{
  "type": "option",
  "name": "Halo2 with IPA, and Halo2 with KZG",
  "slug": "halo2",
  "section": {
    "id": "proof-systems",
    "number": "01",
    "title": "Choosing a proof system",
    "url": "https://zkpick.com/proof-systems/"
  },
  "url": "https://zkpick.com/proof-systems/halo2/",
  "markdown": "https://zkpick.com/md/proof-systems/halo2.md",
  "category": "PLONKish SNARK — two distinct trust models",
  "summary": "Halo2 with IPA, and Halo2 with KZG: PLONKish SNARK — two distinct trust models. As Halo2 + IPA — Setup: None. Proof size: Logarithmic. On-chain verification: Impractical — verifier linear in circuit size. PQ: No. Recursion: Native, via accumulation on a curve cycle. Maturity: Years in production; gadget-layer bug in 2026. As Halo2 + KZG — Setup: Universal, updatable. Proof size: Constant. On-chain verification: Practical. PQ: No. Recursion: Supported. Maturity: Production; central maintenance declining. As Halo2 + IPA — Prover cost profile: MSM-dominated over the Pasta curve cycle; no pairing-curve FFT bottleneck. Peak prover memory: Proportional to circuit size; moderate. Off-chain verifier: Linear in circuit size — tens to hundreds of milliseconds for large circuits. Implementations and maintainers: zcash/halo2 (Electric Coin Company). Where it is measured: Zcash Orchard figures; no neutral suite. As Halo2 + KZG — Prover cost profile: 256-bit-field FFTs over BN254; the largest gadget ecosystem of any PLONKish frontend. Peak prover memory: SRS resident; large circuits need tens of gigabytes. Off-chain verifier: Milliseconds. Implementations and maintainers: privacy-ethereum/halo2 (Ethereum Foundation PSE, maintenance mode), halo2-lib (Axiom), Scroll's fork. Where it is measured: Scroll and Axiom published figures; no neutral suite. Choose it when: IPA: systems verified on a node rather than in a gas-metered contract, where trusted setup is unacceptable. KZG: EVM-verified application circuits and coprocessors needing expressive custom gates.",
  "description": "The same PLONKish frontend with two very different backends. The original uses an inner-product argument over a curve cycle and needs no trusted setup, with recursion via accumulation. The widely used Ethereum-oriented variant replaces IPA with KZG, giving constant-size proofs and a practical Solidity verifier — and a universal trusted setup. These are routinely conflated.",
  "notes": [],
  "sections": [],
  "strengths": [
    "The IPA variant needs no trusted setup and has years of deployment in a value-bearing system",
    "Recursion without pairing-friendly curves, via accumulation on a two-cycle",
    "The KZG variant gives constant-size proofs and EVM-practical verification",
    "Rich, expressive frontend with mature circuit libraries for elliptic-curve and hashing work"
  ],
  "tradeoffs": [
    "IPA verification is linear in circuit size — that variant is not an EVM settlement candidate",
    "The KZG variant reintroduces a universal trusted setup, unlike the original — a frequent source of confusion",
    "Neither is post-quantum",
    "The ecosystem has fragmented into forks that are not drop-in compatible and have uneven maintenance",
    "Maturity of the construction does not transfer to its gadget libraries: a counterfeiting bug in the upstream ECC gadget prompted an emergency response in 2026 — check the current status of any deployment cited as evidence"
  ],
  "bestFit": "IPA: systems verified on a node rather than in a gas-metered contract, where trusted setup is unacceptable. KZG: EVM-verified application circuits and coprocessors needing expressive custom gates.",
  "maintainers": "Halo by Bowe, Grigg and Hopwood (Electric Coin Company, 2019); upstream halo2 maintained by Electric Coin Company. KZG fork by Ethereum Foundation PSE (maintenance mode); halo2-lib by Axiom; further forks at Scroll and others",
  "maturity": "Long production history; forks vary",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://eprint.iacr.org/2019/1021",
  "facts": [
    {
      "table": "Proof system selection matrix",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-halo2-ipa",
      "name": "Halo2 + IPA",
      "setup": "None",
      "size": "Logarithmic",
      "verify": "Impractical — verifier linear in circuit size",
      "pq": "No",
      "recursion": "Native, via accumulation on a curve cycle",
      "maturity": "Years in production; gadget-layer bug in 2026"
    },
    {
      "table": "Proof system selection matrix",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-halo2-kzg",
      "name": "Halo2 + KZG",
      "setup": "Universal, updatable",
      "size": "Constant",
      "verify": "Practical",
      "pq": "No",
      "recursion": "Supported",
      "maturity": "Production; central maintenance declining"
    },
    {
      "table": "Prover profile, implementations and benchmarks",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-2-halo2-ipa",
      "name": "Halo2 + IPA",
      "prover": "MSM-dominated over the Pasta curve cycle; no pairing-curve FFT bottleneck",
      "memory": "Proportional to circuit size; moderate",
      "offchain": "Linear in circuit size — tens to hundreds of milliseconds for large circuits",
      "impls": "zcash/halo2 (Electric Coin Company)",
      "bench": "Zcash Orchard figures; no neutral suite"
    },
    {
      "table": "Prover profile, implementations and benchmarks",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-2-halo2-kzg",
      "name": "Halo2 + KZG",
      "prover": "256-bit-field FFTs over BN254; the largest gadget ecosystem of any PLONKish frontend",
      "memory": "SRS resident; large circuits need tens of gigabytes",
      "offchain": "Milliseconds",
      "impls": "privacy-ethereum/halo2 (Ethereum Foundation PSE, maintenance mode), halo2-lib (Axiom), Scroll's fork",
      "bench": "Scroll and Axiom published figures; no neutral suite"
    }
  ],
  "relatedFailureModes": [],
  "sources": [
    {
      "title": "Halo — recursive proof composition without a trusted setup",
      "url": "https://eprint.iacr.org/2019/1021",
      "kind": "paper"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/proof-systems/halo2/",
  "authors": [
    "MarketComp"
  ]
}