Written by Pablo Gómez
Founder & CEO at Metlabs · Reviewed on October 11, 2026
To build a zk-SNARK, the computation to be proven is expressed as an arithmetic circuit, usually in R1CS (Rank-1 Constraint System) or QAP (Quadratic Arithmetic Program) form. The scheme uses bilinear pairings over pairing-friendly elliptic curves such as BN254 or BLS12-381, and requires a trusted setup that generates a structured reference string (SRS); the secret used, the toxic waste, must be destroyed. The theoretical foundation starts with GGPR in 2013, with Pinocchio as the first practical implementation, and the dominant scheme by verification efficiency is Groth16 (Jens Groth, Eurocrypt 2016): three group elements and three pairing operations.
It enables two things: privacy, through confidential transactions, and scaling, since a verifier checks an enormous computation in constant time. That succinctness breaks the link between verification cost and computation size, and it is the basis of the zk-rollups that decongest networks like Ethereum. Later schemes such as PLONK, Marlin and Sonic introduce a universal, updatable setup that is easier to operate.
Also known as
- zkSNARK
