01 — Proof system · Proof system

Groth16

Pairing-based SNARK

In one paragraph

Groth16: Pairing-based SNARK. Setup: Circuit-specific. Proof size: 3 group elements: 128 B compressed, 256 B as EVM calldata. On-chain verification: Cheapest deployed option. PQ: No. Recursion: Via curve cycles; awkward. Maturity: Production since 2016. Prover cost profile: 256-bit-field MSMs and FFTs; roughly linear in constraints with a high constant. Mature GPU provers exist. Peak prover memory: Proving key resident in RAM, growing with circuit size — the usual browser and mobile limit. Off-chain verifier: Milliseconds: three pairings. Implementations and maintainers: snarkjs and rapidsnark (iden3), gnark (Consensys), arkworks, bellman (Zcash lineage), ICICLE GPU backends (Ingonyama). Where it is measured: Delendum zk-benchmarking; wrapper cost inside every zkVM benchmark on ethproofs.org. Choose it when: A stable circuit verified on-chain at high frequency where gas is the binding constraint. Also the standard final compression layer for STARK-based systems.

By MarketComp Updated 2026-09-12 v1.3 About the authors Changelog

Setup

Circuit-specific

Proof size

3 group elements: 128 B compressed, 256 B as EVM calldata

On-chain verification

Cheapest deployed option

Recursion

Via curve cycles; awkward

Maturity

Production since 2016

Selection matrix · as Groth16 · see the row in context

Prover cost profile

256-bit-field MSMs and FFTs; roughly linear in constraints with a high constant. Mature GPU provers exist.

Peak prover memory

Proving key resident in RAM, growing with circuit size — the usual browser and mobile limit

Off-chain verifier

Milliseconds: three pairings

Implementations and maintainers

snarkjs and rapidsnark (iden3), gnark (Consensys), arkworks, bellman (Zcash lineage), ICICLE GPU backends (Ingonyama)

Where it is measured

Delendum zk-benchmarking; wrapper cost inside every zkVM benchmark on ethproofs.org

Prover profile · as Groth16 · see the row in context

What it is

The 2016 pairing-based preprocessing SNARK over R1CS: the proof is three group elements verified with a single pairing product equation. Requires a per-circuit setup on top of a reusable universal phase one.

Strengths and tradeoffs

Strengths

The smallest proofs and cheapest verifier of any widely deployed system
The cheapest realistic on-chain verification on Ethereum
Extremely well understood, with many independent implementations and a decade of scrutiny

Tradeoffs

Circuit-specific trusted setup: any circuit change means a new ceremony, and toxic waste breaks soundness for that circuit permanently
No universality — setup cannot be amortised across circuits
Not post-quantum
Proofs are re-randomisable, which breaks any application treating a proof as a unique object

Choose it whenA stable circuit verified on-chain at high frequency where gas is the binding constraint. Also the standard final compression layer for STARK-based systems.

Sources cited on this page · 1

Groth16 — On the size of pairing-based non-interactive argumentspaper

All 40 sources for §01 are listed on the section page →

Cite this page

MarketComp (2026). Groth16. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/proof-systems/groth16/

@misc{zkfieldmanual-groth16,
  title        = {Groth16 — The ZK Field Manual},
  author       = {MarketComp},
  year         = {2026},
  version      = {1.3},
  howpublished = {\url{https://zkpick.com/proof-systems/groth16/}},
  note         = {Accessed: YYYY-MM-DD}
}

Groth16

What it is

Strengths and tradeoffs

Related pages

Sources cited on this page · 1