A KZG commitment (Kate-Zaverucha-Goldberg commitment, also called a polynomial commitment) is a cryptographic scheme that allows a prover to commit to a polynomial and later efficiently prove the value of that polynomial at any specific point, without revealing the entire polynomial. Named after its inventors Aniket Kate, Gregory M. Zaverucha, and Ian Goldberg (2010), KZG commitments have become critically important to Ethereum’s scaling roadmap because they enable succinct, verifiable data availability proofs. KZG commitments power proto-danksharding (EIP-4844), where Ethereum L2 rollups post transaction “blobs” of data with KZG proofs that validators can verify without storing the entire data permanently. This dramatically reduces L2 data posting costs, with some rollups seeing fee reductions of up to 99%. KZG commitments also underpin some ZK-SNARK proof systems (particularly PLONK) and are central to Ethereum’s long-term danksharding data availability design.
Origin & History
| Date | Event |
|---|---|
| 2010 | Kate, Zaverucha, and Goldberg publish “Constant-Size Commitments to Polynomials and Applications” at ASIACRYPT 2010 |
| 2019 | PLONK universal ZK-SNARK scheme uses KZG commitments for polynomial commitments |
| 2020 | KZG-based polynomial commitments adopted in Ethereum research for data sharding |
| Nov 2022 | EIP-4844 (proto-danksharding) proposed by Protolambda and Dankrad Feist; KZG commitments are the central mechanism |
| Mar 13, 2024 | EIP-4844 “Dencun” upgrade activates on Ethereum at 13:55 UTC; blobs and KZG commitments go live on mainnet |
| 2024 | L2 fees drop significantly after blob activation; some rollups (Optimism, Base) see up to 99% fee reductions |
| 2025 and beyond | Full danksharding planned; KZG commitments scale to 64 blobs per block |
How It Works
Commit to polynomial p(x):
p(x) = a₀ + a₁x + a₂x² + … + aₙxⁿ
The commitment C = commit(p) is a single short elliptic curve point. C reveals nothing about the polynomial coefficients.
Open at point z:
The prover claims “p(z) = y” with proof π, where π is a single elliptic curve point (48 bytes).
Verify:
The verifier checks using two pairing operations (computationally cheap). If the check passes, the claim is verified without the verifier ever seeing the full polynomial.
EIP-4844 Blob Application:
A rollup posts a 128 KiB blob of transaction data alongside a 48-byte KZG commitment. The Ethereum network verifies the KZG commitment cheaply on-chain, stores the blob for approximately 18 days (4,096 epochs) before pruning, and L1 contracts use the commitment for data availability proofs. The result is significant L2 cost reduction compared to posting data as permanent calldata.
Comparison Table:
| Property | KZG Commitment | Merkle Tree | Hash Commitment |
|---|---|---|---|
| Proof size | O(1) | O(log n) | O(n) |
| Verification cost | Constant | Proportional to depth | Linear |
| Updatable | Yes | Partial | No |
| Trusted setup needed | Yes (ceremony) | No | No |
In Simple Terms
Compressed polynomial proof: KZG lets you create a tiny “fingerprint” of a large dataset (polynomial) and later prove any specific value in that dataset with a tiny proof, without revealing the whole dataset.
Constant-size magic: Regardless of how large the polynomial (dataset) is, the commitment and proof are always the same tiny size (48 bytes each), unlike Merkle proofs, which grow with data size.
Blob data availability: EIP-4844 used KZG to let L2s post large batches of transaction data (blobs) to Ethereum, with a tiny proof that the data is available, enabling dramatic fee reductions.
Trusted setup: KZG requires a one-time “trusted setup ceremony,” a multi-party computation where the secret “toxic waste” must be destroyed. Ethereum’s ceremony had over 141,000 contributors, ensuring that as long as even one participant was honest, the parameters are secure.
ZK foundation: KZG commitments are used inside ZK-SNARK systems (PLONK) as efficient polynomial commitment schemes, a fundamental building block of zero-knowledge proofs.
