Imagine convincing a friend you know the password to a club — without saying the password, without whispering it, without leaving a single hint of what it is. They walk away certain you know it, and clueless about what it is.
That impossible-sounding trick has a name: a zero-knowledge proof. It’s the engine that lets Zcash say “this transaction is valid, trust me” while showing you absolutely nothing about who paid whom or how much.
What a zero-knowledge proof actually is
Before you read — take a guess
Guess: in a zero-knowledge proof, what does the verifier end up with?
Two characters, always. A prover wants to convince a verifier that some statement is true. The catch: the prover must reveal nothing beyond the mere fact that it’s true.
To count as a real zero-knowledge proof, it has to nail three properties. Memorize the exact words — they show up everywhere.
- Completeness — if the statement is true and the prover is honest, the verifier ends up convinced. (Honest claims always go through.)
- Soundness — a dishonest prover cannot convince the verifier of a false statement, except with negligibly tiny probability. (You can’t bluff your way in.)
- Zero-knowledge — the verifier learns nothing beyond the truth of the statement. In particular, they never learn the secret — the witness — that made it true.
The “witness” is the private thing the prover knows: a password, a key, a solution. The whole game is to prove you possess a valid witness without handing it over — or even hinting at it.
Lock the vocabulary in by producing it, not just reading it:
Fill in the core definition from memory.
Pick the right option for each blank, then check.
A zero-knowledge proof convinces a that a statement is true while revealing beyond its truth. The private secret the prover holds is called the .
Now match each property to exactly what it promises:
Pick a term, then click its definition.
The Ali Baba cave
Before you read — take a guess
Guess: in a cave where one branch needs the secret word, how does Peggy convince Victor she knows it WITHOUT saying it?
The classic way to feel this comes from Quisquater and colleagues: the Ali Baba cave.
Picture a ring-shaped cave shaped like a loop. There’s one entrance, and the loop splits into a left branch and a right branch that meet at the back. Blocking that meeting point is a magic door that only opens for someone who knows the secret word.
Our cast: Peggy the prover (she claims to know the word) and Victor the verifier (he wants proof, but Peggy refuses to just tell him the word).
Here’s the dance. These steps really are sequential — advance through one round:
- Victor looks away. Peggy enters the cave alone and walks down EITHER the left or right branch, her choice. Victor, outside, has no idea which one she took.
- Victor makes a demand. Victor steps to the entrance and shouts the branch he wants her to EXIT from — “Come out the left!” (or right). He picks at random.
- Peggy obeys. If she came up the branch he named, she just walks back out — no magic needed. If she came up the OTHER branch, she must open the magic door at the back to cross over. That needs the secret word.
- One round = a coin flip. If Peggy were faking, she could only guess which branch Victor would name. She survives a single round by luck with probability 1/2 — she just happened to pick the branch he asks for.
- Repeat, repeat, repeat. Do it again. And again. A cheater has to win EVERY coin flip in a row. After n rounds, her odds of bluffing the whole way are 1/2^n — vanishingly small.
- Verdict. Peggy exits the demanded branch every single time across many rounds. Victor is now convinced she knows the word — yet he never heard it. Completeness, soundness, and zero-knowledge, all in one walk.
Map it back to the three properties and it clicks. Sort each cave fact under the property it demonstrates:
Which property does each part of the cave protocol demonstrate?
Place each item in the right group.
- Peggy knows the word, so she always exits the branch Victor names
- A faker has to win every coin flip; her odds collapse to 1/2^n
- Victor sees her emerge, but never hears the word itself
The soundness intuition in one line: each round halves a cheater’s survival odds. One round = 1/2. Ten rounds = 1/1024. Twenty rounds ≈ one in a million. We never reach zero, but we get negligibly close — and that “negligible probability” is exactly what soundness promises.
Nail the soundness math.
Pick the right option for each blank, then check.
A single cave round, a faker survives by luck with probability one in . Across n independent rounds the survival odds become 1 over 2 to the power , shrinking toward .
A second lens: Where’s Waldo?
Here’s a purely illustrative teaching device (not a formal protocol): Where’s Waldo?
You claim you found Waldo on a huge, busy page. To prove it, you cover the entire page with a giant sheet that has one tiny hole in it — positioned right over Waldo’s face. Your friend peers through the hole and sees Waldo, plainly in the picture.
But the sheet hides the page’s edges, so they can’t tell where on the page that hole sits. They’re convinced Waldo is there (the statement is true) without learning his location (the witness). Truth revealed, secret kept.
In the Where's Waldo device, which part plays the role of the witness — the secret kept hidden?
SNARK: the practical flavor Zcash uses
Before you read — take a guess
Guess: which two upgrades would make the cave protocol usable on a blockchain?
Cave rounds are charming but slow — all that shouting back and forth. Zcash needs something a verifier can check in milliseconds with no conversation at all. Enter the zk-SNARK:
Zero-Knowledge Succinct Non-interactive ARgument of Knowledge. Unpacked:
- Succinct — the proof is small and fast to verify. Checking it is far cheaper than re-running the computation it’s about. (A verifier confirms a huge calculation happened correctly without redoing it.)
