polynomial commitment

A polynomial commitment scheme lets a prover lock in a polynomial with one short fingerprint, then later prove the value of that polynomial at any point the verifier picks — all without revealing the polynomial's coefficients. Think of it as sealing a complicated function inside an envelope: the commitment is binding (you cannot later swap in a different polynomial) and the evaluation proofs are succinct (much smaller than the polynomial itself). This single primitive is the workhorse of nearly every modern succinct proof system.

The reason it matters is the reduction at the core of SNARKs and STARKs: proving a big computation is converted into proving statements about polynomials (their degree, their evaluations, their divisibility). With a polynomial commitment, the prover commits to those polynomials, the verifier challenges with one or a few random points, and the prover answers with tiny evaluation proofs. Because two distinct low-degree polynomials can agree at only a few points, checking at a random point is overwhelmingly convincing — this is the Schwartz-Zippel lemma doing the heavy lifting.

Different schemes trade off in revealing ways. KZG commitments are constant-size, with constant-size evaluation proofs, but require a trusted setup and pairings. FRI (used in STARKs) is hash-based and transparent but yields larger, poly-logarithmic proofs. Inner-Product-Argument commitments (Bulletproofs, Halo) are transparent with no setup but have logarithmic-size proofs and slower verification. Choosing among them largely determines a proof system's setup requirements, proof size, and post-quantum stance.