Zero-knowledge proof systems have reached production maturity in 2026, with Groth16, PLONK, and Cairo-based STARKs powering billions in daily transaction volume across Ethereum Layer 2 networks. The selection of a proving system directly determines on-chain gas costs, end-user latency, and security assumptions for any ZK-powered application.
This article presents production benchmarks for the three dominant systems as of August 2026, measuring proving time, verification cost, proof size, and recursion overhead across standardized workloads.
Groth16: The On-Chain Efficiency Leader
Groth16 remains the most efficient ZK-SNARK in terms of proof size and verification time. Production benchmarks on an AMD EPYC 7763 processor, testing a standardized SHA-256 hash preimage circuit with approximately 22,000 constraints, show Groth16 producing a proof of 192 bytes with an Ethereum L1 verification gas cost of approximately 230,000 gas. The proof size remains constant regardless of circuit complexity—a 10-million-constraint computation yields the same 192-byte proof as a 10-thousand-constraint circuit.
Verification time for Groth16 measures 3.1 milliseconds. Proving time scales at O(n log n) where n represents the number of constraints. At 1 million constraints, Groth16 achieves a proving time of 2.1 seconds.
The primary limitation of Groth16 remains its circuit-specific trusted setup requirement. Each distinct computation demands its own trusted setup ceremony. This imposes operational overhead and introduces trust assumptions that some enterprise and government deployments find unacceptable. Groth16 also lacks post-quantum security, as its security relies on elliptic curve pairings vulnerable to Shor’s algorithm.
PLONK: Universal Setup with Moderate Costs
PLONK occupies the middle ground between Groth16 and STARKs across all performance dimensions. The same benchmark circuit produces a proof of 576 bytes with an Ethereum L1 verification gas cost of approximately 320,000 gas. Verification time measures 5.2 milliseconds. At 1 million constraints, PLONK’s proving time reaches 3.8 seconds.
PLONK’s defining advantage is its universal trusted setup. A single ceremony, such as the Powers of Tau, can be reused across all circuits. This eliminates the per-circuit ceremony overhead that burdens Groth16 deployments. However, PLONK still requires a trusted setup and does not provide post-quantum security. The larger proof size translates to higher calldata costs on Ethereum L1 compared to Groth16.
Cairo and STARKs: Transparency at Scale
Cairo-based STARKs operate on fundamentally different trade-offs. The Cairo virtual machine, designed by StarkWare, generates execution traces optimized for STARK proof systems. At 1 million constraints, Cairo achieves a proving time of 14.7 seconds with a proof size of 176 kilobytes. Verification time measures 42 milliseconds.
A raw STARK proof weighs approximately 42 kilobytes and costs roughly 2.5 million gas to verify on Ethereum L1. This represents a 10x cost increase over Groth16 verification. The proof size for STARKs ranges from 40 to 200 kilobytes depending on computation complexity.
Security derives from collision-resistant hash functions and the FRI protocol, not discrete logarithm assumptions. This provides post-quantum security. For large computations exceeding 10^6 steps, STARKs prove faster than SNARKs due to their quasilinear scaling outperforming SNARK linear scaling at high constraint counts.
Recursion Overhead: The Compression Layer
Recursive proof composition enables STARK-based systems to compress large proofs for economical L1 submission. StarkNet addresses the raw STARK verification cost through recursive aggregation: hundreds of STARK proofs aggregate into a single proof, with batch verification costing approximately 500,000 gas.
StarkWare’s S-two prover, introduced in April 2026, represents a significant advancement in recursive proving efficiency. Circuit-based recursion replaces the previous Cairo-based recursive approach. Proving the Cairo verifier previously required approximately 1 minute; proving the circuit verifier now takes 3 seconds—a 95% decrease in latency and computational resource usage. The circuit verifier runs on standard laptops, whereas the Cairo verifier required dedicated machines with substantial memory. S-two produces smaller proofs with lower verification costs.
The STARK-to-SNARK wrapping approach provides another compression pathway. A STARK proof wraps into a Groth16 proof of approximately 260 bytes or a PLONK proof of about 868 bytes for EVM verification, typically costing 270,000 to 300,000 gas. SP1, which uses STARK-to-SNARK wrapping, achieves 768-byte proofs at 350,000 gas while maintaining a transparent setup. The wrapping bottleneck can consume up to 5x the time of the rest of the proving system.
System Selection Framework
No single ZKP system dominates across all performance dimensions. The selection depends on specific application requirements:
- Groth16 suits applications requiring frequent on-chain verification where gas costs dominate the economic model. Examples include high-frequency DeFi operations, on-chain identity verification, and privacy-preserving transfers. The circuit-specific trusted setup imposes operational costs acceptable for fixed, production-stable circuits.
- PLONK serves deployments requiring circuit flexibility without per-circuit ceremonies. Teams iterating on circuit designs benefit from the universal setup. The moderate gas cost increase over Groth16 trades against setup ceremony overhead.
- Cairo and STARKs fit large-scale computations where proving time and transparency outweigh per-proof verification costs. Applications include ZK-rollups processing thousands of transactions per batch, post-quantum security requirements, and deployments where trusted setups present political or regulatory obstacles.
- Recursive aggregation enables STARK-based systems to remain economically viable on Ethereum L1. The S-two prover’s 3-second proving latency and laptop-compatible hardware requirements lower the barrier to decentralized proving. For applications requiring both transparency and economical L1 verification, the STARK-to-SNARK wrapping approach provides a practical production path.
FAQ
Why does Groth16 verification cost less gas than STARK verification on Ethereum?
Groth16 produces a constant 192-byte proof regardless of circuit size, while a raw STARK proof ranges from 40 to 200 kilobytes. Ethereum L1 charges gas based on calldata bytes at approximately 16 gas per non-zero byte. The 10x to 100x difference in proof size directly translates to higher calldata costs for STARK verification.
What is the actual gas cost difference between Groth16, PLONK, and STARK in 2026 production?
How does the S-two prover change STARK recursion overhead?
S-two reduces recursive proving latency from approximately 1 minute to 3 seconds—a 95% decrease. The circuit-based recursion approach eliminates the overhead of using Cairo as a general-purpose language for verification. Proving becomes possible on standard laptops rather than requiring dedicated high-memory machines.
Which proof system should a developer choose for a new ZK application in 2026?
For applications with frequent on-chain verification and fixed circuits, Groth16 provides the lowest gas costs. For circuit flexibility without per-circuit ceremonies, PLONK offers the best balance. For large-scale computations exceeding 10^6 steps, post-quantum security requirements, or deployments where trusted setups are unacceptable, Cairo/STARKs are the appropriate choice.
Are STARKs post-quantum secure, and does that matter for production systems?
Yes, STARKs provide post-quantum security because they rely on collision-resistant hash functions rather than elliptic curve pairings. Groth16 and PLONK are vulnerable to Shor’s algorithm. For applications with long-term data confidentiality requirements, such as government systems or enterprise archives, post-quantum security is a critical differentiator.
