O(1)
KZG Gas Complexity
Independent of credential set size
39,997
Update Gas (constant)
Degrees 2 → 4,096
43,026
Verify Gas (constant)
Degrees 2 → 4,096
0.59 ms
C Backend Verify
verify_kzg_proof
98.2%
Batch Gas Savings
50-credential batch vs individual
4,095
Max Secure Degree
EIP-4844 security bound
KZG Gas — Degree Scaling
Gas consumption for
updateCommitment() and verifyNonRevocation()
across polynomial degrees 2 – 4,096.
O(1) constant gas: Both operations cost exactly the same regardless of how many
credentials are encoded in the polynomial. Gas depends only on the BLS12-381 pairing precompile,
not on polynomial degree.
KZG vs. Merkle — Verification Gas
KZG verify gas (flat line) vs. Merkle
verifyNonRevocation() gas (scales with tree depth).
Merkle is O(depth): Each additional keccak256 hashing step adds ~906 gas per
level. KZG remains at 43,026 gas while Merkle grows from 27,465 (depth 2) to 31,995 (depth 12).
Merkle Batch Revocation Efficiency
Gas cost per individual revocation shrinks dramatically when multiple revocations are
batched into a single Merkle root update.
Amortised cost: Batching 100 revocations into one transaction reduces
per-credential gas from 30,074 → 301 (99% reduction), since the fixed 30,075 root-update
cost is shared across all credentials in the batch.
Revocation Strategy: Manual vs. Scheduled Batch
Total gas for revoking 10, 50, 200, and 1,000 credentials using individual transactions
vs. the optimal batch size.
98.2% gas savings at scale: revoking 1,000 credentials individually costs
59.4 M gas; with batch-50 it costs 1.09 M gas — the KZG commitment update is constant
regardless of batch size.
C Backend — Off-Chain Proof Generation & Verification Timing
Wall-clock time for key operations measured with
CLOCK_MONOTONIC over 10+ runs.
Proof generation runs off-chain; only the pairing check hits the EVM.
Sub-millisecond verification:
verify_kzg_proof takes 0.59 ms
and verify_blob_kzg_proof 1.01 ms on commodity hardware. Commitment generation
is ~4.96 ms. Trusted-setup loading (1,003 ms) is a one-time startup cost.
Summary Comparison: KZG vs. Merkle
| Property | KZG Commitment | Merkle Tree |
|---|---|---|
| Verify gas complexity | O(1) 43,026 gas (constant) | O(depth) 27,465 – 31,995 gas |
| Update gas complexity | O(1) 39,997 gas (constant) | O(1) 30,075 gas (constant) |
| Commitment / root size | 48 bytes (G1 point) | 32 bytes (keccak256 hash) |
| Proof payload size | 160 bytes (constant) | 32 × depth bytes (grows) |
| Cryptographic primitive | BLS12-381 pairing (EIP-4844) | keccak256 hashing |
| Security bound | ≤ 4,095 credentials per polynomial | Unlimited (tree depth scales) |
| Off-chain verify time | 0.59 ms (C backend) | Sub-ms (hash chain) |
| Batch revocation savings | Up to 98.2% gas reduction | Up to 99% gas reduction |
| Horizontal scalability | Multiple polynomials (unlimited) | Larger trees or multiple roots |