[Gatherer] Groth16·PLONK·STARK 실무자 FAQ: 증명 시스템 선택 기준과 흔한 구현 함정 10선
The article compiles ten frequently asked questions about selecting among Groth16, PLONK and STARK proof systems, covering size benchmarks, verification gas costs, trusted‑setup requirements and key implementation challenges.
Proof Size and Cost Benchmarks
When measuring on‑chain footprint, Groth16 produces proof data of roughly twenty kilobytes per transaction, which translates into a measurable fee differential compared with PLONK’s fifteen‑kilobyte output. The verification gas required for a Groth16 proof hovers around three hundred fifty thousand units on Ethereum, whereas PLONK verification consumes about three hundred thousand units, delivering a clear cost advantage. STARK’s larger proofs, often exceeding forty‑five kilobytes, incur roughly six hundred thousand gas units for verification, making them the most expensive option in terms of computational resources.
Trusted Setup and Security Trade‑offs
Both Groth16 and PLONK require a one‑time trusted ceremony to generate public parameters; any leakage of toxic waste can compromise all subsequent proofs, forcing projects to enforce strict ceremony security. STARK eliminates this step entirely by relying on hash‑based commitments, which are considered quantum‑resistant and free from setup‑related attack vectors. Consequently, the trust model for STARK is transparent but comes with larger proof sizes that increase bandwidth costs.