Lecture 5: The Plonk SNARK

What this lecture covers

This lecture answers how a practical, widely used SNARK for general circuits is actually built. It follows lecture four's interactive-proof approach with a different strategy: start from a concrete polynomial commitment scheme, add a toolbox of proof gadgets for properties of committed polynomials, and assemble them into Plonk. The lecture builds up in stages, from the KZG commitment scheme through zero tests, product checks, and permutation checks, ending with the full Plonk protocol.

After watching, you should be able to explain how KZG commitments and evaluation proofs work, describe the zero test, product check, and permutation check gadgets, and follow how Plonk arithmetizes a circuit's computation trace and proves it correct using those gadgets.

Key ideas

• Polynomial commitment scheme: lets a prover commit to a bounded-degree polynomial and later prove evaluations at chosen points, with proof size and verification time that stay short (ideally constant or logarithmic) regardless of the polynomial's degree.
• KZG commitment scheme: uses a trusted setup that generates group elements G, tau*G, tau^2*G, ... and then deletes the secret tau; a commitment is a single group element, and evaluation proofs are also a single group element, verified using pairings.
• Quotient polynomial trick: f(u) = v if and only if x - u divides f(x) - v; the prover commits to that quotient polynomial as its evaluation proof.
• Batching: KZG lets many evaluation proofs, across many polynomials and points, be combined into a single group element, and the FK algorithm generates many evaluation proofs faster than doing them one at a time.
• Zero test, sum check, and product check: proof gadgets that let a prover convince a verifier that a committed polynomial vanishes on a set, or that its values sum or multiply to a target, using the vanishing polynomial of that set and a quotient argument.
• Permutation check: proves that the evaluations of one committed polynomial over a set are a permutation of another's, by constructing auxiliary polynomials with those evaluations as roots and reducing equality of the auxiliaries to a product check (a trick called Lipton's trick).
• Prescribed permutation check: strengthens the permutation check to verify a specific wiring permutation, using pairs of points rather than single points to keep the prover's work linear rather than quadratic.
• Plonk arithmetization: encodes a circuit's entire computation trace (inputs, gate inputs, gate outputs) as a single polynomial T, then proves it is correct using a zero test for public inputs, a zero test for gate correctness, and a permutation check for wiring.

Walkthrough

KZG polynomial commitments (0:00)

The lecture reviews what a polynomial commitment scheme needs to provide, then introduces KZG (Kate, Zaverucha, Goldberg, 2010). A trusted setup samples a secret field element tau and publishes group elements G, tau*G, ..., tau^d*G, then deletes tau. A commitment to polynomial f is f(tau)*G, computed from the public parameters without ever learning tau. The commitment is binding but not hiding.

Evaluation proofs and their properties (5:55)

Using the fact that f(u) = v if and only if x - u divides f(x) - v, the prover commits to the quotient polynomial as a constant-size evaluation proof, verified with a pairing check at the point tau without the verifier ever knowing tau. The lecture then covers KZG's useful properties: batching many evaluation proofs into one group element, linear-time commitment using point-value (Lagrange) representation instead of coefficient form, and the FK algorithm for generating many proofs faster than the naive quadratic approach.

Trade-offs and Merkle tree comparison (17:44)

The lecture notes KZG's downsides — a trusted setup and global parameters linear in the degree — and contrasts it with Dory (no trusted setup, but larger, slower proofs). It then shows that polynomial commitments give a drop-in, more efficient replacement for Merkle trees: batched openings need only a single group element instead of multiple logarithmic-size Merkle proofs.

Polynomial equality testing, zero tests, sum and product checks (24:44)

The lecture builds a toolbox of proof gadgets, presented as interactive Oracle proofs later compiled with Fiat-Shamir. It starts with equality testing (evaluate two committed polynomials at a random point), then the zero test (using the vanishing polynomial of a set to prove a polynomial is zero there), and the product check (using an auxiliary polynomial of prefix products, reduced to a zero test). Each gadget is shown to also work for rational functions.

Permutation checks and Plonk's wiring gadget (49:35)

Two more gadgets are introduced: a permutation check (are two polynomials' evaluations over a set permutations of each other, using Lipton's trick from 1989) and a prescribed permutation check (do they match a specific permutation W). The latter avoids a quadratic blow-up in prover time by comparing pairs of points with bivariate auxiliary polynomials rather than composing polynomials directly.

Assembling Plonk (1:02:41)

With the gadgets in place, the lecture constructs the Plonk IOP for circuit satisfiability. A worked example circuit shows how the computation trace (public inputs, each gate's two inputs and one output) is encoded as a single polynomial T in point-value form. Proving the trace is valid requires four checks: T encodes the correct public inputs (zero test), every gate performed the right operation (zero test using a selector polynomial), the wiring between gates is correct (prescribed permutation check), and the final gate's output is zero. The lecture states Plonk's soundness bound and notes that Plonk can be paired with different commitment schemes — KZG (used by Aztec), bulletproofs (Halo 2), or FRI (Plonky2) — and extended with custom gates and lookups to speed up the prover.

Before you watch

• Watch lecture four first for the SNARK vocabulary (succinctness, knowledge soundness, Fiat-Shamir) and the Schwartz-Zippel lemma, both used throughout this lecture.
• Review functional and vector commitments (including Merkle trees) from lecture two, since KZG is presented as an alternative to them.
• Basic familiarity with finite fields, cyclic groups, and polynomial interpolation is assumed.

Check your understanding

1. How does the quotient-polynomial trick let a KZG prover prove f(u) = v with a single group element, and why can't the verifier check this without pairings?
2. Why does KZG's batching property matter even though the verifier could just compare two commitments directly to test equality of two polynomials?
3. What does a zero test prove about a polynomial, and how does the choice of Omega as a multiplicative subgroup make the vanishing polynomial fast to evaluate?
4. Why does checking a prescribed permutation directly (composing G with W) blow up the prover's degree, and how does the pairs-based trick avoid that?
5. What are the four checks that make up the Plonk IOP for a circuit, and which proof gadget does each one use?