Polynomial Commitment Schemes from Classical Constructions to Post-Quantum Directions

Abstract

Polynomial commitment schemes (PCS) enable a prover to commit to a polynomial and later reveal evaluations with succinct, verifiable proofs. As critical components of modern cryptographic systems like Verkle trees and zk-SNARKs, these methods are experiencing a significant transition from classical to post-quantum designs. This comprehensive research systematically compares the major scheme families to examine this progression, from pairing-based KZG and transparent Bulletproofs to lattice-based and hash-based post-quantum alternatives. We present a unified taxonomy that maps the classical-to-post-quantum transition across trust models, security assumptions, and efficiency measures after conducting a PRISMA-guided systematic review of 77 works. Our analysis reveals a fundamental trade-off between efficiency and security: classical schemes, which rely on quantum-vulnerable assumptions, provide optimal performance with constant-sized proofs, while post-quantum alternatives offer quantum resistance at the cost of larger proofs and higher computational overhead. By combining research works, we highlight recurrent problems with adaptive security, verification efficiency, and proof conciseness. We offer a specific research roadmap with prioritized short-, medium-, and long-term directions to close the performance gap between quantum-resistant and classical architectures based on our quantitative analysis. This study offers a technical reference and a strategic roadmap for constructing practical post-quantum polynomial commitments.

1. Introduction

In the digital era, it is critical to ensure that a computation is done correctly without releasing sensitive data. Applications like blockchain smart contract validation and private data machine learning depend on this [1]. An essential tool in cryptographic solutions to this issue is a polynomial commitment scheme (PCS) [2]. A prover must produce a brief cryptographic commitment to a polynomial in order for a PCS to function. Then, without disclosing any further details about the polynomial itself, they can publish the polynomial’s value at any given time along with a succinct demonstration that it is accurate and compatible with the original commitment [3]. Significant advances in cryptography are made possible by this potent feature, most notably zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs). By confirming complex program execution in milliseconds at little expense, these technologies offer private and verifiable computing [4,5].

The usefulness of polynomial commitments extends well beyond theory and is a powerful tool for promoting innovation in the real world. Verkle trees, for example, are a novel blockchain data structure that requires them. Unlike classic structures that employ straightforward hashes, Verkle trees use polynomial commitments to provide proofs that expand very slowly, barely logarithmically, with the amount of data [6]. This is a significant advancement in blockchain scalability. It is crucial for “stateless clients” to function with the least amount of bandwidth and data storage in networks like Ethereum [7]. Beyond blockchains, polynomial commitments are required for verified secret sharing, a technique that permits a secret to be safely shared among a group without the requirement for a single trusted authority [8]. These applications all depend on two essential features of a good polynomial commitment scheme: conciseness (the commitment and proofs are reasonably short) and efficiency (proving a proof is computationally quick) [9].

However, there will be a significant disruption in the field of cryptography. The security of our current digital systems is seriously threatened by the emergence of large-scale quantum computers [10]. This is because a quantum method called Shor’s algorithm may be able to readily overcome the mathematical obstacles that guarantee the security of today’s most widely used encryption systems, such RSA and Elliptic Curve Cryptography [11]. On a quantum computer, Shor’s algorithm solves discrete logarithm and integer factorization problems in polynomial time. The discrete logarithm assumption and its variations, which make conventional polynomial commitment systems like KZG and Bulletproofs insecure in the presence of a large-scale quantum adversary, are directly threatened by this.

The most effective polynomial commitment methods now in use are directly impacted by this weakness. For instance, the well-known KZG approach, which is renowned for its quick verification and compact proofs, is based on a problem that quantum computers can handle [12]. Another popular strategy that does not require a trustworthy environment and is susceptible to quantum attacks is bulletproofing [13]. Because of this, researchers are working rapidly to create post-quantum cryptography, a new class of secure instruments that can survive the might of quantum computers.

Novel secure polynomial commitment algorithms have been extensively researched due to the growing need for quantum-resistant encryption [14]. Both conventional and quantum computers are thought to find it challenging to address the mathematical problems underlying these post-quantum alternatives. For instance, the difficulty of learning with errors (LWE) [15,16] and Short Integer Solution (SIS) problems, which require locating short vectors in high-dimensional, complex lattices [17,18], are the foundation for the security of lattice-based systems like Brakedown and Orion. The collision-resistance of cryptographic hash functions, which are represented as random oracles, is the only source of security for hash-based methods such as the Fast Reed-Solomon Interactive Oracle Proof of Proximity (FRI) protocol, which forms the basis of zk-STARKs [19,20]. Groups of undetermined order and multivariate-based assumptions are two further mathematical foundations for post-quantum commitments that are being studied [21]. A major barrier to the broad implementation and practical acceptance of these quantum-resistant schemes is their propensity to have significantly larger proof volumes and higher computing overhead than classical systems [22].

