# What is a prover and a verifier?

In a proof system, the prover makes a claim and builds a proof, and the verifier checks that proof. The verifier accepts only a valid proof, so the prover's claim does not have to be trusted.

## How the two roles work

The prover knows a secret, such as a private key, and wants to show that a statement about it is true. It runs a computation over the secret and sends back a proof.

The verifier receives the public statement and the proof. It runs a check that uses only those two, and it learns whether the statement is true.

## Interactive and non-interactive proofs

In an interactive proof, the verifier sends random challenges and the prover answers them over several rounds. Each answer depends on the challenge, so the prover cannot prepare the answers in advance.

Many modern proofs, including STARKs and zk-SNARKs, skip the back-and-forth. The prover sends one proof, and anyone can check it later.

## Why the roles matter for privacy

In a zero-knowledge proof, the verifier learns only that the statement is true. A prover can show that it owns a coin worth enough for a payment, without revealing which coin it is.

## In Redacted

In bunker mode, every spend from your private balance is proved with a STARK, and the verifier checks a few random spots of that proof against a tree of hashes.

More: [Bunker mode](https://redacted.gg/docs/using-redacted/bunker-mode.md)

## Related terms

- [Zero-knowledge proof](https://redacted.gg/glossary/zero-knowledge-proof.md): A zero-knowledge proof lets someone prove that a statement is true without revealing anything else, for example that they own funds and may spend them, without showing which funds or who they are.
- [zk-SNARK](https://redacted.gg/glossary/zk-snark.md): A zk-SNARK is a zero-knowledge proof that is small, quick to verify and needs only one message from the prover, which is why blockchains can check them inside a smart contract.
- [STARK](https://redacted.gg/glossary/stark.md): A STARK is a short proof that a long computation was done correctly, which anyone can check quickly. It is built from hash functions alone, so it needs no trusted setup and no elliptic curves, and it can keep the inputs secret.
- [Soundness and completeness](https://redacted.gg/glossary/soundness-and-completeness.md): Completeness means an honest prover can always convince the verifier of a true statement. Soundness means a cheater cannot convince the verifier of a false one, except with a negligible chance.
- [Fiat-Shamir transform](https://redacted.gg/glossary/fiat-shamir.md): The Fiat-Shamir transform turns an interactive proof, where the verifier sends random challenges, into a single message. The prover computes each challenge as a hash of everything sent so far, so no back-and-forth is needed.
- [Succinct proof](https://redacted.gg/glossary/succinct-proof.md): A succinct proof is far shorter than the computation it covers, and far quicker to check than to redo. Its size and checking time grow only slowly as the computation grows, so a blockchain can verify a long computation cheaply.

Sources: [Zero-knowledge proofs, ethereum.org](https://ethereum.org/en/zero-knowledge-proofs/), [Fast Reed-Solomon Interactive Oracle Proofs of Proximity, ECCC 2017](https://eccc.weizmann.ac.il/report/2017/134/)
---

Page: https://redacted.gg/glossary/prover-and-verifier/