KZG commitment
A KZG commitment (Kate-Zaverucha-Goldberg) is a polynomial commitment with a remarkable property: both the commitment and every evaluation proof are a single group element — constant size, no matter how high the polynomial's degree. You commit to a polynomial p(x) by evaluating it "in the exponent" at a secret point τ baked into the trusted setup, producing a commitment C = [p(τ)]. The whole polynomial, which might have a million coefficients, is squeezed into one elliptic-curve point of a few dozen bytes.
To prove that p(z) = y for a point z the verifier chooses, the prover relies on a simple algebraic fact: p(x) − y is divisible by (x − z) exactly when p(z) = y. So the prover computes the quotient polynomial q(x) = (p(x) − y)/(x − z) and sends its commitment π = [q(τ)] as the proof. The verifier checks one pairing equation that holds if and only if that divisibility is real. One pairing check, one constant-size proof, regardless of the computation's size — this is the succinctness that makes KZG ideal for blockchains.
KZG powers PLONK and many production zkEVMs, and it is the commitment behind Ethereum's EIP-4844 blobs, where each blob is treated as a polynomial and committed with KZG so rollups can cheaply prove data availability. The price is a trusted setup (the powers-of-tau ceremony) and reliance on pairing-friendly curves, which are not post-quantum. Its homomorphic structure also enables batch openings: many evaluations across many polynomials can be proven with essentially one combined proof.
Commit, prove an evaluation via the quotient, and verify with a single pairing check.
KZG's constant proof size comes entirely from the trusted setup encoding τ. If the setup secret τ leaked, an attacker could open a commitment to any value they liked, breaking binding — another reason the powers-of-tau ceremony must stay honest.