma(X) = \sum_{i=1}^{t} \gamma^{i-1}\bigl(f_i(X) - v_i\bigr)$ 。诚实的证明者满足 $C_\gamma - \gi{v_\gamma} = \gi{F_\gamma(\tau)}$ 以及 $F_\gamma(X) = h(X)\,(X - z)$ ，于是完备性由双线性直接得到：

\begin{aligned} e\bigl(C_\gamma - \gi{v_\gamma},\, \gii{1}\bigr) &= e\bigl(\gi{F_\gamma(\tau)},\, \gii{1}\bigr) \\ &= e\bigl(\gi{h(\tau)\,(\tau - z)},\, \gii{1}\bigr) \\ &= e\bigl(\gi{h(\tau)},\, \gii{\tau - z}\bigr) = e\bigl(\pi,\, \gii{\tau} - \gii{z}\bigr). \end{aligned}

把 $h$ 完全展开，就是下面这个很长的式子（它同时用来测试窄屏上的横向滚动）：

h(X) = \frac{f_1(X) - v_1}{X - z} + \gamma \cdot \frac{f_2(X) - v_2}{X - z} + \gamma^{2} \cdot \frac{f_3(X) - v_3}{X - z} + \gamma^{3} \cdot \frac{f_4(X) - v_4}{X - z} + \cdots + \gamma^{t-1} \cdot \frac{f_t(X) - v_t}{X - z} = \frac{1}{X - z} \sum_{i=1}^{t} \gamma^{i-1} \bigl(f_i(X) - v_i\bigr).

引理与证明

可靠性的核心是：只要有一个声称的取值是错的，做完随机线性组合之后它以压倒性的概率「仍然是错的」。

引理（随机线性组合）

设 $f_1, \dots, f_t \in \F[X]$ ， $z, v_1, \dots, v_t \in \F$ ， $F_\gamma$ 如上定义。若存在 $j$ 使得 $f_j(z) \neq v_j$ ，则

\Pr_{\gamma \gets \F}\Bigl[\, (X - z) \mid F_\gamma(X) \,\Bigr] \;\le\; \frac{t-1}{|\F|}.

证明

由余式定理， $(X - z) \mid F_\gamma(X)$ 当且仅当 $F_\gamma(z) = 0$ 。把 $F_\gamma(z)$ 看成关于 $\gamma$ 的多项式：

P(\gamma) = \sum_{i=1}^{t} \bigl(f_i(z) - v_i\bigr)\, \gamma^{i-1} \;\in\; \F[\gamma].

它的次数至多为 $t - 1$ ，并且 $\gamma^{j-1}$ 的系数 $f_j(z) - v_j \neq 0$ ，所以 $P$ 不是零多项式。域上非零多项式的根的个数不超过它的次数，因此使 $P(\gamma) = 0$ 的 $\gamma$ 至多有 $t - 1$ 个；而 $\gamma$ 在 $\F$ 上均匀分布，故所求概率不超过 $(t-1)/|\F|$ 。

定理（批量打开的可靠性，非正式）

假设单个多项式的 KZG 方案满足求值绑定性，并且从敌手输出的每个承诺 $C_i$ 都能提取出对应的多项式 $f_i$ （例如在代数群模型中³）。那么对任何多项式时间的敌手，批量验证通过、同时又存在某个 $j$ 使 $f_j(z) \neq v_j$ 的概率至多为 $(t-1)/|\F| + \negl(\lambda)$ 。

证明

（概要）设验证通过且某个 $f_j(z) \neq v_j$ 。由引理 1，除去至多 $(t-1)/|\F|$ 的概率，有 $F_\gamma(z) \neq 0$ 。此时 $C_\gamma - \gi{v_\gamma}$ 是多项式 $F_\gamma$ 的承诺，而敌手的 $\pi$ 把它在 $z$ 处打开为 $0$ ；归约算法知道所有的 $f_i$ ，可以自己诚实地算出把同一个承诺在 $z$ 处打开为 $F_\gamma(z) \neq 0$ 的证明。同一个承诺在同一点有两个取值不同的合法打开，与求值绑定性矛盾。

