[KZG10] Constant-size commitments to polynomials and their applications

Authors: Aniket Kate, Gregory M. Zaverucha, Ian Goldberg | Venue: Asiacrypt 2010 | Source

Introduced the KZG polynomial commitment scheme, which allows a prover to commit to a polynomial $f\in {\mathbb{F}}_p[X]$ with a single group element and later prove evaluations $f(z)=y$ with a single group element proof (O(1) size). Security relies on the $q$-Strong Diffie-Hellman assumption in a bilinear group and requires a structured reference string (trusted setup) of the form $(g,g^{\tau },g^{{\tau }^2},\dots ,g^{{\tau }^d})$ for secret $\tau$. KZG is the polynomial commitment underlying most practical SNARKs, including Plonk and Marlin, and is used in Ethereum’s KZG ceremony (EIP-4844).

BibTeX

Copy

@Inproceedings{AC:KatZavGol10,
  author = {Aniket Kate and Gregory M. Zaverucha and Ian Goldberg},
  title = {Constant-Size Commitments to Polynomials and Their Applications},
  pages = {177--194},
  editor = {Masayuki Abe},
  booktitle = {Advances in Cryptology -- {ASIACRYPT}~2010},
  volume = {6477},
  series = {Lecture Notes in Computer Science},
  address = {Singapore},
  month = {dec~5--9},
  publisher = {Springer Berlin Heidelberg, Germany},
  year = {2010},
  doi = {10.1007/978-3-642-17373-8_11},
}