Halo2 with IPA, and Halo2 with KZG
PLONKish SNARK — two distinct trust models
Halo2 with IPA, and Halo2 with KZG: PLONKish SNARK — two distinct trust models. As Halo2 + IPA — Setup: None. Proof size: Logarithmic. On-chain verification: Impractical — verifier linear in circuit size. PQ: No. Recursion: Native, via accumulation on a curve cycle. Maturity: Years in production; gadget-layer bug in 2026. As Halo2 + KZG — Setup: Universal, updatable. Proof size: Constant. On-chain verification: Practical. PQ: No. Recursion: Supported. Maturity: Production; central maintenance declining. As Halo2 + IPA — Prover cost profile: MSM-dominated over the Pasta curve cycle; no pairing-curve FFT bottleneck. Peak prover memory: Proportional to circuit size; moderate. Off-chain verifier: Linear in circuit size — tens to hundreds of milliseconds for large circuits. Implementations and maintainers: zcash/halo2 (Electric Coin Company). Where it is measured: Zcash Orchard figures; no neutral suite. As Halo2 + KZG — Prover cost profile: 256-bit-field FFTs over BN254; the largest gadget ecosystem of any PLONKish frontend. Peak prover memory: SRS resident; large circuits need tens of gigabytes. Off-chain verifier: Milliseconds. Implementations and maintainers: privacy-ethereum/halo2 (Ethereum Foundation PSE, maintenance mode), halo2-lib (Axiom), Scroll's fork. Where it is measured: Scroll and Axiom published figures; no neutral suite. Choose it when: IPA: systems verified on a node rather than in a gas-metered contract, where trusted setup is unacceptable. KZG: EVM-verified application circuits and coprocessors needing expressive custom gates.
What it is
The same PLONKish frontend with two very different backends. The original uses an inner-product argument over a curve cycle and needs no trusted setup, with recursion via accumulation. The widely used Ethereum-oriented variant replaces IPA with KZG, giving constant-size proofs and a practical Solidity verifier — and a universal trusted setup. These are routinely conflated.
Strengths and tradeoffs
- The IPA variant needs no trusted setup and has years of deployment in a value-bearing system
- Recursion without pairing-friendly curves, via accumulation on a two-cycle
- The KZG variant gives constant-size proofs and EVM-practical verification
- Rich, expressive frontend with mature circuit libraries for elliptic-curve and hashing work
- IPA verification is linear in circuit size — that variant is not an EVM settlement candidate
- The KZG variant reintroduces a universal trusted setup, unlike the original — a frequent source of confusion
- Neither is post-quantum
- The ecosystem has fragmented into forks that are not drop-in compatible and have uneven maintenance
- Maturity of the construction does not transfer to its gadget libraries: a counterfeiting bug in the upstream ECC gadget prompted an emergency response in 2026 — check the current status of any deployment cited as evidence
Choose it whenIPA: systems verified on a node rather than in a gas-metered contract, where trusted setup is unacceptable. KZG: EVM-verified application circuits and coprocessors needing expressive custom gates.
Related pages
Sources cited on this page · 1
All 40 sources for §01 are listed on the section page →
Cite this page
MarketComp (2026). Halo2 with IPA, and Halo2 with KZG. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/proof-systems/halo2/
@misc{zkfieldmanual-halo2-with-ipa-and-halo2-with-kzg,
title = {Halo2 with IPA, and Halo2 with KZG — The ZK Field Manual},
author = {MarketComp},
year = {2026},
version = {1.3},
howpublished = {\url{https://zkpick.com/proof-systems/halo2/}},
note = {Accessed: YYYY-MM-DD}
}