---
title: "Halo2 with IPA, and Halo2 with KZG"
description: "Halo2 with IPA, and Halo2 with KZG: PLONKish SNARK — two distinct trust models. As Halo2 + IPA — Setup: None. Proof size: Logarithmic."
type: "option"
url: "https://zkpick.com/proof-systems/halo2/"
section: "01 Choosing a proof system"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/proof-systems/halo2.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# Halo2 with IPA, and Halo2 with KZG — *PLONKish SNARK — two distinct trust models*

> Halo2 with IPA, and Halo2 with KZG: PLONKish SNARK — two distinct trust models. As Halo2 + IPA — Setup: None. Proof size: Logarithmic. On-chain verification: Impractical — verifier linear in circuit size. PQ: No. Recursion: Native, via accumulation on a curve cycle. Maturity: Years in production; gadget-layer bug in 2026. As Halo2 + KZG — Setup: Universal, updatable. Proof size: Constant. On-chain verification: Practical. PQ: No. Recursion: Supported. Maturity: Production; central maintenance declining. As Halo2 + IPA — Prover cost profile: MSM-dominated over the Pasta curve cycle; no pairing-curve FFT bottleneck. Peak prover memory: Proportional to circuit size; moderate. Off-chain verifier: Linear in circuit size — tens to hundreds of milliseconds for large circuits. Implementations and maintainers: zcash/halo2 (Electric Coin Company). Where it is measured: Zcash Orchard figures; no neutral suite. As Halo2 + KZG — Prover cost profile: 256-bit-field FFTs over BN254; the largest gadget ecosystem of any PLONKish frontend. Peak prover memory: SRS resident; large circuits need tens of gigabytes. Off-chain verifier: Milliseconds. Implementations and maintainers: privacy-ethereum/halo2 (Ethereum Foundation PSE, maintenance mode), halo2-lib (Axiom), Scroll's fork. Where it is measured: Scroll and Axiom published figures; no neutral suite. Choose it when: IPA: systems verified on a node rather than in a gas-metered contract, where trusted setup is unacceptable. KZG: EVM-verified application circuits and coprocessors needing expressive custom gates.

The same PLONKish frontend with two very different backends. The original uses an inner-product argument over a curve cycle and needs no trusted setup, with recursion via accumulation. The widely used Ethereum-oriented variant replaces IPA with KZG, giving constant-size proofs and a practical Solidity verifier — and a universal trusted setup. These are routinely conflated.

**Strengths**

- The IPA variant needs no trusted setup and has years of deployment in a value-bearing system
- Recursion without pairing-friendly curves, via accumulation on a two-cycle
- The KZG variant gives constant-size proofs and EVM-practical verification
- Rich, expressive frontend with mature circuit libraries for elliptic-curve and hashing work

**Tradeoffs**

- IPA verification is linear in circuit size — that variant is not an EVM settlement candidate
- The KZG variant reintroduces a universal trusted setup, unlike the original — a frequent source of confusion
- Neither is post-quantum
- The ecosystem has fragmented into forks that are not drop-in compatible and have uneven maintenance
- Maturity of the construction does not transfer to its gadget libraries: a counterfeiting bug in the upstream ECC gadget prompted an emergency response in 2026 — check the current status of any deployment cited as evidence

**Choose it when:** IPA: systems verified on a node rather than in a gas-metered contract, where trusted setup is unacceptable. KZG: EVM-verified application circuits and coprocessors needing expressive custom gates.

Maintained by: Halo by Bowe, Grigg and Hopwood (Electric Coin Company, 2019); upstream halo2 maintained by Electric Coin Company. KZG fork by Ethereum Foundation PSE (maintenance mode); halo2-lib by Axiom; further forks at Scroll and others · Maturity: Long production history; forks vary · License: n/a (construction) · Source: https://eprint.iacr.org/2019/1021

**In the proof system selection matrix** (https://zkpick.com/proof-systems/#proof-systems-matrix-halo2-ipa)

| Family | Setup | Proof size | On-chain verification | PQ | Recursion | Maturity |
| --- | --- | --- | --- | --- | --- | --- |
| Halo2 + IPA | None | Logarithmic | Impractical — verifier linear in circuit size | No | Native, via accumulation on a curve cycle | Years in production; gadget-layer bug in 2026 |

**In the proof system selection matrix** (https://zkpick.com/proof-systems/#proof-systems-matrix-halo2-kzg)

| Family | Setup | Proof size | On-chain verification | PQ | Recursion | Maturity |
| --- | --- | --- | --- | --- | --- | --- |
| Halo2 + KZG | Universal, updatable | Constant | Practical | No | Supported | Production; central maintenance declining |

**In the prover profile, implementations and benchmarks** (https://zkpick.com/proof-systems/#proof-systems-matrix-2-halo2-ipa)

| Family | Prover cost profile | Peak prover memory | Off-chain verifier | Implementations and maintainers | Where it is measured |
| --- | --- | --- | --- | --- | --- |
| Halo2 + IPA | MSM-dominated over the Pasta curve cycle; no pairing-curve FFT bottleneck | Proportional to circuit size; moderate | Linear in circuit size — tens to hundreds of milliseconds for large circuits | zcash/halo2 (Electric Coin Company) | Zcash Orchard figures; no neutral suite |

**In the prover profile, implementations and benchmarks** (https://zkpick.com/proof-systems/#proof-systems-matrix-2-halo2-kzg)

| Family | Prover cost profile | Peak prover memory | Off-chain verifier | Implementations and maintainers | Where it is measured |
| --- | --- | --- | --- | --- | --- |
| Halo2 + KZG | 256-bit-field FFTs over BN254; the largest gadget ecosystem of any PLONKish frontend | SRS resident; large circuits need tens of gigabytes | Milliseconds | privacy-ethereum/halo2 (Ethereum Foundation PSE, maintenance mode), halo2-lib (Axiom), Scroll's fork | Scroll and Axiom published figures; no neutral suite |