A Taxonomy of Polynomial Commitment Schemes

We can categorize polynomial commitment schemes according to their fundamental security presumptions and trust requirements in order to clarify the field. The primary lines of development are mapped by this classification, which is displayed in Figure 1. The primary difference is between post-quantum schemes, which are based on problems believed to be challenging even for quantum computers, and classical schemes, which are based on mathematical problems that quantum computers can solve.

One significant distinction within the classical category is the setup requirement. In order to generate its parameters, the highly effective KZG scheme needs a trusted setup, which calls for a one-time secure ceremony [23]. In contrast, schemes such as Bulletproofs [24] and DARK [25] are more practical and secure in some scenarios because to their transparent configuration, which reduces the requirement for trust during startup.

There are two most noteworthy families on the post-quantum horizon. The first are lattice-based systems, such as Brakedown and other Lattice SNARKs whose security is determined by the complexity of problems such as Learning with Errors (LWE) and Short Integer Solution (SIS) [26,27]. Second, there are hash-based systems, such as Polaris and the FRI protocol (used in zk-STARKs), that rely entirely on the properties of cryptographic hash functions for security [28]. This taxonomy makes it easier to organize existing research and uncover prospective new schemes that combine the best features of different branches.

In Figure 1 we have hierarchical classification of major polynomial commitment schemes, categorized by their security foundation and trust model.

The security of the DARK system relies on groups of unknown order, which makes it classical. Unlike KZG and Bulletproofs, DARK does not rely on discrete logarithms. Instead, quantum algorithms that can determine group orders, like Shor’s algorithm, can exploit groups of unknown order. The DARK security proof has also been shown to have flaws by recent cryptanalysis. Thus, security following quantum computing is not provided by DARK.

The evolution of these scheme families over time is illustrated in Figure 2, showing the field’s progression from classical to post-quantum constructions.

Because this subject is so complicated and fast-paced, there is an evident need for a resource that brings everything together. This study aims to serve as an invaluable reference by providing a comprehensive map of polynomial commitments, from their classical roots to the most current post-quantum research. We will conduct a rigorous and complete investigation of the area, beginning with a precise formal framework for understanding how these schemes operate and their security aspects. In this examination, we will look at the underlying processes, benefits, and downsides of major classical schemes including KZG, Bulletproofs and DARK.

A comprehensive investigation of post-quantum constructs, analyzing the many methodologies based on lattices, hashes, and other mathematical underpinnings, will be a key focus. A comprehensive comparison of various schemes will be presented to provide a practical perspective, evaluating them based on crucial characteristics such as computational cost, commitment size, proof size, and trust needs. Finally, by identifying the remaining gaps and unresolved concerns, this study will not only offer an overview of the current state of the art, but will also recommend a future research agenda that will aid in the development of the necessary safe and effective systems.

This research’s main goal is to present a thorough and methodical examination of the state-of-the-art in polynomial commitment schemes, with a focus on the shift to post-quantum security. Our particular objectives are:

• To review and compile the vast amount of literature on post-quantum and classical polynomial commitments.
• To find and group the most relevant papers, giving them a ranking according to citations, scientific significance, and usefulness.
• To evaluate the trade-offs in performance across various paradigms (proof size, prover/verifier time, setup requirements).
• To determine important research gaps and unanswered concerns in the discipline, especially with regard to composability, efficiency, and security.
• To offer a guide for upcoming studies that will try to make polynomial commitments workable in the post-quantum age.

This study provides the following:

• We conduct a systematic review using PRISMA-inspired search transparency, ensuring a reproducible and unbiased selection of 77 core papers from an initial corpus of 654.
• We provide a unified taxonomy (Figure 1) and horizontal timeline (Figure 2) that map the evolution from classical KZG to post-quantum lattice-based and hash-based constructions.
• We present comprehensive comparative tables that quantify the trade-offs between proof size, verifier time, prover time, setup assumptions and security guarantees.
• We identify persistent open problems and based on our analysis, propose a prioritized research roadmap to guide future efforts toward practical post-quantum polynomial commitments.

The remainder of the paper follows this format. Section 2 details the research methodology employed for this systematic review. Polynomial commitments are defined and given a formal structure in Section 3. Section 4 examines classical schemes, whereas Section 5 examines post-quantum structures. An examination of the most important designs is presented in comparison in Section 6. In Section 7, the research topics and the extent to which this review achieves its goals are discussed. Finally, Section 8 brings the paper to its conclusion.

