Skip to main content
Important: We do not provide financial advice or custody funds. All transactions occur on third-party platforms.

What ZK Actually Proves

Completeness, soundness, zero-knowledge — explained without symbols first. The history from Goldwasser-Micali-Rackoff to Fiat-Shamir, and what prover and verifier actually do.

35 min · expert · part of ZK Cryptography & Proof Systems

The Three Properties That Define a ZK Proof

A zero-knowledge proof is a way for one party — the prover — to convince another party — the verifier — that some statement is true, without revealing anything beyond the truth of the statement itself. That definition sounds slippery on first read. The discipline becomes precise when you decompose it into three properties that every legitimate zero-knowledge proof must satisfy. **Completeness.** If the statement is true and the prover follows the protocol honestly, the verifier will accept the proof. This is the "happy path." A correct proof must convince a correct verifier. Without completeness, the protocol is useless because even honest provers cannot get their truthful claims accepted. **Soundness.** If the statement is false, no cheating prover can convince the verifier to accept — except with negligibly small probability. This is the security guarantee. Soundness is what makes a proof actually mean something. A protocol with perfect completeness but weak soundness is just a rubber stamp. In modern systems "negligibly small" typically means probabilities like 2^(-100) or 2^(-128), which is to say, smaller than the chance of guessing a private key by accident. **Zero-knowledge.** The verifier learns nothing from the proof beyond the fact that the statement is true. Crucially, "learns nothing" is formalized using a simulator: there exists an efficient algorithm that, without ever seeing a real proof, can produce a transcript indistinguishable from a real interaction. If such a simulator exists, then anything the verifier could extract from the proof, it could have generated on its own without the prover. Therefore the proof itself reveals no extra information. Hold these three together and you have something remarkable. Alice can prove to Bob that she knows a password without telling Bob the password. A rollup can prove to Ethereum that a million transactions are valid without Ethereum re-executing them. A user can prove they are over 18 without revealing their date of birth. Every interesting application of zero-knowledge cryptography is a creative use of these three properties. This lesson builds the intuition for why these properties are achievable, the historical breakthrough that introduced them, and the move from interactive to non-interactive proofs that made the whole field practical.

Also in this lesson

  • The Ali Baba Cave (Intuition Pump)
  • The 1985 Breakthrough
  • What Prover and Verifier Actually Do
  • Interactive vs Non-Interactive (Fiat-Shamir)
  • What Can Be Proven in Zero Knowledge

Key terms

Zero-knowledge proof
A cryptographic protocol in which a prover convinces a verifier that a statement is true without revealing any information beyond the validity of the statement itself.
Completeness
The property that an honest prover with a true statement can always convince an honest verifier.
Soundness
The property that no cheating prover can convince the verifier that a false statement is true, except with negligible probability.
Zero-knowledge property
The property that the verifier learns nothing from the proof beyond the truth of the statement, formalized by the existence of a simulator that can produce indistinguishable transcripts without the witness.
Prover
The party in a ZK protocol that holds the secret witness and produces a proof object convincing the verifier of a statement.
Verifier
The party in a ZK protocol that holds only the public statement and the proof, and runs an algorithm to accept or reject.
Witness
The secret piece of information held by the prover that demonstrates the truth of the statement (e.g., a private key, a preimage, a transaction sequence).
Interactive proof
A proof system in which prover and verifier exchange multiple rounds of messages, with the verifier issuing random challenges between prover responses.
Fiat-Shamir transform
A technique from 1986 that converts interactive sigma protocols into non-interactive proofs by replacing verifier randomness with the output of a cryptographic hash applied to the protocol transcript.
Random oracle model
A theoretical model in which a hash function is treated as an idealized random function, used to prove security of constructions like Fiat-Shamir; real hashes (SHA-256, Poseidon) are believed to approximate it well enough for practice.

Continue this lesson — 5 more sections in the CryptoBipto app.

Open lesson

Educational only — not financial advice.