Walk into any Vietnamese convenience store and you'll see them by the counter: phone scratch cards (thẻ cào). Thin, palm-sized, worth a few thousand đồng. You scratch off the silver film, read the code, and top up your phone in seconds. Nobody weighs them. Nobody worries about shipping them. A scratch card is so small that its transport cost is effectively zero — the value is in the code, not the cardboard.
Now imagine that a cryptographic proof — the mathematical evidence that a zk-rollup processed 10,000 transactions correctly, or that your income statement is real without revealing the numbers — could be just as small. That's the promise behind the smallest proofs in zero-knowledge cryptography: kích thước proof zk (ZK proof size) measured in hundreds of bytes, not kilobytes or megabytes.
A Groth16 SNARK proof — the workhorse of privacy coins and zk-rollups — is just 3 group elements, roughly 128–200 bytes. That's literally the size of a phone scratch card's printed code. It verifies in milliseconds and costs almost nothing to post on-chain.
This article explains how a proof gets that small, why proof size is a price tag (every byte you send on-chain costs gas), and when a tiny proof beats a bulky one — and when it doesn't.
What "proof size" actually means
Every zero-knowledge proof is a message: the prover sends data to the verifier that proves "this computation was executed correctly" without revealing the secret inputs. Proof size is simply the number of bytes in that message.
Three things scale with proof size, and they're the reason this article matters:
- On-chain cost. On Ethereum, sending calldata costs 16 gas per non-zero byte (EIP-2028). A 200-byte proof costs ~3,200 gas just to deliver — trivial. A 100 KB proof costs ~1.6 million gas. For a rollup, proof size is literally transaction cost.
- Verification speed. The verifier must read and process the proof. Smaller proofs are typically faster to check (a Groth16 proof checks in ~1-5 ms with three pairing equations).
- Storage and bandwidth. On-chain data lives forever. Mobile wallets and light clients must download and store it. A 128-byte proof syncs instantly on a budget Android phone; a 100 KB proof is a burden.
The punchline: proof size is not an aesthetic detail — it's a cost line.
Groth16: The proof that fits in a scratch card
The smallest practical proofs come from Groth16, a SNARK scheme introduced by Jens Groth in 2016 and used by Zcash, Tornado Cash, and early zk-rollups.
The anatomy: exactly 3 group elements
A Groth16 proof is precisely three group elements, conventionally labeled A, B, and C:
` Proof = (A, B, C)
A ∈ G₁ (32 bytes compressed) — encodes the witness B ∈ G₂ (64 bytes compressed) — encodes the witness (second group) C ∈ G₁ (32 bytes compressed) — enforces the computation constraints
Total: ~128 bytes raw, ~200 bytes with encoding overhead `
- A and C are points on one elliptic curve group (G₁); B is a point on a second group (G₂). Using two groups is what makes the pairing-based verification work.
- The verifier checks one pairing equation that ties A, B, C to the public inputs. If the equation balances, the proof is valid.
- The 128–200 byte range covers every Groth16 proof regardless of the size of the underlying computation — that's what "succinct" means. Proving 1 transaction or 10,000 transactions produces the same tiny proof.
Where the size comes from
Groth16's smallness is a deliberate design choice:
- Constant-size: proof size depends only on the scheme, not the computation. A giant circuit still yields 3 group elements.
- Pairing-based verification: the verifier does a fixed number of pairing operations, independent of the computation's complexity.
This is why "zk proof 128 byte" is not marketing hype — it's the mathematical output of the scheme.
Figure 1: Proof size — a scratch card (SNARK) vs a notebook (STARK)
The tradeoff: why STARK proofs are bulky
If Groth16 proofs are scratch cards, STARK proofs are thick notebooks. A STARK proof for a large computation is typically 10–100 KB — 50 to 500 times bigger than a Groth16 proof.
Why? STARK achieves something Groth16 doesn't: transparency (no trusted setup ceremony, no secret parameter to leak). It does this by replacing the single secret-based commitment with a Merkle tree of polynomial evaluations (the FRI protocol). The proof must include:
- The Merkle root committing to the execution trace
- Authentication paths for every queried position
- Folded polynomials across many FRI rounds
All of that is much larger than three group elements. The scalability in "STARK" refers to proving (huge computations) — but the proof itself balloons.
The size tradeoff, honestly stated
| Property | Groth16 SNARK | STARK (FRI) |
|---|---|---|
| Proof size | ~128-200 bytes | 10-100 KB+ |
| Verification | ~1-5 ms (3 pairings) | ~10-50 ms (hash-based) |
| Trusted setup | Yes | No |
| Quantum resistance | No (pairings) | Yes (hashing) |
Smaller proof ≠ better proof. STARK is bigger because it removed the trusted setup. Proof size is a tradeoff axis, not a universal winner. A 200-byte proof with a trusted setup may be the wrong choice if the setup ceremony is unacceptable.
Why size matters on-chain: the gas math
The most concrete place proof size bites is on-chain verification. Let's do the arithmetic.
Calldata: 16 gas per byte
On Ethereum, each non-zero byte of calldata costs 16 gas (EIP-2028). A proof must be delivered as calldata to the verifying smart contract:
` Proof size Calldata cost (at ~10 gwei, ETH ≈ $2,000) ──────────────────────────────────────────────────────────── 128 bytes ~2,048 gas ≈ $0.04 (a scratch card!) 200 bytes ~3,200 gas ≈ $0.06 1 KB ~16,000 gas ≈ $0.32 100 KB (STARK) ~1.6M gas ≈ $32 (a notebook) `
That's the difference between a fee your grandma wouldn't notice and a fee that eats the entire rollup's profit margin.