2. Research Methodology

To ensure a thorough and objective literature selection, this survey adhered to PRISMA standards [29]. While rooted in medical sciences, PRISMA’s methodology effectively applies to cryptography, addressing selection bias in a vast research landscape. This approach guarantees transparency and reliability in selected literature. The PRISMA checklist is detailed in Section 2.4, and the selection process flow diagram is presented in Section 2.5. The methodology involved three stages: formulating research questions, retrieving relevant materials from selected academic sources, and applying strict inclusion and exclusion criteria.

2.1. Research Questions

The following study issues led the literature selection and subsequent analysis, which addressed the conceptual, technical, and practical aspects of polynomial commitment schemes:

• What are the foundational and most influential works in the development of polynomial commitment schemes?
• What are the current research trends in post-quantum polynomial commitments and what performance trade-offs do they introduce?
• What are the known limitations, open problems and unresolved challenges in existing schemes?
• What is the conceptual, scientific and practical significance of the reviewed research landscape?

2.2. Research Process

We gathered research articles from scholarly search engines and significant scientific databases. The ACM Digital Library, arXiv, IEEE Xplore, SpringerLink, Scopus, and Google Scholar were among the key sources (for a complete list, see

Table 1. Reference Scientific Literature Databases and Academic Search Engines.

Database/Search Engine	Type	URL
Scopus	Search Engine	https://www.scopus.com (accessed on 16 April 2026)
Google Scholar	Search Engine	https://scholar.google.com (accessed on 16 April 2026)
IEEE Xplore	Digital Library	https://ieeexplore.ieee.org (accessed on 16 April 2026)
ACM Digital Library	Digital Library	https://dL.acm.org (accessed on 16 April 2026)
SpringerLink	Digital Library	https://link.springer.com (accessed on 16 April 2026)
arXiv	Preprint Repository	https://arxiv.org (accessed on 16 April 2026)

). Several essential concepts were used in the search approach, including “polynomial commitment”, “KZG”, “post-quantum commitment”, “vector commitment”, “lattice-based SNAR”, “zk-STARK”, “transparent setup” and “Verkle tree”.

This broad search strategy ensured comprehensive coverage of both established conference proceedings and emerging preprint research, which is particularly important in the fast-moving field of post-quantum cryptography.

2.3. Inclusion and Exclusion Criteria

In this study, survey articles were evaluated based on predefined inclusion and exclusion criteria. Articles that did not meet these criteria were disregarded. The focus is primarily on publications post-2010, although significant earlier works are also acknowledged. The filtering process included three steps: First, irrelevant articles were excluded based on titles and abstracts, retaining those meeting at least 50% relevancy. Next, the remaining articles underwent a full text evaluation, discarding superficial or out-of-scope works. Finally, a quality review ensured that each paper thoroughly presented technological solutions, detailed security proofs, or fresh theoretical constructs regarding polynomial commitments, with results provided for evaluation.

Table 2. Inclusion and Exclusion Criteria.

Inclusion Criteria	Exclusion Criteria
Published in one of the selected databases (Table 1)	Not written in English
Published in or after 2010	Only partially related to polynomial commitments
At least one search term appears in the title, abstract, or keywords	Full text not available
Addresses or analyzes the stated research questions	Lacks technical detail or is a duplicate of another study
Published in peer-reviewed journals, conference proceedings, or reputable preprint servers

details the official criteria for inclusion and exclusion.

Table 2 provides a summary of the official inclusion and exclusion criteria.

2.4. PRISMA Study Selection Flow Diagram

As shown in Figure 3, the methodical literature selection procedure adhered to the PRISMA 2020 requirements. Initially, 654 documents were found by searching six significant academic databases and preprint sites. Following the removal of 78 duplicates, 576 records were screened using abstracts and titles; 422 of these were eliminated because they were deemed irrelevant to the study topics. Table 2’s inclusion criteria were used to determine the eligibility of the remaining 154 full-text publications. A total of 77 papers were included in the final systematic review after meeting all the requirements.

2.5. PRISMA Checklist Compliance

This evaluation adheres to the PRISMA 2020 reporting requirements. A simplified checklist that outlines the locations of each mandatory reporting item is provided in

Table 3. PRISMA 2020 Checklist for This Systematic Review.

