KZG Proof
Pronunciation: KAY-ZEE-JEE PROOF
Definition
A KZG proof is a compact witness showing that a committed polynomial has a particular value at a specified evaluation point. The verifier checks a pairing equation using the original commitment, claimed evaluation, point, proof, and structured reference string. A successful check establishes consistency with the committed polynomial under KZG assumptions, while revealing only the requested evaluation rather than the full polynomial.
Overview
Meaning and scope
A KZG proof is a compact witness showing that a committed polynomial has a particular value at a specified evaluation point. The verifier checks a pairing equation using the original commitment, claimed evaluation, point, proof, and structured reference string. A successful check establishes consistency with the committed polynomial under KZG assumptions, while revealing only the requested evaluation rather than the full polynomial.
Mechanism and operation
A KZG proof opens a polynomial commitment at one point. The prover derives a quotient polynomial from the committed polynomial, evaluation point, and claimed value, then commits to that quotient as the proof. Implementations must validate field elements, subgroup membership, point encoding, and domain rules before the pairing check. Batch verification can improve performance but must use safe randomness or specified aggregation. Input validation, constant-time behavior where relevant, secure randomness, key handling, and rejection of malformed or non-canonical values belong to the implementation boundary. Monitoring cannot repair invalid cryptography, so upgrade and incident procedures must be planned before deployment.
Practical payment example
A rollup publishes blob commitments and associated proofs. A verifier checks the commitment proof for the submitted data before using the blob as evidence, while recognizing that availability and execution correctness remain distinct.
Operational checks
Security review for KZG Proof should account for parameter updates, batch verification, side channels, implementation bugs, and the consequences of a broken assumption. KZG Proof should be described by the precise security property it provides, the mathematical assumptions behind it, and the protocol step that consumes its output.
Distinctions and limits
A valid proof does not establish data availability, business correctness, or that the commitment came from an authorized source. Production deployments should rely on reviewed libraries and published test vectors rather than custom cryptography.
Related reading
Related definitions: data availability.
Example
A rollup publishes blob commitments and associated proofs. A verifier checks the commitment proof for the submitted data before using the blob as evidence, while recognizing that availability and execution correctness remain distinct.
Comparison
A successful check establishes consistency with the committed polynomial under KZG assumptions, while revealing only the requested evaluation rather than the full polynomial. A valid proof does not establish data availability, business correctness, or that the commitment came from an authorized source.
Key Takeaway
A KZG proof verifies one evaluation against a polynomial commitment, but does not independently prove data availability, authorization, or semantic correctness.
Sources
- NIST Cryptographic Standards and Guidelines — NIST (2026-07-30)
- Ethereum Documentation: Scaling — Ethereum Foundation (2026-07-30)
- Ethereum Documentation: Zero-Knowledge Proofs — Ethereum Foundation (2026-07-30)