KZG Commitment

A KZG commitment (Kate-Zaverucha-Goldberg commitment) is a cryptographic scheme that allows a prover to commit to a polynomial and later generate a succinct proof that the polynomial evaluates to a specific value at a given point. This proof, also known as a KZG proof or witness, can be verified by anyone who holds the commitment, without requiring the prover to reveal the entire polynomial. The scheme relies on pairing-based cryptography and trusted setup ceremonies to generate public parameters, which are critical for its security.

The primary utility of a KZG commitment lies in its constant size and efficient verification. Unlike a Merkle proof, whose size grows logarithmically with the data, a KZG proof is a single group element (e.g., a 48-byte elliptic curve point). This makes it ideal for blockchain scaling, where it can prove that a specific piece of data, such as a blob of transaction data in Ethereum's EIP-4844 (proto-danksharding), is part of a larger committed dataset. Verifiers only need the commitment and the proof, enabling light clients to efficiently confirm data availability.

In practice, a KZG commitment scheme involves a trusted setup to generate a Structured Reference String (SRS). This ceremony produces public parameters that must be used to create and verify commitments; if the secret parameters used in the setup are compromised, an attacker could create fake proofs. Despite this requirement, KZG's properties—binding, hiding, and the ability to perform polynomial evaluations and linear combinations of commitments—make it a cornerstone for verifiable secret sharing, zero-knowledge proof systems, and data availability sampling protocols in layer-2 rollups.

A KZG commitment (named for its creators Kate, Zaverucha, and Goldberg) is a cryptographic scheme based on pairing-friendly elliptic curves. To commit to a polynomial f(x), a trusted setup ceremony generates a structured reference string (SRS) containing powers of a secret value τ (tau) hidden within elliptic curve points: [τ⁰]G, [τ¹]G, ..., [τᵈ]G. The commitment C is computed as C = f(τ)⋅G, a single elliptic curve point that acts as a succinct fingerprint for the entire polynomial. This commitment is binding (the committer cannot later change the polynomial) and hiding (the commitment reveals nothing about the polynomial's coefficients).

The power of KZG lies in its ability to generate evaluation proofs. If a verifier wants to check that f(u) = v for a specific point u, the prover computes a witness polynomial q(x) = (f(x) - v) / (x - u). The corresponding proof π is q(τ)⋅G, another single curve point. The verifier, who knows C, u, v, and π, can check the proof using a bilinear pairing e on the elliptic curve group. The verification equation e(C - [v]G, G) = e(π, [τ]G - [u]G) holds if and only if the evaluation is correct, requiring only constant-time work regardless of the polynomial's degree.

KZG commitments enable powerful cryptographic constructions. In Ethereum's EIP-4844 (proto-danksharding), they commit to large data blobs, allowing validators to verify data availability with tiny proofs. They are also fundamental to polynomial commitment schemes used in zero-knowledge rollups and succinct non-interactive arguments of knowledge (SNARKs). A critical requirement is the trusted setup for the SRS; if the secret τ is leaked, an attacker could generate fake commitments. This risk is mitigated through ceremonies like the Perpetual Powers of Tau, where multiple participants collaborate to generate the SRS, ensuring security if at least one participant was honest and destroyed their secret.

A KZG commitment is a constant-sized cryptographic fingerprint, or cryptographic commitment, that binds to a specific polynomial. In the context of EIP-4844 (Proto-Danksharding), this polynomial represents the data within a blob. The commitment is generated using a trusted setup ceremony, resulting in a structured reference string (SRS). Its key property is that it allows for efficient polynomial commitment schemes, enabling anyone to verify that a specific piece of data is part of the original blob by checking a small proof against the commitment, without needing the entire dataset.

The primary function of the KZG commitment within the Ethereum consensus layer is to guarantee data availability. When a validator posts a blob-carrying transaction, they provide the KZG commitment. Other network participants can then be cryptographically assured that the full blob data is published and can be reconstructed, which is essential for data availability sampling (DAS). This mechanism is far more efficient than requiring every node to download the entire multi-megabyte blob, enabling scalable layer 2 rollup data posting while keeping mainchain load manageable.

The technical workflow involves the blob provider (e.g., a rollup sequencer) encoding their data into a polynomial, creating the KZG commitment, and submitting it in a transaction. Ethereum consensus clients then verify the commitment's validity. For a node performing DAS, it can request random chunks of the blob and use the KZG commitment to cryptographically verify that each chunk is correct. This creates a high-probability guarantee that the entire blob is available, securing the network against data withholding attacks that could compromise rollup security.