1

As a smart contract developer, I am unable to understand why do we use circom circuits for zero knowledge proofs? All the examples like A*B = C can be done in javascript and solidity. We can also create digital signature, and perform hashing in these language. Why do we use circom circuits?

Improve this question

1 Answer 1

Reset to default
3

Good question!

I think the main reason is that the underlying framework of ZK systems is somewhat different. For example, integers in ZK are field elements instead of regular integers. They behave similarly for many regular operations, but differently for others. It's difficult to map between these integer types automatically.

Another reason is performance. In ZK systems, certain operations are a lot more expensive than in regular environments. For example bit shifts are very expensive in ZK systems, but super easy in regular systems. This leads to the use of different hashing algorithms as well.

Basically all the ZK languages are built to utilize the more ZK native constructs. These ZK languages guide you to using the language in a performant way. Therefore writing in a ZK language is also somewhat of a different kind of experience, compared to traditional languages.

Field element differences

As mentioned above, integers behave differently in ZK systems, because all calculations are performed based on field elements instead of regular integers.

Depending on the used proving system, the field element is usually about 252 bits. The default integer (uint256) in Solidity is 256 bits. One of the challenges is conversion between these two systems: if you bridge a token with 256 bit values into a L2 with 252 bit integers (field values), should the bridge simply drop the last bits or do something else?

Another challenge is with actual calculations. 1+2 has the same result with field elements as with normal integers, but for example 3/2 gives totally different results - the actual result is far from trivial with field elements and is related to how elliptic curve point operations are calculated.

Improve this answer
2
  • Ok, like everything I read about ZK to understand it, this made me more confused than clear. An example would be cool when ZK field elements behave different or same as integers. The performance part is a discouragement of using ZK system, which I already am.
    – EresDev
    Commented May 10, 2023 at 18:45
  • Added an example. Yes, ZK systems are difficult. And yes, their performance is very different compared to more 'traditional' systems. But they are not meant for performant operations and their field element trickiness is just an unfortunate side effect. ZK systems are meant for operations where 1) party A can do heavy operations and party B can cheaply verify those operations 2) hide information with privacy ZK. Feel free to poke me if you wanna chat about it more - my profile has contact info.
    – Lauri Peltonen
    Commented May 10, 2023 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.