PRISMA Item	Description	Location in Article
Title (1)	Identify as systematic review	Title page
Abstract (2)	Structured summary	Abstract
Introduction (3–4)	Rationale and objectives	Section 1 and Section 2.1
Methods (5–10)	Eligibility, sources, search, selection, data	Section 2.2, Section 2.3 and Section 2.4, Table 1 and Table 2
Methods (12–14)	Synthesis, heterogeneity, certainty	Section 4, Section 5, Section 6, Section 7.1, Section 7.2 and Section 7.3
Results (15–16)	Study selection and citation	Section 2.4, References
Results (18–20)	Findings and synthesis results	Section 4, Section 5, Section 6, Section 7.1 and Section 7.2
Discussion (22–25)	Interpretation and implications	Section 8 and Section 9
Other (26)	Funding	Funding statement
Other (27)	Registration	Section 2.6

. Items (11, 17, 21) of statistical meta-analyses do not apply to narrative reviews such as this one.

2.6. Protocol Registration

This systematic review was retrospectively registered in the Open Science Framework (OSF) registry. The registration, contains the review title and scope (registration available at: https://osf.io/uf34p/ (accessed on 16 April 2026)). In this publication, Section 2.1, Section 2.2, Section 2.3, Section 2.4 and Section 2.5 provides comprehensive methodological information, including the search strategy, inclusion/exclusion criteria, and analytical processes.

The corpus of 77 publications produced by the methodical procedure mentioned above served as the foundation for the comparative analyses in Section 4, Section 5, Section 6 and Section 7, the historical chronology in Figure 2, and the taxonomy classification in Section A Taxonomy of Polynomial Commitment Schemes. The next sections of the study address each of the research questions (Section 2.1):

• RQ1 (foundational literature) is addressed in Section 4 (classical schemes) and Section 5 (post-quantum schemes).
• RQ2 (current trends and trade-offs) is addressed in Section 5 and Section 6 and the comparative analysis in Section 7.
• RQ3 (shortcomings and open issues) is addressed in Section 7.3 (Security Analysis, Research Directions).
• RQ4 (significance of the research scope) is addressed in Section 6 (Applications) and Section 8 (Research Questions and Degree of Accomplishment).

3. Framework and Definitions

A polynomial commitment scheme is a cryptographic primitive protocol that allows a prover to commit to a polynomial and then later reveal its evaluation at a specific point, along with a proof that the evaluation is correct consistent with the original commitment. A verifier can check this proof against the initial commitment Without learning anything else about the polynomial, the verifier may compare this proof to the first commitment. This primitive is a fundamental and necessary component of modern succinct zero-knowledge proof systems, such as zk-STARKs and zk-SNARKs [30].

Formally, a polynomial commitment scheme for a field $\mathbb{F}$ and a family of polynomials $\mathcal{F}$ is defined by a tuple of four probabilistic polynomial-time (PPT) algorithms:

• Setup $\left(1^{\lambda },n\right)\to crs$: The inputs for this probabilistic polynomial-time (PPT) approach are a maximum degree bound (n) and a security parameter (λ). The common reference string ($crs$) is one of the public parameters that it outputs. How these parameters are obtained is a crucial difference across methods. Certain protocols need a trusted setup in which parameters are generated via a ceremony that produces “toxic waste” that needs to be eliminated in order to preserve security [31]. The system as a whole is vulnerable if it is hacked. Other techniques involve no confidence in any one party and have a transparent setup where parameters are produced from public randomness [32].
• Commit $(crs,f(X\left)\right)\to com$: This algorithm takes the public parameters, common reference string $crs$ and a polynomial $f\left(X\right)\in \mathcal{F}$ of degree at most $n$ as input. It outputs a commitment string $com$, that binds the prover to the polynomial $f\left(X\right)$.
• Open $(crs,f(X),z)\to \pi$: This algorithm produces a proof $\pi$ attesting to the accuracy of the evaluation $y=f\left(z\right)$ given the public parameters, common reference string $crs$, the polynomial $f\left(X\right)$, and a point $z\in \mathbb{F}$.
• Verify $(crs,com,z,y,\pi )\to \{0,1\}$: This deterministic algorithm requires a proof $\pi$, a claimed value $y$, a point $z$, a commitment $com$, and a common reference string $crs$. It outputs 1 (if it is accepted) if the proof verifies that $y$ is the correct evaluation of the committed polynomial at $z$. Otherwise, it outputs 0.

Secure polynomial commitment scheme must satisfy three fundamental properties.

