Archivecryptography
zk-SNARKs vs zk-STARKs
Trusted setup and small proofs versus transparency and larger proofs. The choice is about assumptions, not speed alone.
- Published
- Reading time
- 1 min read
Both prove knowledge of a witness without revealing it. They differ in cryptographic assumptions, setup ceremony, and proof size.
| SNARK | STARK | |
|---|---|---|
| Setup | trusted (often) | transparent |
| Assumptions | pairing groups, knowledge-of-exponent | hash functions |
| Proof size | hundreds of bytes | tens of kilobytes |
| Verify cost | very low | low |
| Post-quantum | no (pairing-based) | plausibly yes |
When the trusted setup matters
A compromised setup can let someone forge proofs. Ceremonies with many participants reduce the risk if at least one is honest, but the assumption remains. STARKs remove it at the cost of bandwidth and verification work.
The practical trend
SNARKs dominate on-chain verification where proof size is expensive. STARKs and newer transparent SNARKs are gaining where setup risk is unacceptable or recursion helps.
Takeaway: pick by trust model first, then by proof size and verifier cost. "SNARK" is a category, not a single scheme.