Verification: another price tag
Beyond delivery, the contract must check the proof:
- Groth16 on-chain: ~200k gas (~$4 at the same rates) — uses Ethereum's precompiles for pairings.
- Raw STARK on-chain: ~5M gas (~$100) — FRI verification is not EVM-friendly.
Combined, verifying a Groth16 proof on Ethereum costs roughly ~$4-5. Verifying a raw STARK costs ~$130. For a rollup posting proofs every few minutes, this is a decisive business decision.
Why rollups compress
A zk-rollup batches thousands of transactions into one proof. If that proof were 100 KB, calldata alone would make the rollup uneconomical. So production rollups use a hybrid pipeline:
`
- Prove the batch with STARK (transparent, scalable prover)
- Compress the STARK into a SNARK (recursive proof composition)
- Post the tiny SNARK (~200 bytes) on-chain — the scratch card
`
This is exactly what StarkNet (SHARP → Groth16) and zkSync Era (STARK → PLONK) do. They get STARK's transparent proving and SNARK's scratch-card-sized settlement proof.
Figure 4: The gas math — why proof size matters on-chain
Figure 2: Groth16 proof anatomy — 3 group elements (~128-200 bytes)
When proof size matters most
Proof size is a constraint, and constraints only matter in constrained environments. Here's when it decides everything:
Size matters:
- On-chain settlement — calldata + verification gas dominate (the math above).
- Mobile and light clients — a 128-byte proof syncs instantly and verifies in microseconds on a low-end phone.
- Frequent proofs — if you post many proofs (every rollup batch, every oracle update), size compounds.
- Limited bandwidth — rural areas, slow connections, tiny devices.
Size matters less:
- Off-chain verification — a server can verify a 100 KB STARK comfortably.
- One-time or rare proofs — a periodic compliance report, a settlement every few hours.
- When blobs are used — EIP-4844 introduced ~128 KB blob data at a much lower cost, softening the calldata penalty for data (though verification still prefers small proofs).
The mental model
Ask: "Where is this proof verified, and how often?" If the answer is "on-chain, frequently" → tiny proofs win. If it's "off-chain, occasionally" → size barely matters and transparency/quantum-resistance may matter more.
The scratch-card decision framework
| Scenario | Best choice | Why |
|---|---|---|
| zk-rollup settling on Ethereum every few minutes | SNARK (Groth16/PLONK) | Scratch-card calldata + fast verification |
| Privacy coin (Zcash-style) | SNARK | Tiny proofs in normal transactions |
| Huge VM execution, no trusted setup allowed | STARK (+ SNARK wrapper for settlement) | Transparent proving, compress at the end |
| Quantum-resistant long-term archives | STARK | Hash-based security |
| Mobile-first consumer app | SNARK | Instant sync, negligible bandwidth |
Figure 3: ZK proof size comparison — SNARK vs STARK
FAQ: Your Questions Answered
Q: Is a ZK proof really just 128 bytes?
A: A Groth16 proof is exactly 3 group elements: ~128 bytes raw, ~200 bytes once encoded into a transaction. Yes — that's the actual output of the scheme, and it's independent of how large the computation being proven is.Q: Why do people say "zk proof 128 byte" instead of larger numbers?
A: Because Groth16 (the most widely deployed SNARK) produces ~128 bytes. Other schemes — PLONK (~1-2 KB), Halo2 (~5-10 KB), STARK (10-100 KB) — are larger because they trade proof size for other properties like universal or transparent setup.Q: Does bigger proof size mean more secure?
A: No. Security comes from the underlying assumptions (pairing hardness for SNARK, hash collision resistance for STARK), not from byte count. STARK is bigger for transparency, not for security.Q: How much does proof size cost on Ethereum?
A: Calldata costs 16 gas per non-zero byte. A ~200-byte Groth16 proof costs ~3,200 gas to deliver and ~200k gas to verify (roughly $4-5 total). A 100 KB STARK costs ~1.6M gas to deliver and ~5M gas to verify (roughly $130+).Q: Do zk-rollups actually use tiny proofs?
A: Yes. StarkNet and zkSync Era prove with STARKs but compress to Groth16/PLONK SNARKs before posting on-chain. The on-chain proof — the scratch card — is what users and L1 contracts see.Q: Is a small proof always better?
A: No. A tiny Groth16 proof requires a trusted setup. If you can't accept that ceremony (or need quantum resistance), the larger STARK proof is the right trade. Choose based on where the proof is verified and how often.Summary: The scratch card principle
A phone scratch card works because it's small enough to be worthless to ship and quick enough to redeem on the spot. ZK proofs work the same way: kích thước proof zk determines whether proving something is a rounding error in your fee budget or a line item that breaks your product.
The smallest proofs — Groth16's 3 group elements, ~128–200 bytes — are the cryptography equivalent of a scratch card. They're cheap to deliver, instant to verify, and they're why zk-rollups can settle thousands of transactions for pocket change. Bigger, transparent STARK proofs earn their bulk when trust and quantum-resistance matter more than bytes.
The next time you top up a phone with a thẻ cào, remember: the code on that card is roughly the size of a zero-knowledge proof — and the proof might be the most valuable tiny thing on the blockchain.
Word count: ~1,700 | Primary keyword: "kích thước proof zk" | Secondary: "zk proof 128 byte", "snark proof size"