Writing a Circuit (Circom / Noir / Cairo)
Circom, Noir, and Cairo for ZK circuits. The "thinking in constraints" mental model. zkVMs like RISC0, SP1, Jolt, and Nexus that let you write Rust instead.
45 min · expert · part of ZK Cryptography & Proof Systems
What you'll learn
- Thinking in Constraints
- Circom: R1CS and Templates
- Noir: A Rust-Like Circuit Language
- Cairo: A STARK-Native Language
- zkVMs: Writing Normal Code That Proves Itself
- Choosing a Tool for Your Use Case
Key terms
- Constraint system
- A set of algebraic equations (typically over a finite field) that defines what a circuit computes; the prover supplies values satisfying all constraints, and the verifier checks them.
- R1CS (Rank-1 Constraint System)
- A constraint representation where each constraint has the form A * B = C with A, B, C linear combinations of signals; the standard target of Circom and many SNARK provers.
- Circom
- An R1CS-targeting circuit DSL developed by iden3, used by Tornado Cash, Semaphore, Worldcoin, and many shielded-asset designs; mature but with ergonomic quirks.
- Noir
- A Rust-inspired ZK circuit language by Aztec Labs, compiling to ACIR and supporting multiple SNARK backends (Barretenberg, UltraHonk); focused on ergonomic privacy and recursive proofs.
- Cairo
- StarkWare's language for STARK-provable programs; Cairo 1 (2023) is a Rust-inspired rewrite of the original Cairo Zero, used for StarkNet smart contracts and other STARK applications.
- zkVM
- A general-purpose virtual machine whose execution can be proved with a ZK proof, letting developers write normal code (typically Rust) instead of writing circuits directly. Examples: RISC0, SP1, Jolt, Nexus, Polygon Miden.
- Poseidon hash
- A ZK-friendly hash function designed for efficient evaluation inside SNARK and STARK constraint systems; typically a few hundred constraints versus tens of thousands for SHA-256.
- Non-deterministic hint
- A value computed outside the circuit and supplied to the prover, then verified inside the circuit with cheap constraints; used heavily to avoid expressing expensive operations (square roots, divisions) as constraints.
- ACIR (Abstract Circuit Intermediate Representation)
- Noir's backend-agnostic intermediate representation, allowing the same Noir program to compile to multiple proving systems.
- Bonsai / SP1 prover network
- Proof-as-a-service infrastructure that lets developers outsource expensive proof generation to specialized provers, paying per proof; Bonsai is RISC0's service and Succinct operates a similar network for SP1.
Read the full lesson in the CryptoBipto app.
Open lessonEducational only — not financial advice.