Post Quantum Zero Knowledge Proofs Lattices

Short answer: A zero-knowledge proof lets a prover convince a verifier that a statement is true without revealing why. Lattice-based zero-knowledge proofs build these on problems believed to resist quantum attack, instead of the number-theoretic assumptions that quantum computers put at risk. The research covered here reports proof systems for lattice-relevant statements, a post-quantum polynomial commitment with smaller proofs than a hash-based baseline at one size, and a construction that adds zero-knowledge to a succinct proof system. These are research papers, not deployed products.

Why lattices

A 2019 paper on efficient lattice-based zero-knowledge says traditional cryptographic schemes based on number-theoretic assumptions are at risk from possible quantum attacks, and that among the alternatives the lattice-based ones appear most promising. Its authors provide zero-knowledge argument systems for matrix-vector and integer relations common in lattice cryptography. They say earlier practical arguments for such relations either had a constant soundness error of 2/3 or a weaker form of soundness in which extraction only shows the prover holds an approximate witness, and that their systems avoid both limitations. They state a small soundness error and a complexity linear in the size of the solution. On that basis they present constructions of a group signature, a ring signature and a range proof protocol, which they report as one to three orders of magnitude more efficient than the state of the art in the standard lattice setting. That is their own comparison.

Polynomial commitments

A polynomial commitment lets a prover commit to a polynomial and later prove it was correctly evaluated at a point. A CRYPTO 2024 paper says these are used in succinct non-interactive arguments of knowledge (SNARKs), which need succinct commitments and evaluation proofs with no preprocessing step. It observes that for plausibly quantum-safe commitments the most efficient constructions rely on weak assumptions such as hash function security, and that earlier lattice-based commitments lagged behind and had no formal analysis against quantum adversaries. The authors propose what they call the first efficient lattice-based polynomial commitment with transparent setup and post-quantum security. The interactive version relies on the standard Module-SIS problem and can be made non-interactive in the random oracle model with the Fiat-Shamir transformation, and they include a knowledge soundness proof against quantum adversaries. For polynomial degree 2^20 they report proofs 2x smaller than the hash-based FRI commitment and 70x smaller than a recent lattice-based construction.

Adding zero knowledge to succinct proofs

A 2026 preprint says that building on LaBRADOR, a Crypto 2023 scheme, state-of-the-art lattice-based proof systems have fast provers and output sizes under 100KB for arbitrarily large statements, which the authors describe as the smallest among post-quantum schemes. Many applications also need witness privacy. The preprint gives what it calls the first concrete construction and implementation adding zero-knowledge to LaBRADOR, by integrating a linear-size zero-knowledge proof from a 2022 paper, and benchmarks several use cases. It extends the LaZer library so others can use the primitives. The use cases it mentions include anonymous credential systems, where users prove possession of a signature without revealing it.

What this does not tell you

These are papers with their own benchmarks and assumptions. Proof sizes and speed depend on the statement and parameters, and the comparisons are the authors' own. Nothing here says a lattice-based zero-knowledge system is in production.

FAQ

What is a zero-knowledge proof?

A way to prove a statement is true without revealing the underlying secret.

Why use lattices?

They are a candidate basis for cryptography that quantum computers are not known to break, per the 2019 paper's framing.

What is a polynomial commitment?

A commitment to a polynomial plus a proof that it evaluates to a claimed value at a chosen point.

How small can these proofs be?

A 2026 preprint reports output sizes under 100KB for the underlying LaBRADOR-based systems, on its own benchmarks.

Are these systems deployed?

These sources are research papers and do not report deployment.