代价

	逐个打开	批量打开
证明大小	$t$ 个 $\G_1$ 元素	$1$ 个 $\G_1$ 元素
配对次数	$2t$	$2$
$\G_1$ 上的标量乘	约 $2t$	约 $t + 1$
额外的可靠性损失	无	$(t-1)/\lvert\F\rvert$

对 $|\F| \approx 2^{255}$ 和实际中出现的 $t \le 2^{10}$ ，这个损失完全可以忽略。

Aniket Kate, Gregory M. Zaverucha, Ian Goldberg, “Constant-Size Commitments to Polynomials and Their Applications”, ASIACRYPT 2010. ↩︎
Ariel Gabizon, Zachary J. Williamson, Oana Ciobotaru, “PLONK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge”, IACR ePrint 2019/953. ↩︎
Georg Fuchsbauer, Eike Kiltz, Julian Loss, “The Algebraic Group Model and its Applications”, CRYPTO 2018. ↩︎

Batch Inversion in Rust

Thu, 20 Nov 2025 00:00:00 GMT

Inversion is by far the most expensive basic operation in a prime field, and provers invert all the time: the denominators of a quotient polynomial over an evaluation domain, the slopes in affine point addition, the weights of a barycentric evaluation. Montgomery’s trick replaces $n$ inversions by one inversion and about $3n$ multiplications.

The trick

Write $p_i = a_0 a_1 \cdots a_{i-1}$ for the prefix products, with $p_0 = 1$ . Invert only the last one, $p_n^{-1}$ , then walk backwards. At every step two multiplications recover one inverse and shorten the running inverse by one factor:

a_i^{-1} = p_{i+1}^{-1} \cdot p_i, \qquad p_i^{-1} = p_{i+1}^{-1} \cdot a_i .

All the algorithm needs from the field is a multiplication, a zero test and a single inversion:

src/field.rs

use core::ops::{Mul, MulAssign};

/// The handful of operations batch inversion needs from a field element.
pub trait Field: Copy + Mul<Output = Self> + MulAssign {
    const ONE: Self;

    fn is_zero(&self) -> bool;

    /// Returns `None` for zero.
    fn invert(&self) -> Option<Self>;
}

The code

Zeros have no inverse, so they are skipped in both passes and left untouched. The highlighted lines are the single inversion and the two multiplications per element.

src/batch_inverse.rs

use crate::field::Field;

/// Inverts every non-zero element of `values` in place; zeros stay zero.
/// Costs one field inversion and about 3n multiplications.
pub fn batch_inverse<F: Field>(values: &mut [F]) {
    // Forward pass: prefix[i] = product of the non-zero values before i.
    let mut prefix = Vec::with_capacity(values.len());
    let mut acc = F::ONE;
    for v in values.iter() {
        prefix.push(acc);
        if !v.is_zero() {
            acc *= *v;
        }
    }

    // The only inversion. `acc` is a product of non-zero elements.
    let mut inv = acc.invert().expect("product of non-zero elements");

    // Backward pass: `inv` is the inverse of the product of values[..=i].
    for (v, p) in values.iter_mut().zip(prefix).rev() {
        if v.is_zero() {
            continue;
        }
        let next = inv * *v; // drop v from the running inverse
        *v = inv * p; // v⁻¹ = (a₀ ⋯ aᵢ)⁻¹ · (a₀ ⋯ aᵢ₋₁)
        inv = next;
    }
}

The function allocates one scratch vector of $n$ elements. When memory matters more than simplicity, the prefix products can be written into the output buffer of the caller instead, and the slice can be processed in chunks that fit the cache:

cargo test batch_inverse
cargo bench --bench inversion -- --sample-size 50

One caveat for cryptographic code: the branch on is_zero makes the running time depend on which elements are zero. That is fine for public data such as evaluation domains, and it is not fine for secrets.