A technical breakdown of Nova's incremental computation versus PLONK's universal circuit approach for recursive proof systems.
Nova excels at fast, incremental proof recursion by leveraging a folding scheme for R1CS constraints. This approach avoids the overhead of repeated SNARK verifications within the circuit, enabling linear-time recursion. For example, in benchmarks for proving SHA256 chains, Nova demonstrated recursion overheads of mere milliseconds per step, making it ideal for high-throughput state updates in applications like rollup provers or on-chain gaming.
PLONK takes a different, more general approach by using a universal and updatable trusted setup to verify arbitrary circuits within a single SNARK. This strategy provides immense flexibility for complex, heterogeneous proof composition but introduces higher per-proof computational costs. The trade-off is generality for raw speed; PLONK-based systems like those used by zkEVMs (e.g., Scroll, Polygon zkEVM) can recursively verify entire block executions but with longer proving times measured in minutes.
The key trade-off: If your priority is ultra-low-latency recursion for homogeneous computations (like a verifiable state machine), choose Nova. If you prioritize flexibility to recursively verify diverse, complex logic within a single proof, choose a PLONK-based system. The decision hinges on whether you need specialized speed or general-purpose composability.
Key strengths and trade-offs for recursive proof systems at a glance.
Folding Scheme Efficiency: Nova uses a unique folding scheme to incrementally combine proofs, avoiding the overhead of full verification at each step. This results in ~10x faster recursion for long-running computations like proving state transitions in a zkVM. This matters for high-throughput L2s and on-chain gaming where proving latency is critical.
No Trusted Setup per Circuit: Nova's folding scheme relies on a single, circuit-agnostic Structured Reference String (SRS). This eliminates the need for a new trusted setup for each new program, simplifying deployment. This matters for rapid protocol iteration and teams wanting to avoid the ceremony overhead of PLONK.
Industry Standard Verification: PLONK's verifier is a single, fixed circuit that can verify proofs for any program up to a bounded size. This universal setup (one-time ceremony) is now highly decentralized (e.g., Perpetual Powers of Tau). This matters for interoperability and mainnet deployments where security audits and tooling (Circom, halo2) are mature.
Optimal On-Chain Footprint: After recursive aggregation, a PLONK-based stack (e.g., using SnarkPack or a final Groth16 wrapper) can produce a single, constant-sized SNARK (~1 KB) for the entire computation. This matters for Ethereum L1 settlement where calldata costs dominate and final proof size is the ultimate bottleneck.
Direct comparison of key technical metrics and design trade-offs for recursive proof systems.
| Metric | Nova (IVC) | PLONK (Universal) |
|---|---|---|
Primary Design Goal | Incrementally Verifiable Computation (IVC) | Universal, flexible circuit proving |
Recursion Overhead per Step | ~10ms (folding scheme) | ~2-5 seconds (full SNARK verification) |
Prover Memory for N Steps | O(1) (constant) | O(N) (linear) |
Trusted Setup Required | true (per circuit) | |
Succinct Final Proof | false (requires final SNARK wrap) | |
Primary Use Case | High-frequency state updates (e.g., rollups) | General-purpose ZK applications (e.g., zkEVMs) |
Notable Implementations | Lurk, RISC Zero, Jolt | Aztec, zkSync, Polygon zkEVM |
Direct comparison of key technical metrics for recursive proof systems used in ZK-rollups and validity proofs.
| Metric | Nova (SNARK) | PLONK (SNARK) |
|---|---|---|
Proof Generation Time (1 iteration) | < 100 ms | ~2-5 seconds |
Recursive Overhead per Step | Constant (~10 ms) | Logarithmic (O(log n)) |
Primary Use Case | Incremental Computation (IVC) | General Circuit Verification |
Succinct Proof Size | ~1 KB | ~400-600 bytes |
Trusted Setup Required | ||
Major Adoption | RISC Zero, Lasso | Aztec, zkSync, Polygon zkEVM |
Key strengths and trade-offs for recursive proof systems at a glance. Choose based on your protocol's primary constraint: speed or flexibility.
