STARKs: post-quantum and transparent
STARKs throw out pairings in favor of hash functions and polynomial low-degree testing. The transparent setup is the first selling point: no ceremony, no toxic waste, nothing to trust beyond collision-resistant hashing.
The second is plausible post-quantum security, since Shor does not break Merkle trees. The third is prover throughput - AIR encoding plus FRI scales to extremely large computations, which is why StarkNet, Polygon Miden and the Cairo VM all build on the STARK stack.
The price you pay is proof size: a STARK is typically tens of kilobytes, much larger than a Groth16 proof. Recursive STARKs and on-chain SNARK wrappers exist to cut the on-chain cost when you need Ethereum mainnet verification.
- FRI low-degree testing
- AIR / algebraic intermediate representation
- Merkle commitments
- no trusted setup
- hash-based security
- EP 003CH-012026-02-16
STARKs, FRI, and the transparent dream
Why hash-based proofs matter, how FRI low-degree testing works in the large, and where STARKs beat SNARKs on throughput despite the proof size penalty.
WATCH ->
