ZK Hints
Elliptic Curve
Comparison of common elliptic curves used in zero knowledge proofs
SNARK Systems
⭕ Elliptic Curves for ZK
| Name | Family | Security (bits) | Field Size | Pairing | In-Circuit | Used In | Common Pairings |
|---|---|---|---|---|---|---|---|
| BN254 | BN | 100 | 254 | ✅ | ❌ | ZoKrates, SnarkJS, Ethereum (alt_bn128 precompile) | Baby Jubjub |
| BLS12-381 | BLS12 | 128 | 381 | ✅ | ❌ | Ethereum 2.0, Halo2, Arkworks, Zcash | Jubjub |
| BLS12-377 | BLS12 | 128 | 377 | ✅ | ❌ | Aleo, Zexe | Jubjub |
| Pasta (Pallas/Vesta) | Cycle | 128 | 255 | ❌ | ✅ | Halo2, Zcash, Mina | Pasta (Pallas/Vesta)BW6-761 |
| BW6-761 | BW6 | 180 | 761 | ✅ | ❌ | Mina, Gnark | Pasta (Pallas/Vesta) |
| CP6-782 | CP6 | 256 | 782 | ✅ | ❌ | Experimental | - |
| Jubjub | Twisted Edwards | 128 | 255 | ❌ | ✅ | Zcash, Zexe, Filecoin | BLS12-381BLS12-377 |
| Baby Jubjub | Twisted Edwards | 128 | 254 | ❌ | ✅ | Zcash (Sapling), circomlib, Semaphore | BN254 |
| Koala Bear | Prime Field | 31 | 31 | ❌ | ✅ | Plonky3 | - |
| Baby Bear | Prime Field | 31 | 31 | ❌ | ✅ | Plonky3 | - |
| Goldilocks | Prime Field | 32 | ✅ | ❌ | Plonky2, Plonky3 | - |
🔍 Select Your Use Case
Note: Click on a use case below to see recommendations.
I want to use the curve on Ethereum
Only curves supported by Ethereum precompiles are allowed (e.g., alt_bn128).
I want to use Groth16
You need pairing-friendly curves with good Groth16 support and tooling.
I care about long-term cryptographic security
Prefer curves with at least 128-bit or higher security margin.
I want a non-pairing curve
Pairing-free curves are used in systems like Halo2, STARK-like designs, or recursive circuits.
I want to use a curve inside the circuit (e.g., for recursive proof)
You need a curve with efficient in-circuit arithmetic, often non-pairing and cycle-friendly.
I want to use a curve as the outer wrapper for recursion
You need a pairing-friendly curve capable of verifying inner SNARK proofs.