Folding scheme efficiency: Nova's incremental computation (IVC) avoids repeated verification of the entire proof. This results in ~10x faster recursion than PLONK-based approaches for long-running computations like zkVM state transitions. This matters for high-throughput L2s like Scroll or applications needing real-time proof updates.
Constant-size recursive verifier: The final recursive proof and verification key size remain constant, regardless of iteration count. This leads to lower gas costs for on-chain settlement (e.g., on Ethereum). This matters for protocols like Brevis coProcessors that frequently commit proofs to L1, where gas is the primary cost driver.
Single trusted setup for all circuits: PLONK's universal SNARK (e.g., via Aztec's barretenberg) allows one ceremony to support any circuit up to a fixed size. This enables rapid prototyping and upgrades without new trusted setups. This matters for evolving protocols like Polygon zkEVM that need to frequently update their circuit logic.
Mature developer frameworks: PLONK is integrated into widely-used toolchains like Circom, halo2, and Noir. This provides extensive libraries, debugging tools, and auditor familiarity. This matters for teams prioritizing developer velocity and security, such as those building private DeFi with Aztec.
Requires R1CS structure: Nova's folding scheme works natively with Rank-1 Constraint Systems (R1CS), which can be less intuitive for certain operations compared to PLONK's custom gates. This may increase initial development overhead for complex business logic. This is a trade-off for its speed advantage.
Verification cost scales with recursion: Each recursive step in a PLONK-based stack (e.g., using a SNARK verifier inside a circuit) adds significant proving time and size. This leads to diminishing returns for deep recursion, making it less ideal for applications like continuous proof aggregation in a zkRollup sequencer.
Key strengths and trade-offs at a glance for two leading recursive proof systems.
Incremental Verifiable Computation (IVC): Nova uses folding schemes to aggregate proofs iteratively, avoiding the need for a trusted setup. This makes it exceptionally efficient for long-running computations like proving state transitions in a blockchain or a zkVM.
Limited Proof Expressiveness: Nova's current implementations are optimized for a specific class of computations (e.g., R1CS). For complex, custom logic requiring high-degree constraints, you may need to wrap it in a less efficient circuit or use a different proving system as a final layer.
Universal & Updatable Trusted Setup: PLONK's universal setup (e.g., Perpetual Powers of Tau) supports any circuit up to a bounded size. This flexibility is critical for protocols like zkSync Era and Aztec that deploy many diverse, complex smart contracts.
Higher Per-Step Overhead for Recursion: While PLONK can be made recursive, each recursive step involves verifying a PLONK proof inside a circuit, which is computationally heavy. This makes deep, fast recursion more expensive than Nova's native folding approach.
Choosing between Nova and PLONK for recursive proofs is a decision between specialized performance and universal flexibility.
Nova excels at high-throughput, incremental computation because it leverages folding schemes to avoid expensive SNARK verifications at each step. For example, in a recursive proving benchmark for a zkVM, Nova demonstrated the ability to generate proofs for 10,000 steps in under 2 seconds, significantly outperforming traditional SNARK recursion for long-running computations. Its design is optimal for stateful applications like on-chain games or zk-rollups that require continuous proving of incremental state updates.
PLONK takes a different approach by providing a universal, circuit-agnostic proof system. This results in greater flexibility for complex, one-off proofs but at the cost of higher per-proof overhead. PLONK's widespread adoption in ecosystems like Ethereum (via circuits for zkEVMs) and its support by major tooling (e.g., Circom, halo2) make it the de facto standard for applications requiring interoperability and proof composability across diverse, custom logic.
The key trade-off: If your priority is sheer proving speed and low cost for sequential, repetitive logic (e.g., a zkVM, a verifiable map-reduce), choose Nova. Its folding paradigm minimizes recursive overhead. If you prioritize flexibility, ecosystem support, and proving arbitrary, non-linear circuits (e.g., a custom DEX circuit, a privacy-preserving identity proof), choose PLONK. Its universal setup and robust toolchain are better suited for heterogeneous, standalone applications.
Stop patching. Start engineering. Get a free technical roadmap and a 30min strategy call.