- Non-interactive — no back-and-forth. The prover produces one proof, posts it on-chain, and anyone can verify it later, alone. No live shouting matches.
- Argument of Knowledge — it’s sound, and it certifies the prover genuinely knows a valid witness (not just that one exists out there somewhere).
“No back-and-forth” might sound weaker than the interactive cave. It isn’t. A Fiat–Shamir-style transform replaces Victor’s random shouts with the output of a hash function, collapsing all those rounds into a single self-contained proof — with the same guarantees.
Spell out the acronym's pieces from memory.
Pick the right option for each blank, then check.
In zk-SNARK, '' means the proof is small and fast to verify, '' means one proof with no back-and-forth, and the transform that removes interaction is named after .
What a Zcash SNARK actually proves
Before you read — take a guess
Guess: when you make a shielded spend, what does the attached SNARK reveal to the network?
Here’s the payoff. When you make a shielded spend in Zcash, the proof attached to it convinces every node that all of the following are true — while revealing none of the underlying secrets:
- The note exists — the note being spent is really in the note-commitment Merkle tree (the prover knows a valid Merkle path to it).
- You’re authorized — the prover knows the spending key that controls that note.
- The nullifier is honest — the nullifier is correctly derived from the note, which is what stops the same note being spent twice.
- The books balance — inputs equal outputs; the value commitments sum correctly, so no money is conjured from thin air.
All of that is proven while keeping the note’s value, the address, and which note is being spent completely hidden. The network gets certainty that the transaction is legitimate, and learns nothing else.
Sort what the proof guarantees from what it deliberately keeps secret:
In a shielded spend, what does the SNARK PROVE versus what does it HIDE?
Place each item in the right group.
- The note exists in the Merkle tree
- The spender knows the spending key
- The nullifier is correctly derived (no double-spend)
- Inputs balance outputs
- The note's value
- The address involved
- Which specific note is spent
Don’t worry if “note”, “nullifier”, “commitment”, and “Merkle path” feel hazy — that’s the next lesson’s whole job. For now, just absorb the shape: a SNARK proves a bundle of true facts about a payment without exposing any of them.
Recall the anti-double-spend piece.
Pick the right option for each blank, then check.
The value that is correctly derived from a note and stops it being spent twice is the , and the proof shows the note sits in the note-commitment tree.
Three misconceptions worth burning down
Before you read — take a guess
Guess: is a zero-knowledge proof basically the same thing as encrypting the secret?
No. Encryption hides data behind a key someone could decrypt. Zero-knowledge proves a fact while leaking nothing extra — there may be no ciphertext to decrypt at all. It’s about what’s revealed by the proof, not about scrambling a message.
No. Succinct means the proof is small and fast to check — not that the witness is squeezed in somewhere. The witness is never in the proof. You couldn’t extract the secret from it even if you tried.
No. Fiat–Shamir-style transforms turn interactive protocols into non-interactive ones with the same soundness and zero-knowledge guarantees. One posted proof, verifiable by anyone, no conversation required.
A tiny pseudo-statement, just to make “prove a fact, hide the witness” concrete:
prove: "I know x such that hash(x) = H" // reveal H and the proof — never reveal xIn that one-liner, x is the witness — the thing you keep secret — and H plus the proof are all the verifier ever sees.
Read the pseudo-statement above and name the parts.
Pick the right option for each blank, then check.
In `prove: I know x such that hash(x) = H`, the hidden secret — the witness — is , while the value published alongside the proof is .
Big picture & final check
You now have the intuition: a zero-knowledge proof buys you certainty without disclosure, and a zk-SNARK makes that certainty small, fast, and non-interactive enough to live on a blockchain.
Big picture
Zero-knowledge proofs in one picture
- Zero-knowledge proof
- Cast
- Prover knows witness
- Verifier checks claim
- Three properties
- Completeness — honest prover convinces
- Soundness — liar cannot, except negligibly
- Zero-knowledge — witness stays secret
- Intuitions
- Ali Baba cave — random rounds, 1 over 2 to the n
- Wheres Waldo — see him, not where
- zk-SNARK
- Succinct — small, fast to verify
- Non-interactive — one proof, Fiat-Shamir
- Argument of Knowledge — really knows witness
- Zcash shielded spend proves
- Note exists in Merkle tree
- Knows spending key
- Nullifier correct — no double-spend
- Inputs balance outputs
- Hides value, address, which note
- Cast
A final mixed check — these span the whole lesson, so reach back across sections:
In the Ali Baba cave, why does repeating the rounds matter?
Check your answer to continue.
Next: cracking open the machine
We’ve been waving at “notes”, “commitments”, “nullifiers”, and “shielded pools” like they’re obvious. They’re not — yet. Time to open the actual Zcash machine.
Next up: addresses, notes, commitments, and nullifiers — the moving parts a shielded transaction is really made of.