Protocol Study #6: Proving Without Revealing (zk-SNARKs in Zcash)

​Session 6 of the Zcash Protocol Study Series, a 13-session guided reading of the Zcash Protocol Specification, run as a sub-series of Zcash Engineering Office Hours.

​Topic: §4.1 (Abstract Cryptographic Schemes, centered on §4.1.13, the Zero-Knowledge Proving System) and §4.18 (Zk-SNARK Statements).

​Session 5 closed on the Merkle path: proving your note is in the tree without revealing which one. Session 6 is that trick at full power. A shielded transaction carries a zk-SNARK, a proof that the consensus rules were followed, which the chain verifies without seeing amounts, addresses, or the notes themselves. We read what the spec demands of a proving system (completeness, knowledge soundness, zero knowledge), then open §4.18 and read the actual statements Zcash proves: JoinSplit (Sprout), Spend and Output (Sapling), Action (Orchard).

​The throughline: the public-input / private-witness split in each statement is Zcash's privacy boundary, drawn in math. Everything the chain learns is on the public-input list; everything else stays witness. We also trace why the proving system changed three times (BCTV14 for Sprout, Groth16 for Sapling, Halo 2 for Orchard) and how the trusted setup disappeared along the way.

​Live on the Zcash Global Discord stage. Recorded by Zcash Brazil with Portuguese translation.

​PDF: https://zips.z.cash/protocol/protocol.pdf, we're reading §4.1 and §4.18.

​Catch up on Session 5 (Merkle Trees and How the Chain Remembers): [FILL: Session 5 YouTube URL]

​Full 13-session arc and canonical thread on the Zcash forum: https://forum.zcashcommunity.com/t/protocol-study-series-12-session-guided-reading-of-the-zcash-protocol-specification-starting-april-21/55350

​Hosted by Mark Henderson (@shieldedmark), Shielded Labs.