Amudhan Muthaiah.

The problem with Weierstrass

The standard Weierstrass form y² = x³ + ax + b has incomplete addition formulas. You need separate logic for point doubling, adding distinct points, and handling the point at infinity. In a ZK circuit, every branch costs constraints.

Edwards curves fix this

An Edwards curve is defined as:

The addition formula is complete — one formula handles every case, including doubling:

Why this matters for ZK

• No edge cases → no branching → constant-time operations → side-channel resistance
• Every Edwards curve is birationally equivalent to a Weierstrass curve, so no security is lost in the isomorphism
• The twisted form ax² + y² = 1 + dx²y² generalizes further

Curves in production

ed25519 for signatures, Jubjub in Zcash, Baby Jubjub in Ethereum ZK circuits — all Edwards-form curves chosen for their complete addition laws and efficiency inside arithmetic circuits.

Pedersen commitments

The building block. A Pedersen commitment to value v with blinding factor r:

Where G, H are generator points on an elliptic curve. Computationally binding, perfectly hiding. The key property — additively homomorphic:

The inner product argument

IPA proves knowledge of vectors a, b such that ⟨a, b⟩ = c. Each round halves the vector size, so a proof over n elements takes only O(log n) rounds — logarithmic proof size.

Range proofs

The killer app: proving v ∈ [0, 2ⁿ) without revealing v. Decompose in binary, represent as an arithmetic circuit, reduce to an inner product relation, apply IPA. The proof is only ~672 bytes for a 64-bit range.

Bulletproofs vs SNARKs

No trusted setup ceremony. No toxic waste, no multi-party computation. Trade-off: verification is O(n) instead of O(1). For most applications, the simpler trust model wins.

arkworks ecosystem

arkworks is the standard Rust library ecosystem for zero-knowledge proofs. It provides elliptic curve arithmetic, finite field operations, R1CS constraint systems, and proof system implementations.

Minimal Pedersen on BLS12-381

use ark_bls12_381::G1Projective as G;
use ark_ec::Group;
use ark_std::UniformRand;

fn pedersen_commit(
    v: u64,
    r: ark_bls12_381::Fr,
    g: G,
    h: G,
) -> G {
    // C = v*G + r*H
    g.mul_bigint(&[v]) + h * r
}

fn main() {
    let mut rng = ark_std::test_rng();
    let g = G::generator();
    let h = G::rand(&mut rng);
    let r = ark_bls12_381::Fr::rand(&mut rng);

    let c1 = pedersen_commit(5, r, g, h);
    let c2 = pedersen_commit(3, r, g, h);
    // Homomorphic: c1 + c2 commits to 8
}

Why BLS12-381?

The BLS12-381 curve provides a 255-bit scalar field — enough for 128-bit security. It supports efficient pairings (needed for some proof systems) and has wide ecosystem support across Ethereum, Zcash, and Filecoin.

Homomorphic property

Because Pedersen commitments are additively homomorphic, you can compute on committed values without revealing them. C(v₁) + C(v₂) = C(v₁ + v₂) — this is the foundation for confidential transactions.