This property ensures that an honest prover can always generate a valid proof that an honest verifier will accept. For any polynomial $f\left(X\right)$ of degree at most $n$, any point $z\in \mathbb{F}$, and any public parameters, common reference string $crs$, produced by $\mathrm{S}\mathrm{e}\mathrm{t}\mathrm{u}\mathrm{p}\left(1^{\lambda },n\right)$, the following holds with probability 1:

$$\mathrm{V}\mathrm{e}\mathrm{r}\mathrm{i}\mathrm{f}\mathrm{y}(crs,\mathrm{C}\mathrm{o}\mathrm{m}\mathrm{m}\mathrm{i}\mathrm{t}(crs,f\left(X\right)),z,f(z),\mathrm{O}\mathrm{p}\mathrm{e}\mathrm{n}(crs,f\left(X\right),z\left)\right)=1.$$

(1)

The verifier’s security is guaranteed by the binding property. This property protects the verifier by ensuring a computationally bounded prover cannot open the same commitment to two different values at the same point. Formally speaking, if the following probability is negligible in the security parameter $\lambda$ for any probabilistic polynomial-time adversary $\mathcal{A}$, then the scheme is computationally binding:

$$\mathrm{P}\mathrm{r}\left[\begin{array}{l}\mathrm{c}\mathrm{r}\mathrm{s}\leftarrow \mathrm{S}\mathrm{e}\mathrm{t}\mathrm{u}\mathrm{p}\left(1^{\lambda },n\right);\\ \left(\mathrm{c}\mathrm{o}\mathrm{m},z,y,\pi ,y^{\prime },{\pi }^{\prime }\right)\leftarrow A\left(\mathrm{c}\mathrm{r}\mathrm{s}\right);\\ y\ne y^{\prime }\wedge \mathrm{V}\mathrm{e}\mathrm{r}\mathrm{i}\mathrm{f}\mathrm{y}(\mathrm{c}\mathrm{r}\mathrm{s},\mathrm{c}\mathrm{o}\mathrm{m},z,y,\pi )=1\\ \wedge \mathrm{Verify} \left(\mathrm{c}\mathrm{r}\mathrm{s},\mathrm{c}\mathrm{o}\mathrm{m},z,y^{\prime },{\pi }^{\prime }\right)=1\end{array}\right]\le \mathrm{n}\mathrm{e}\mathrm{g}\mathrm{l}(\lambda ).$$

(2)

Here $Pr$ means probability, $crs$ is the common reference string, $\mathcal{A}$ is a probabilistic polynomial-time adversary, Setup is the setup algorithm with inputs security parameter $\lambda$ and degree bound n, and $\mathrm{n}\mathrm{e}\mathrm{g}\mathrm{l}\left(\lambda \right)$ is a negligible function (a function that becomes extremely small faster than 1 divided by $\lambda$ to any power).

Although it is not necessarily required, the concealing condition ensures that no information about the committed polynomial $f\left(X\right)$ is revealed by the commitment $\mathrm{c}\mathrm{o}\mathrm{m}$. For example, certain successful techniques, like the basic KZG construction, may be made to hide even if they are not by nature by adding a random blinding polynomial to the commitment before publishing [33,34].

The performance of these schemes is evaluated using a number of important metrics, including prover time, verifier time, commitment size, and proof size $\left(\right|\pi \left|\right)$. The ideal objective is to minimize trust assumptions while achieving small, constant-sized commitments and proofs $\left(O\right(1\left)\right)$ with fast, constant-time verification $\left(O\right(1\left)\right)$ and efficient prover time $\left(O\right(n)$ or $O(n\mathrm{l}\mathrm{o}\mathrm{g} n))$, No single plan can accomplish all of these goals at once, as we will see in the sections that follow. As a result, there is a wide variety of constructions with various trade-offs between security, trust, and efficiency.

Extended Security Properties

Polynomial commitments used in blockchain protocols and zero-knowledge proof systems require additional security qualities in addition to completeness, binding, and concealment. The three most crucial traits are listed below.

Extractability: A polynomial commitment scheme is said to be extractable if there is an extractor that can get the original polynomial for every probabilistic polynomial-time adversary that generates valid evidence for an evaluation. This ensures that the prover truly “knows” the polynomial.

Adaptive Security: If the adversary may select the evaluation point after viewing the commitment, the method is considered adaptively secure. The adversary in the adaptive security game first obtains the commitment, then selects a point and asserts a value in an attempt to create a fake proof. This mimics real-world scenarios when challenge points are chosen at random after commitment.

Universal Composability (UC): If a polynomial commitment scheme remains secure when used concurrently with any other protocol, it is UC-secure. According to the UC framework, the scheme’s ideal performance must be identical to a real-world implementation in any setting. Hash-based schemes, like FRI, often only provide security on their own, while most pairing-based schemes, like KZG, include UC-secure versions.

