Consensys/gnark-crypto

gnark-crypto

gnark-crypto provides efficient cryptographic primitives, in Go.

It is actively developed and maintained by the team ([email protected] | HackMD) behind gnark: a framework to execute (and verify) algorithms in zero-knowledge.

Features

Elliptic curves & pairings

• bn254 (audit report)
• bls12-381 (audit report)
• bls24-317
• bls12-377 / bw6-761
• bls24-315 / bw6-633

Each pairing-friendly curve has a twistededwards companion sub-package for efficient elliptic-curve cryptography in zkSNARK circuits. BLS12-381 also has the bandersnatch companion curve.

Additional non-pairing-friendly curves: secp256r1 (P-256), secp256k1, grumpkin, stark-curve.

Small fields

Small prime fields for STARK-style provers:

• koalabear and babybear — 31-bit fields with AVX-512 and NEON vector kernels; degree-2/4/6 extensions
• mamabear — 49-bit field with AVX-512 IFMA kernels; a degree-3 extension
• goldilocks — 64-bit field; a degree-2 extension
• Each field includes fft, poseidon2, sis (Ring-SIS) and iop; KoalaBear and MamaBear additionally provide the experimental vortex commitment scheme

Signatures & hashing

• ecdsa - ECDSA signatures, on every curve above
• eddsa - EdDSA signatures, on the companion twistededwards curves
• mimc - MiMC hash function using Miyaguchi-Preneel construction
• poseidon2 - Poseidon2 permutation and compression function
• hash - registry of field-typed hash functions

Polynomial commitments & protocols

• kzg - KZG commitment scheme
• mpcsetup - multiparty setup ceremony primitives (MMPORPG)
• shplonk / fflonk - batched polynomial commitment openings
• pedersen - Pedersen vector commitments
• fft - Fast Fourier Transform
• iop - polynomial IOP building blocks (multilinear, quotients, ratios)
• permutation - Permutation proofs
• fiatshamir - Fiat-Shamir transcript builder

Tooling & utilities

• field/generator - Finite field arithmetic code generator (blazingly fast big.Int)
• merkletree - Merkle tree accumulator
• eisenstein / lattice - Eisenstein integer arithmetic and lattice reduction for scalar decomposition

Warning

gnark-crypto is not fully audited and is provided as-is, use at your own risk. In particular, gnark-crypto makes no security guarantees such as constant time implementation or side-channel attack resistance.

To report a security bug, please refer to gnark Security Policy.

gnark-crypto packages are optimized for 64-bit architectures (amd64 with AVX-512 where available, arm64 with NEON) and tested on Linux, macOS and Windows. Pure Go fallbacks are provided for all other platforms.

Audits

See list of audits for gnark and gnark-crypto

Getting started

Go version

gnark-crypto requires Go 1.26 or newer (see go.mod); CI tests against Go 1.26.x.

Install gnark-crypto

go get github.com/consensys/gnark-crypto

Note that if you use go modules, in go.mod the module path is case sensitive (use consensys and not ConsenSys).

Development

Most (but not all) of the code is generated from the templates in internal/generator.

The generated code contains little to no interfaces and is strongly typed with a field (generated by the gnark-crypto/field package). The two main factors driving this design choice are:

1. Performance: gnark-crypto algorithms manipulate millions (if not billions) of field elements. Interface indirection at this level, plus garbage collection indexing takes a heavy toll on perf.
2. Need to derive (mostly) identical code for various moduli and curves, with consistent APIs. Generics introduce significant performance overhead and are not yet suited for high performance computing.

To regenerate the files, see internal/generator/main.go. Run:

go generate ./...

Benchmarks

Benchmarking pairing-friendly elliptic curves libraries

The libraries are implemented in different languages and some use more assembly code than others. Besides the different algorithmic and software optimizations used across, it should be noted also that some libraries target constant-time implementation for some operations making it de facto slower. However, it can be clear that consensys/gnark-crypto is one of the fastest pairing-friendly elliptic curve libraries to be used in zkp projects with different curves.

Citing

If you use gnark-crypto in your research a citation would be appreciated. Please use the following BibTeX to cite the most recent release.

@software{gnark-crypto-v0.22,
  author       = {Gautam Botrel and
                  Thomas Piellard and
                  Youssef El Housni and
                  Arya Tabaie and
                  Gus Gutoski and
                  Ivo Kubjas and
                  Yao J. Galteland},
  title        = {Consensys/gnark-crypto: v0.22.0},
  month        = oct,
  year         = 2026,
  publisher    = {Zenodo},
  version      = {v0.22.0},
  doi          = {10.5281/zenodo.5815453},
  url          = {https://doi.org/10.5281/zenodo.5815453}
}

Versioning

We use SemVer for versioning. For the versions available, see the tags on this repository.

License

This project is licensed under the Apache 2 License - see the LICENSE file for details.