Zero-knowledge demo: x³ + x + 5 = 35

This page runs a real (toy) zk-SNARK in your browser via WebAssembly, compiled from the zk-toy Rust code. Pick a secret x. The prover will convince the verifier that it knows an x with x³ + x + 5 = 35 (mod 257) — without the verifier ever seeing x.

Proof

Verification

2. Verify against public output 35 3. Verify against tampered output 36

How it works (60 seconds)

1. Circuit → R1CS → QAP. The equation becomes rank-1 constraints, then polynomials A, B, C with A·B − C = H·t.
2. Trusted setup. Random toxic waste s, α (deterministic here, from a fixed seed so the demo is reproducible); publish only encrypted powers E(sⁱ), E(α·sⁱ).
3. Prove. Blind evaluation: the prover computes E(A(s)) etc. from the encrypted powers without learning s.
4. Verify. Knowledge-of-exponent check on the α-shifts, then the divisibility check a·b − c = h·t(s) (discrete logs brute-forced — toy-sized group only!).

Further reading

The full writeup lives in the zk-toy README. Each pipeline stage has a deeper explainer, each readable in one sitting:

• R1CS — flattening the circuit, why addition is free, the witness check
• QAP — the interpolation trick, the divisibility argument, Schwartz–Zippel
• The protocol — hiding, trusted setup, blind evaluation, the KEA check, caveats
• Field choice — why F₂₅₇, roots of unity, the mod-1543 subgroup trick

← back to demos