What is a polynomial commitment?

A polynomial commitment is a short value that binds a prover to one polynomial. Later the prover can prove the polynomial's value at any chosen point, and the verifier checks that proof against the short value.

Also called Polynomial commitment scheme or PCS.

How it works

The prover commits to a polynomial by sending one short value. That value fixes the polynomial, so the prover cannot change it afterwards.

Later, a point is chosen and the prover reveals the polynomial's value there, together with a proof. Checking that proof against the commitment shows whether the value is correct.

Two common kinds

KZG commitments, from a 2010 paper by Kate, Zaverucha and Goldberg, have a constant size whatever the degree of the polynomial. They rely on elliptic-curve pairings and need a trusted setup ceremony.

Hash-based commitments build a Merkle tree over the polynomial's values, and the root of that tree is the commitment. Their proofs are longer, but they rest only on hash functions and need no trusted setup.

Why proof systems use them

A proof system commits to its polynomials before the random challenges are sent. The prover therefore cannot choose the polynomials after seeing the challenges, which would let it cheat.

In Redacted

In bunker mode, the polynomials of each proof are sealed in a tree of hashes, and every spend from your private balance is proved with a STARK whose only cryptographic building block is the hash, with no trusted setup.

Bunker mode →

Related terms

CommitmentA commitment locks in a piece of data without revealing it. Later it can be opened and anyone can check that it matches, but until then it gives nothing away and cannot be changed.Trusted setup ceremonyA trusted setup ceremony creates the public parameters that some zero-knowledge proof systems need. Each participant adds secret randomness and destroys it, and the result is safe as long as at least one participant was honest.zk-SNARKA zk-SNARK is a zero-knowledge proof that is small, quick to verify and needs only one message from the prover, which is why blockchains can check them inside a smart contract.STARKA STARK is a short proof that a long computation was done correctly, which anyone can check quickly. It is built from hash functions alone, so it needs no trusted setup and no elliptic curves, and it can keep the inputs secret.Merkle treeA Merkle tree fingerprints a long list with one short value, the root, so that anyone can prove an item is in the list with a handful of hashes instead of the whole list.FRIFRI is the low-degree test used in STARKs. It checks that committed values come from a polynomial of low degree by halving the problem round after round and testing a few random points, and it rests only on hash functions.

Sources: Constant-size commitments to polynomials and their applications, Kate, Zaverucha and Goldberg, 2010 · Danksharding, ethereum.org · Post-quantum cryptography on Ethereum, ethereum.org

Updated November 1, 2026. All terms