KZG Polynomial Commitment Revocation

Performance analysis of KZG-based credential revocation on Ethereum — gas costs, scalability, and comparison with Merkle-tree baseline.

Hoodi Testnet · EIP-4844 Trusted Setup · BLS12-381
O(1)
KZG Gas Complexity
Independent of credential set size
39,997
Update Gas (constant)
Degrees 2 → 4,096
43,026
Verify Gas (constant)
Degrees 2 → 4,096
0.59 ms
C Backend Verify
verify_kzg_proof
98.2%
Batch Gas Savings
50-credential batch vs individual
4,095
Max Secure Degree
EIP-4844 security bound
KZG Gas — Degree Scaling
Gas consumption for updateCommitment() and verifyNonRevocation() across polynomial degrees 2 – 4,096.
O(1) constant gas: Both operations cost exactly the same regardless of how many credentials are encoded in the polynomial. Gas depends only on the BLS12-381 pairing precompile, not on polynomial degree.
KZG vs. Merkle — Verification Gas
KZG verify gas (flat line) vs. Merkle verifyNonRevocation() gas (scales with tree depth).
Merkle is O(depth): Each additional keccak256 hashing step adds ~906 gas per level. KZG remains at 43,026 gas while Merkle grows from 27,465 (depth 2) to 31,995 (depth 12).
Merkle Batch Revocation Efficiency
Gas cost per individual revocation shrinks dramatically when multiple revocations are batched into a single Merkle root update.
Amortised cost: Batching 100 revocations into one transaction reduces per-credential gas from 30,074 → 301 (99% reduction), since the fixed 30,075 root-update cost is shared across all credentials in the batch.
Revocation Strategy: Manual vs. Scheduled Batch
Total gas for revoking 10, 50, 200, and 1,000 credentials using individual transactions vs. the optimal batch size.
98.2% gas savings at scale: revoking 1,000 credentials individually costs 59.4 M gas; with batch-50 it costs 1.09 M gas — the KZG commitment update is constant regardless of batch size.
C Backend — Off-Chain Proof Generation & Verification Timing
Wall-clock time for key operations measured with CLOCK_MONOTONIC over 10+ runs. Proof generation runs off-chain; only the pairing check hits the EVM.
Sub-millisecond verification: verify_kzg_proof takes 0.59 ms and verify_blob_kzg_proof 1.01 ms on commodity hardware. Commitment generation is ~4.96 ms. Trusted-setup loading (1,003 ms) is a one-time startup cost.
Summary Comparison: KZG vs. Merkle
Property KZG Commitment Merkle Tree
Verify gas complexity O(1) 43,026 gas (constant) O(depth) 27,465 – 31,995 gas
Update gas complexity O(1) 39,997 gas (constant) O(1) 30,075 gas (constant)
Commitment / root size 48 bytes (G1 point) 32 bytes (keccak256 hash)
Proof payload size 160 bytes (constant) 32 × depth bytes (grows)
Cryptographic primitive BLS12-381 pairing (EIP-4844) keccak256 hashing
Security bound ≤ 4,095 credentials per polynomial Unlimited (tree depth scales)
Off-chain verify time 0.59 ms (C backend) Sub-ms (hash chain)
Batch revocation savings Up to 98.2% gas reduction Up to 99% gas reduction
Horizontal scalability Multiple polynomials (unlimited) Larger trees or multiple roots