Knowledge soundness of Groth16

Together with my colleagues Ryan Cao and Kunming Jiang, we re-derived the knowledge soundness of Groth16 as an entertaining exercise. Groth16 is a pairing-based ZK-SNARK. See here for an excellent tutorial on Groth16, or check out the paper itself. R1CS QAPs A witness is $$ \mathbf a = (a_0,\ldots,a_\ell,a_{\ell+1},\ldots,a_m) \in \mathbb{F}^{m+1}, $$ where $a_0,\ldots,a_\ell$ Continue reading…