← → Print all
02 — Framework · Framework

Halo2

Rust eDSL (PLONKish)

In one paragraph

Halo2: Rust eDSL (PLONKish). As Halo2 (upstream) — Kind: Rust eDSL. Arithmetisation / backend: PLONKish + IPA. Setup: None. Maintained by: Electric Coin Company (Zcash). Licence: MIT / Apache-2.0. Status: Production in its home ecosystem. As Halo2 (KZG fork) — Kind: Rust eDSL. Arithmetisation / backend: PLONKish + KZG. Setup: Yes (universal). Maintained by: Ethereum Foundation PSE. Licence: MIT / Apache-2.0. Status: Maintenance mode. Choose it when: Teams needing trusted-setup-free proving with a non-EVM or off-chain verifier, who have cryptography-capable engineers.

By MarketComp Updated v1.3 About the authors Changelog
Kind
Rust eDSL
Arithmetisation / backend
PLONKish + IPA
Setup
None
Maintained by
Electric Coin Company (Zcash)
Licence
MIT / Apache-2.0
Status
Production in its home ecosystem
Selection matrix · as Halo2 (upstream) · see the row in context
Kind
Rust eDSL
Arithmetisation / backend
PLONKish + KZG
Setup
Yes (universal)
Maintained by
Ethereum Foundation PSE
Licence
MIT / Apache-2.0
Status
Maintenance mode
Selection matrix · as Halo2 (KZG fork) · see the row in context

What it is

PLONKish arithmetisation with custom gates, lookup arguments and explicit region and column layout under developer control. The upstream implementation uses an inner-product argument and needs no trusted setup; a widely used fork swaps in KZG for constant-size, cheaply verifiable proofs.

Strengths and tradeoffs

Strengths
  • The upstream IPA instantiation needs no trusted setup, and is deployed in a long-running production shielded protocol
  • Custom gates and lookups allow far more efficient hashing and range-check circuits than R1CS
  • Permissive dual licence
Tradeoffs
  • The steepest learning curve of any mainstream option — correct circuits require manual reasoning about regions, rotations and selectors
  • Very easy to underconstrain, in library gadgets as well as user circuits: a query-collision bug affected edge-case circuits across multiple forks, and in 2026 a counterfeiting bug in the ECC gadget of the upstream library prompted an emergency response in its flagship deployment — verify the current status of any Halo2 deployment you are citing as evidence of maturity
  • IPA proofs are logarithmic in size but the verifier's work is linear in circuit size, so direct L1 verification is impractical without a wrapper
  • The ecosystem is fragmented across forks with divergent maintenance postures — choose deliberately

Choose it whenTeams needing trusted-setup-free proving with a non-EVM or off-chain verifier, who have cryptography-capable engineers.

Direct answers that mention it
Maintained implementations

Electric Coin Company (upstream); Ethereum Foundation PSE (KZG fork, maintenance mode); Axiom (halo2-lib)

Maturity: Long production history; verify current status · License: MIT / Apache-2.0 · github.com ↗

How to decide
Other frameworks in §02
CircomNoirgnarkPlonky3Cairo and the Stwo proverSP1RISC Zero (R0VM)OpenVMZKsync AirbenderJoltMiden VMHosted proving servicesDecentralised proof markets

Sources cited on this page · 3

  1. Halo2 — upstream implementation (IPA, no trusted setup)project
  2. Halo2 — KZG forkproject
  3. halo2-lib — gadget library for Halo2 circuitsproject

All 45 sources for §02 are listed on the section page →

Cite this page 
MarketComp (2026). Halo2. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/frameworks/halo2/
@misc{zkfieldmanual-halo2,
  title        = {Halo2 — The ZK Field Manual},
  author       = {MarketComp},
  year         = {2026},
  version      = {1.3},
  howpublished = {\url{https://zkpick.com/frameworks/halo2/}},
  note         = {Accessed: YYYY-MM-DD}
}