Appendix B — Glossary
Terms used throughout
16 definitions. Each has a stable anchor, so a definition can be linked directly.
16 terms
- Arithmetisation
- The translation of a computation into a system of polynomial constraints (R1CS, PLONKish, AIR) that a proof system can operate on.
- Witness
- The private input plus all intermediate values that satisfy a circuit's constraints. Soundness means no witness exists for a false statement.
- Underconstrained circuit
- A circuit admitting witnesses that do not correspond to a correct execution. The dominant real-world ZK bug class: the cryptography is sound, the statement being proved is simply the wrong one.
- SRS / CRS
- Structured (Common) Reference String — public parameters some proof systems require. Produced by a trusted setup; compromise of the setup randomness breaks soundness.
- Universal setup
- An SRS reusable across every circuit up to a size bound, so a new circuit does not require a new ceremony. Contrast with circuit-specific setup.
- Updatable setup
- An SRS any party may re-randomise after the fact; it stays secure as long as at least one contributor in its entire history was honest.
- Toxic waste
- The secret randomness used to generate an SRS. If any single participant's contribution is destroyed, the setup is secure; if all are retained and combined, forged proofs become possible.
- Powers of tau
- The circuit-independent first phase of a setup ceremony, producing a universal SRS of committed powers of a secret value. Public transcripts exist and are widely reused.
- Polynomial commitment
- A scheme to commit to a polynomial and later prove evaluations of it. The choice (KZG, FRI, IPA, hash-based) drives proof size, verifier cost, setup need and post-quantum posture more than the surrounding protocol does.
- Fiat–Shamir
- The transform making an interactive protocol non-interactive by deriving the verifier's challenges from a hash of the transcript. Omitting values from that hash is the 'Frozen Heart' vulnerability class.
- Recursion / aggregation
- Verifying one proof inside another, to compress many proofs into one or to prove unbounded computation in bounded memory.
- Folding scheme
- A technique that combines two instances of a relation into one without producing a full proof at each step, amortising the cost of proving repeated computation.
- Lookup argument
- A protocol proving that values appear in a precomputed table, used to express operations that are expensive as raw arithmetic constraints.
- zkVM
- A proof system for the execution trace of a general-purpose virtual machine, letting teams prove ordinary programs instead of hand-written circuits, at a cost in prover work.
- Nullifier
- A deterministic, unlinkable value published to prevent double-spending or replay of a private action. Missing or malleable nullifiers are a recurring protocol-level bug.
- Soundness error
- The probability a prover can convince a verifier of a false statement. Quoted in bits; conjectured and provable bounds can differ substantially for FRI-based systems.