KZG commitment

KZG requires a Structured Reference String produced by a trusted setup, the so-called powers of tau: powers of a secret τ multiplied by the generator, where τ is toxic waste that must be destroyed, because anyone who knows it could forge proofs. The commitment is C = p(τ)·G evaluated blindly with the SRS. To prove evaluation at a point, the quotient polynomial is committed and verified with a pairing equation over a pairing-friendly curve such as BLS12-381. Its commitments and proofs are constant-size, not logarithmic like Merkle, in exchange for a trusted setup and not being post-quantum.

It underpins data availability in Ethereum scaling and is a central building block of many zk-rollups, since proof systems such as PLONK use KZG commitments. It lets a rollup commit to large batches of data with small proofs and cheap on-chain verification, compatible with data availability sampling.

The original paper is Constant-Size Commitments to Polynomials and Their Applications by Aniket Kate, Gregory Zaverucha and Ian Goldberg, presented at ASIACRYPT 2010. EIP-4844 (proto-danksharding) brought it to Ethereum mainnet with the Dencun upgrade on 13 March 2024: each 128 KiB blob is committed with KZG. The public trusted setup, the KZG Summoning Ceremony, began on 13 January 2023 and gathered more than 140,000 participants, the largest of its kind to that date. Projects such as zkSync, Scroll, Polygon zkEVM and Linea base parts of their stack on these commitments.