4. Classical Pre-Quantum Schemes

Prior to the urgent push for quantum resistance, the field of polynomial commitments was dominated by a few highly efficient schemes whose security relies on number-theoretic assumptions that are vulnerable to Shor’s algorithm. These classical constructions remain profoundly influential due to their exceptional performance and are actively deployed in systems where quantum adversaries are not yet an immediate threat. This section delves into the mechanisms, advantages, and critical limitations of the three most significant classical schemes: the pairing-based KZG commitment, the discrete-logarithm-based Bulletproofs and the group-of-unknown-order-based DARK scheme.

One of the most influential polynomial commitment schemes is the construction by Kate, Zaverucha, and Goldberg, commonly known as KZG. The elegance of KZG lies in its use of bilinear pairings and polynomial algebra to achieve optimal efficiency. The scheme requires a trusted setup to generate a common reference string ($\mathrm{c}\mathrm{r}\mathrm{s}$). This process involves sampling a secret trapdoor $s$ uniformly at random from ${\mathbb{Z}}_p^{\mathrm{*}}$ and then publishing the $\mathrm{c}\mathrm{r}\mathrm{s}$ as a series of elliptic curve points in groups ${\mathbb{G}}_1$ and ${\mathbb{G}}_2$ that form a bilinear pairing $e:{\mathbb{G}}_1\times {\mathbb{G}}_2\to {\mathbb{G}}_T$. For a maximum degree bound $n$, $\mathrm{c}\mathrm{r}\mathrm{s}$ is:

$$\mathrm{c}\mathrm{r}\mathrm{s}=\left((g,g^s,g^{s^2},\dots ,g^{s^n})\in {\mathbb{G}}_1^{n+1};(h,h^s,h^{s^2},\dots ,h^{s^n})\in {\mathbb{G}}_2^{n+1}\right)$$

(3)

The critical requirement is that the trapdoor $s$ must be permanently deleted after this ceremony. To commit to a polynomial $f\left(X\right)=\sum _{i=0}^n a_i{X}^i$, the prover computes the commitment as:

$$\mathrm{c}\mathrm{o}\mathrm{m}=g^{f\left(s\right)}=\prod _{i=0}^n {\left(g^{s^i}\right)}^{a_i}$$

(4)

which is a single element in ${\mathbb{G}}_1$. To prove that $f\left(z\right)=y$ for a point $z$, the prover computes the quotient polynomial $q\left(X\right)=\left(f\right(X)-y)/(X-z)$ and provides the proof $\pi =g^{q\left(s\right)}$. The verifier checks the pairing equation:

$$e\left(\mathrm{c}\mathrm{o}\mathrm{m}\cdot g^{-y},h\right)\stackrel{?}{=}e\left(\pi ,h^s\cdot h^{-z}\right)$$

(5)

This verification requires only a constant number of group operations, making it extremely fast. The entire protocol yields constant-sized commitments and proofs, a property that has made KZG the “gold standard” for performance [35]. However, its security relies on the $n$-Strong Diffie-Hellman ($n$-SDH) assumption, a variant of the discrete logarithm problem that is completely broken by quantum adversaries [36]. Furthermore, since anyone with knowledge of s can create false proofs, the requirement for a secure, trusted setup is a major logistical challenge and a possible point of failure.

In response to the trust issues inherent in KZG, Bünz et al. developed Bulletproofs, a suite of protocols that includes a polynomial commitment scheme without requiring a trusted setup [37]. Bulletproofs operates in a discrete logarithm setting over a group $\mathbb{G}$ of prime order $p_s$ relying on the standard discrete logarithm assumption. The scheme is transparent, meaning its public parameters consist of randomly chosen group generators, requiring no secret trapdoor. A polynomial $f\left(X\right)$ is committed by first expressing it in terms of its coefficient vector. The core of the Bulletproofs opening protocol is an efficient inner product argument that allows the prover to convince the verifier that the committed coefficients satisfy the linear relation $f\left(z\right)=y$ without revealing the entire vector. This results in a proof size that is logarithmic in the degree $n$ of the polynomial, specifically $O\left({\mathrm{l}\mathrm{o}\mathrm{g}}_2 n\right)$. This is a significant improvement over naive linear-sized proofs, even though it is larger than KZG’s constant-sized proofs. Beyond the larger proof size, the main disadvantage is the verification time, which is linear in degree $n,O\left(n\right),$ which makes it less appropriate for applications involving very high-degree polynomials. Furthermore, it is a prequantum scheme because, like KZG, its security relies on an assumption (the discrete logarithm problem) that is susceptible to quantum attacks.

