IOG Develops ZK Wrapper for RISC Zero and SP1 Proof Verification on Cardano

Input Output Research dey develop one zero-knowledge wrapper wey dem design to connect Cardano applications with RISC Zero, SP1 and other systems wey dey generate Groth16 proofs for the BN254 elliptic curve.

The prototype dey tackle one cryptographic compatibility gap wey currently dey stop Cardano smart contracts from verifying many proofs from established ZK tools in a efficient way. The work still dey technical-feasibility stage, and dem dey prepare selected components for possible engineering implementation for early 2027.

Groth16 Wrapper Converts BN254 Proofs for Cardano

Plenty zero-knowledge infrastructure for blockchain dey use Groth16 proofs for BN254. Ethereum support for the curve make developer frameworks, applications and ZK virtual machines adopt the same cryptographic standard.

Cardano on the other hand dey support BLS12-381 operations. Even though Groth16 fit work with both curves, proof wey dem create for BN254 no fit verify efficiently for Cardano without new protocol functions or heavy arithmetic wey go cost plenty computation inside Plutus smart contract.

The prototype introduce one recursive wrapping layer between the two environments. E go receive valid Groth16 proof for BN254 and then generate second proof for BLS12-381, so that Cardano fit verify the result using cryptographic operations wey the network already support.

The conversion no need users to trust the person wey dey perform am. The outer proof dey confirm say valid original proof dey for the specified verification key and public inputs. Cardano go check that claim without to repeat the computation wey produce the original result.

The toolkit wey dey now dey support RISC Zero and SP1, two zero-knowledge virtual machines wey allow developers run general-purpose programs and generate compact proofs say those programs run correctly.

Source-specific plugins dey convert their outputs enter one common format. The wrapping engine then reproduce the claim for BLS12-381 and generate verifier code wey fit integrate inside Cardano application.

Input Output Research test Groth16 and Plonk as outer proving systems. Groth16 finish the wrapping process faster and produce smaller proofs, but e require trusted setup for the wrapper circuit. Plonk no need circuit-specific setup, but e require plenty more off-chain proving time.

Both approaches produce final proofs wey fit enter inside Cardano on-chain verification budget. So the main trade-off dey for proof generation and setup requirements, no be for the final verification through Plutus.

RISC Zero and SP1 Fit Support Cross-Chain Verification

Compatibility with RISC Zero and SP1 go allow Cardano developers use existing ZK programs and libraries without to rebuild every computation for Cardano cryptographic environment.

One example wey enter the research dey prove the ERC-20 balance of one Ethereum account. RISC Zero go run the required Ethereum logic, extract the balance from committed network state and generate proof. The wrapper then go convert that output into form wey Cardano validator fit verify.

The same architecture fit confirm selected Ethereum or Bitcoin state, verify external program execution or provide cryptographic evidence say one computation happen outside Cardano.

The workshop still discuss one possible SP1-based implementation of Helios, one Ethereum light client. System like that fit prove Ethereum consensus execution inside zero-knowledge environment and submit compact result make Cardano application verify am.

These capabilities fit support light clients, bridges, rollups and cross-chain protocols wey depend on reliable information from another blockchain. The wrapper no dey transfer assets and e no operate like bridge by itself. E dey provide verification layer wey other applications fit integrate inside their own architecture.

The approach fit also reduce duplicate development work. Instead make teams implement every computation as Cardano-native ZK circuit, dem fit use supported software from the RISC Zero or SP1 ecosystems and then translate the final proof before on-chain verification.

The toolkit still be prototype for experimentation. The examples cover proof generation, recursive wrapping and creation of the corresponding Cardano verifier, while production deployment still need engineering work, security review and final decision on the outer proving system.

Plonky3 and Halo2 Define the Remaining Verification Work

The workshop still present one feasibility study to verify Plonky3 proofs through Cardano smart contracts.

Plonky3 na modular framework for STARK-based proving systems. E rely mainly on hash functions and finite-field arithmetic, no be the elliptic-curve operations wey many SNARK systems dey use, and that one make am relevant to Cardano post-quantum research.

One proposed application na post-quantum signature aggregation. These signatures fit require tens of kilobytes each, while ZK proof fit combine multiple signatures into one single result and reduce the amount of data wey must store or verify on-chain.

Another possible use concern legacy UTXOs after future migration away from current elliptic-curve signatures. Holder fit potentially prove say dem know the seed wey connect to one address without to reveal the seed publicly.

The feasibility study find say direct Plonky3 verification still dey pass Cardano single-transaction limits. One optimized test proof measure approximately 186 kilobytes and require around 220 million memory units and 75 billion CPU units.

Because individual query proofs fit check separately, the researchers estimate say the complete process fit divide across approximately 23 transactions. Dem still discuss Hydra execution and one optimistic verification model, wey mean say dem go check the full proof only after challenge, as possible alternatives.

Another separate Halo2 cost estimator dey address earlier stage of the development process. The tool dey calculate expected proof size, verification-key size and the cryptographic operations wey dem need to verify proposed circuit for Cardano.

Developers fit model circuit or test components like SHA-256 before dem complete the full application. The estimates dey allow teams identify expensive components and adjust the design before dem build the prover and Cardano validator.

The Groth16 wrapper currently be the most direct road from the research program to practical developer use. If e advance enter engineering implementation, Cardano applications fit verify outputs from established zkVM ecosystems without to wait make each external system introduce native BLS12-381 support. Plonky3 go require different architecture, with verification wey dem go divide across transactions, move enter Hydra or activate through challenge-based design.