The cave analogy
Imagine a ring-shaped cave with a magic door inside that only opens with a secret password. Alice claims she knows the password. To prove it without saying it, she walks into the cave and takes one of the two paths. Bob, standing at the entrance, shouts which side he wants her to come back from. If she really knows the password, she can always comply — by passing through the door if needed. If she doesn't, she'll get caught half the time. Repeat 20 times and the chance she fooled Bob is roughly one in a million.
That's the core property: completeness (a true statement always convinces), soundness (a false statement almost never does), and zero-knowledge (Bob learns nothing except that Alice knows the password).
From cave to cryptography
Modern zero-knowledge proofs replace the back-and-forth with a single message. The prover constructs a mathematical certificate that any verifier can check in milliseconds. The certificate proves a statement of the form: "I know an input x such that f(x) = y" without revealing x.
In a privacy coin, x might be the sender's spending key and the actual amounts; y is the public commitment recorded on-chain. The proof shows the transaction balances and the sender is authorised, but reveals nothing else.
zk-SNARKs
SNARK = Succinct, Non-interactive Argument of Knowledge. "Succinct" means the proof is tiny (a few hundred bytes) and fast to verify. "Non-interactive" means the prover sends one message, no back-and-forth.
- Proof size: ~200 bytes
- Verification: milliseconds
- Proving time: seconds to minutes, heavy
- Trusted setup: required in older variants (Groth16); newer ones (PLONK, Halo2) are universal or transparent
- Assumptions: elliptic-curve pairings — not post-quantum
Used by Zcash (shielded pool), Aztec, zkSync, Polygon zkEVM.
zk-STARKs
STARK = Scalable Transparent ARgument of Knowledge. "Transparent" means no trusted setup — only public randomness and hash functions.
- Proof size: tens to hundreds of kilobytes
- Verification: still fast, milliseconds
- Proving time: faster than SNARKs at scale
- Trusted setup: none
- Assumptions: collision-resistant hash functions — believed post-quantum secure
Used by Starknet, Polygon Miden, and a growing list of rollups where post-quantum security matters more than proof size.
Bulletproofs and range proofs
A close cousin worth mentioning. Bulletproofs are short, trustless ZK range proofs — they prove a hidden number lies in a valid range (e.g. greater than zero, less than the total supply) without revealing the number. They're the workhorse behind confidential transactions in Monero and XELIS.
Where ZK proofs show up in XELIS
XELIS combines two privacy primitives. Balances are stored as homomorphic ciphertexts, which lets the chain add and subtract encrypted amounts. ZK proofs (range proofs and ownership proofs) attached to each transaction guarantee:
- The sender actually owns the inputs
- No new coins are created from nothing
- The hidden amount is non-negative and within bounds
Verifiers check the proof and update encrypted balances — without ever seeing the numbers. See what is XELIS for the full architecture.
Honest trade-offs
- Proving is expensive. Generating a proof takes orders of magnitude more compute than verifying one. That cost lands on the user's device.
- Cryptography is young. SNARK constructions evolve every two years. Implementations have had real bugs (Zcash counterfeiting bug, 2018).
- Trusted setup ceremonies for older SNARKs require participants to honestly delete "toxic waste". Multi-party ceremonies (like Zcash's Powers of Tau) make this safe in practice if at least one participant is honest.
- Auditability is harder. Privacy plus ZK means regulators can't see flows. View keys (XELIS, Zcash) restore voluntary disclosure.
Frequently asked questions
What is a zero-knowledge proof in one sentence?
A way to prove you know a secret — or that a computation was done correctly — without revealing the secret or the inputs.
Are zk-proofs only for privacy?
No. They started in privacy crypto, but rollups like zkSync and Starknet use them for scalability — compressing thousands of transactions into one verifiable proof.
Why does XELIS use ZK proofs alongside homomorphic encryption?
Homomorphic encryption keeps balances hidden; ZK proofs prove each transaction is valid (no negative balance, no inflation) without revealing the numbers.
Are zk-SNARKs quantum-safe?
Most current zk-SNARK constructions rely on elliptic-curve assumptions that quantum computers could break. zk-STARKs use hashes and are believed post-quantum secure.