In addition to Bulletproofs, alternative transparent polynomial commitment systems based on inner product arguments (IPA) have been developed. The IPA method is expanded upon by the Halo scheme to enable recursive proof synthesis. This implies that a trusted setup is not required in order to aggregate various proofs. These IPA-based techniques have comparable trade-offs as Bulletproofs: verification times grow linearly while proof volumes expand logarithmically. Like Bulletproofs, they rely on discrete logarithm assumptions, making them susceptible to quantum assaults.

The Diophantine Argument of Knowledge (DARK) compiler is a third innovative technique that constructs polynomial commitments using groups of unknown order, such as an RSA group or a class group of an imaginary quadratic field. DARK’s security is based on the adaptive root assumption and the low order assumption inside these groups. DARK has a translucent configuration, just like Bulletproofs. Its ability to create constant-sized proofs, or $O\left(1\right)$, without a trusted setup is one of its key benefits over other classical techniques [38]. Verification time is linear $O\left(n\right)$, and prover time is quasilinear $O(n\mathrm{l}\mathrm{o}\mathrm{g} n)$. The prover can show that $f\left(X\right)-y$ is divisible by ($X-z$) within the exponent of the group operation thanks to the intricate construction, which makes use of the Chinese Remainder Theorem and integer encodings of polynomials [39]. Additionally, the cryptographic community has less experience and standardization around groups of unknown order than others, and group operations in these groups generally perform slower than in the elliptic curve groups used by KZG and Bulletproofs.

In conclusion, the three properties of proof size, verification time, and trust assumptions are crucially traded off to define the terrain of classical polynomial commitments. KZG requires a reliable setup but produces the best proof size and verification time. The trusted setup is eliminated by bulletproofs, but at the expense of linear verification time and logarithmic proof size. With constant-sized proofs and no trusted setup, DARK provides a special place in this design space; however, it has linear verification and less certain post-quantum security. The search for the post-quantum schemes covered in the next section has been motivated by the common flaw that their underlying assumptions are susceptible to quantum attacks.

The three most important pre-quantum polynomial commitment schemes covered in this section are summarized in

Table 4. Comparison of Classical Polynomial Commitment Schemes.

Scheme	Underlying Assumption	Setup	Proof Size	Verifier Time	Prover Time	Key Advantage	Key Disadvantage
KZG	n-Strong Diffie-Hellman (n-SDH) in bilinear groups	Trusted	$\mathrm{O}\left(1\right)$ ($\approx 48–192$ bytes)	$\mathrm{O}\left(1\right)$ (constant number of pairings)	$\mathrm{O}\left(\mathrm{n}\right)$	Optimal succinctness; constant-sized proofs and fast verification	Requires trusted setup; quantum-vulnerable (discrete logarithm based)
Bulletproofs	Discrete logarithm (DL) in prime-order groups	Transparent	$\mathrm{O}(\mathrm{l}\mathrm{o}\mathrm{g} \mathrm{n})(\approx 1–3 \mathrm{K}\mathrm{B}$ for $\mathrm{n}=2^{20}$	O(n) (linear in polynomial degree)	$\mathrm{O}(\mathrm{n}\mathrm{l}\mathrm{o}\mathrm{g} \mathrm{n})$	No trusted setup; transparent parameters	Linear verification time; larger proofs than KZG; quantum-vulnerable
DARK	Adaptive root assumption + low order assumption in groups of unknown order	Transparent	$\mathrm{O}\left(1\right)$ (constant-sized)	$\mathrm{O}\left(\mathrm{n}\right)$ (linear)	$\mathrm{O}(\mathrm{n}\mathrm{l}\mathrm{o}\mathrm{g} \mathrm{n})$	Constant-sized proofs without trusted setup	Linear verification; less studied assumptions; slower group operations; no post-quantum security

to give a clear and succinct picture of the classical landscape. Every system has a unique place in the design space, striking a balance between security, efficiency, and trust presumptions. Although KZG requires a trusted setup and is susceptible to quantum adversaries, it provides maximum succinctness with constant-sized proofs and constant-time verification. Bulletproofs incur a price with logarithmic proof sizes and linear verification time, but they do away with the trusted setup through transparency. DARK uses groups of unknown order to produce constant-sized proofs without the need for trusted setup, but it still uses linear verification and no post-quantum security.

The underlying security assumptions, setup requirements, proof size, verifier time, prover time and their corresponding benefits and drawbacks are all compared in this table.

