// the find
zcash/halo2
The Halo2 zero-knowledge proving system
Halo2 is ZCash's implementation of a PLONK-based zero-knowledge proving system, specifically the variant that drops trusted setup requirements using inner product arguments. It's the foundation ZCash uses for Orchard, and the go-to starting point if you're building ZK circuits in Rust and want production-battle-tested code rather than a research prototype.
The `MockProver` and circuit layout tooling in `halo2_proofs/src/dev/` are genuinely useful — failure messages tell you which constraint failed and why, which is rare in ZK land where debugging is usually 'proof failed, good luck'. The gadgets library ships working implementations of Poseidon, SHA-256, and Pallas/Vesta ECC operations, so you're not writing those from scratch. The book (under `book/`) covers the math from field arithmetic up through the full protocol — it's one of the better explanations of PLONK arithmetization that exists publicly. Rayon parallelism is wired in by default and the benchmark suite (`benches/`) makes it easy to see where your circuit is actually spending time.
This is ZCash's fork, not the upstream PSE (Privacy & Scaling Explorations) halo2, and the two have diverged significantly — gadgets and circuits written for one don't port cleanly to the other, which fragments the already-thin ecosystem. There's no recursive proof support here; if you want folding schemes or Nova-style recursion you need a different library entirely. The API surface for building circuits (`Chip`, `Layouter`, `Region`) has a steep learning curve with very little hand-holding beyond the one simple example, and the floor planner abstraction adds conceptual overhead that's opaque until you've read the source. No support for newer polynomial commitment schemes like KZG — it's IPA only, which means larger proofs than systems like Plonky2 or Groth16 for the same circuit size.