SNARKs vs STARKs

What you'll learn

• Reading the Acronyms
• Trusted Setups and the KZG Ceremony
• Major SNARK Flavors: Groth16, PLONK, Halo2
• STARKs and the StarkWare Lineage
• Choosing SNARK vs STARK in Practice
• Recursive Proofs and Proof Aggregation

Key terms

zk-SNARK

Succinct Non-interactive ARgument of Knowledge — a ZK proof system that is short, fast to verify, and (typically) requires a trusted setup. Major variants include Groth16, PLONK, and Halo2.

zk-STARK

Scalable Transparent ARgument of Knowledge — a ZK proof system built only from hash functions, requiring no trusted setup and offering post-quantum security. Introduced by Eli Ben-Sasson and collaborators in 2018; commercialized by StarkWare.

Trusted setup

A one-time procedure required by many SNARK schemes that generates a structured reference string from secret randomness; if the randomness is recovered, the system can be forged, so ceremonies use multi-party computation across many participants.

KZG ceremony

The 2023 Ethereum trusted setup ceremony (Kate-Zaverucha-Goldberg) supporting proto-danksharding and many ZK applications; ran January-April 2023 and accumulated on the order of 140,000 contributions, the largest cryptographic ceremony to date.

Groth16

A classical pairing-based SNARK by Jens Groth (2016) with ~192-byte proofs and constant-time verification, but requiring a per-circuit trusted setup; used by Tornado Cash and many shielded-asset designs.

PLONK

A 2019 SNARK system (Gabizon, Williamson, Ciobotaru) introducing a universal and updateable trusted setup, decoupling the ceremony from any specific circuit; the basis for Linea, Scroll, zkSync Era Boojum, and many modern provers.

Halo2

A SNARK system with no trusted setup, using inner-product-argument polynomial commitments and Plonkish arithmetization; basis for Penumbra and the Zcash Orchard shielded pool.

FRI (Fast Reed-Solomon IOP)

The low-degree polynomial test at the heart of STARKs; lets the verifier check with high probability that a committed polynomial is close to a low-degree polynomial.

Recursive proof

A proof system where one circuit verifies another proof, enabling aggregation of many proofs into one and constant-size verification of arbitrarily large computations; used by Mina, StarkNet, zkSync, Linea, and most modern rollups.

Folding scheme

A modern alternative to full recursive verification that accumulates proofs into a single relaxed instance with cheaper intermediate steps; Nova (2022) and successors (SuperNova, Sangria) are the foundational examples and underpin many zkVMs.