Real-World Examples
| Scenario | Implementation | Outcome |
|---|---|---|
| EIP-4844 blobs | Arbitrum posts 128 KiB blob and a 48-byte KZG commitment to Ethereum | L2 data cost drops significantly; some rollups see up to 99% fee reductions |
| Ethereum ceremony | 141,000+ participants worldwide contribute to the KZG trusted setup | Powers all EIP-4844 KZG verifications on mainnet |
| PLONK proof system | Polygon zkEVM uses PLONK with KZG commitments | Efficient ZK proof generation for rollup validity proofs |
| Proto-danksharding | Blob transactions active March 13, 2024 (Dencun upgrade) | Optimism, Arbitrum, Base fees drop dramatically immediately after activation |
| Future danksharding | 64 blobs per block planned vs current 3-6 | Further fee reduction; KZG multi-proof enables continued scaling |
Advantages
| Advantage | Description |
|---|---|
| Constant proof size | O(1) proofs regardless of data size, extremely efficient verification |
| Ethereum scaling | Enables blob transactions for significant L2 fee reductions |
| ZK compatibility | Foundational primitive for PLONK and other efficient ZK-SNARK systems |
| Updatable commitments | Can update specific polynomial values without recommitting entirely |
| Bandwidth efficiency | 48-byte commitment and 48-byte proof for any size polynomial |
Disadvantages & Risks
| Disadvantage | Description |
|---|---|
| Trusted setup | Requires a one-time ceremony; compromise of all ceremony participants would break future security |
| Computational complexity | Pairing operations are more expensive than hash operations (though constant in number) |
| Quantum vulnerability | Based on elliptic curve pairings, potentially vulnerable to sufficiently powerful quantum computers |
| Implementation complexity | Highly complex cryptography requiring expert implementation |
| BLS12-381 dependency | Ethereum’s KZG uses the BLS12-381 curve; changes would require a new trusted setup |
Risk Management Tips:
- KZG’s trusted setup ceremony (141,000+ participants) is considered secure; a single actor compromise is impossible with such broad participation
- For quantum risk: Ethereum’s post-quantum roadmap includes transitioning from KZG to hash-based commitments in the longer-term future
- From an L2 user perspective, EIP-4844 blobs are transparent — simply enjoy the reduced fees without needing to understand the underlying cryptography
FAQ
Q: What is a KZG commitment in simple terms?
A: A way to create a small, fixed-size “promise” about a large amount of data, and later prove any specific piece of that data is correct, with a tiny proof that anyone can verify quickly.
Q: Why is KZG important for Ethereum?
A: KZG commitments enable EIP-4844 blob transactions, which allow L2 rollups to post large amounts of transaction data to Ethereum cheaply, with cryptographic proof of availability. The Dencun upgrade activated on March 13, 2024, with some rollups seeing fee reductions of up to 99%.
Q: What is the KZG trusted setup?
A: A multi-party computation ceremony where thousands of participants collectively generate cryptographic parameters. As long as at least one participant destroyed their “toxic waste,” the parameters are secure. Ethereum’s ceremony had over 141,000 contributors.
Q: How does KZG differ from Merkle proofs?
A: Merkle proofs grow logarithmically with data size (bigger data = bigger proof). KZG proofs are always 48 bytes regardless of polynomial size, which is crucial for efficiency at Ethereum’s scale.
Q: Will quantum computers break KZG?
A: Potentially, in the long term. KZG relies on the elliptic curve discrete logarithm problem, which sufficiently powerful quantum computers could break. Ethereum’s researchers are already exploring post-quantum alternatives.
Related Terms
EIP-4844, Danksharding, ZK-SNARK, PLONK, Data Availability, Layer 2, Blob Transaction
UPay Tip: You do not need to understand KZG cryptography to benefit from it. The dramatic fee reductions on Layer 2 networks after EIP-4844 are the tangible user benefit. But if you are a developer building on L2s, understanding blob transactions and KZG commitments helps you design applications that use Ethereum’s data availability layer efficiently.
Disclaimer: This content is for educational purposes only and does not constitute financial or investment advice. Cryptocurrency investments are subject to market risks.