5. Post-Quantum Polynomial Commitment Schemes

A paradigm shift in cryptography has been required due to the imminence of quantum computation, which has prompted the creation of schemes based on mathematical problems thought to be challenging for both classical and quantum computers. To be thorough, we point out that although transparent IPA-based methods like Halo exist in the classical realm, their reliance on discrete logarithm assumptions renders them non-post-quantum safe. In the case of polynomial commitments, this has resulted in novel constructions that substitute lattice-based problems, the collision-resistance of cryptographic hash functions, and other intricate algebraic problems for discrete logarithm and pairing-based assumptions. These post-quantum schemes offer the crucial feature of long-term security in a post-quantum world, but they also entail distinct performance trade-offs by nature, frequently leading to larger proof sizes and higher computational costs in comparison to their classical counterparts.

Lattice-based cryptography is one of the most promising and thoroughly studied postquantum security techniques. The security of these methods is based on the difficulty of tasks such as Learning with Errors (LWE) and the Short Integer Solution (SIS), which involve finding short vectors in high-dimensional lattices. A basic lattice-based architecture that may be adjusted for polynomial commitments was suggested by Peikert et al. [40].

In this paradigm, the common reference string $crs$ often consists of one or more random matrices. To commit to a polynomial $f\left(X\right)$ with coefficient vector $\overrightarrow{f}$, the commitment $\mathrm{c}\mathrm{o}\mathrm{m}\mathrm{m}$ is computed as $\mathrm{c}\mathrm{o}\mathrm{m}=\mathrm{A}\overrightarrow{f}+\overrightarrow{e}\mathrm{m}\mathrm{o}\mathrm{d}q$, where $\mathrm{A}$ is a random matrix from the crs and $\overrightarrow{e}$ is a small error vector. The evaluation proof $\pi$ for $f\left(z\right)=y$ involves demonstrating knowledge of a short vector $\overrightarrow{f}$ that satisfies this relation and the evaluation constraint. The Brakedown scheme is a prominent example that leverages tensor products of linear-time encodable error-correcting codes to build its commitment scheme.

While offering transparent setup and plausible quantum resistance, these lattice-based approaches typically produce larger proofs, on the order of hundreds of kilobytes, and have verification times that are logarithmic in the degree $n,O(\mathrm{l}\mathrm{o}\mathrm{g} n)$. Subsequent work, such as the Orion protocol, aimed to achieve linear prover time and logarithmic proof size [41]. Its original soundness proof was found to have a flaw, though, which prompted a revision that keeps its asymptotic efficiency while modifying the concrete parameters [42]. This procedure demonstrates the intricacy and continuous advancement of this subfield.

An alternative and highly robust approach to post-quantum security utilizes only the properties of cryptographic hash functions, modeled as random oracles. The most prominent examples in this category are schemes built around the FRI protocol, which forms the core of zk-STARKs. In an FRI-based polynomial commitment, the prover first computes the evaluation of the polynomial $f\left(X\right)$ over a large domain and constructs a Merkle tree whose leaves are these evaluations; the root of this tree serves as the commitment $com$. A Merkle tree is a hash-based data structure where each non-leaf node is the hash of its children, enabling efficient verification of data using proofs of size $O(\mathrm{l}\mathrm{o}\mathrm{g} n)$. A Verkle tree generalizes this concept by using vector commitments (often derived from polynomial commitments) instead of simple hash functions. This makes it possible for a single commitment to demonstrate the existence of several data items at once, resulting in significantly reduced proof sizes, which is a crucial feature for blockchain scaling applications like stateless clients.

The prover and verifier then engage in a multi-round interactive protocol where the verifier challenges the prover to commit to progressively smaller related polynomials. This process, made non-interactive via the Fiat-Shamir heuristic, results in a proof $\pi$ that contains authentication paths from the Merkle trees constructed in each round. The security of the entire system reduces to the collision-resistance of the underlying hash function, making it secure against quantum adversaries. The primary advantage of this paradigm is its transparent setup and arguably well-understood security assumptions. The trade-off, however, is in proof size, which is polylogarithmic in the degree of the polynomial, $O\left({\mathrm{l}\mathrm{o}\mathrm{g}}^{2}n\right)$, and can be sizable in practice, often ranging from tens to hundreds of kilobytes for large $n$. Another hash-based scheme is Polaris, which uses a Merkle tree of Merkle trees and other symmetric cryptographic primitives to create a transparent polynomial commitment with proof size $O(\mathrm{l}\mathrm{o}\mathrm{g} n)$ and verification time $O(\mathrm{l}\mathrm{o}\mathrm{g} n)$ [43].

Other mathematical underpinnings for post-quantum commitments are being investigated, in addition to lattices and hashes. Another option is multivariate cryptography, which is based on the difficulty of solving systems of multivariate polynomial equations (the MQ problem). The Libra protocol utilizes this approach, employing a linear-time checkable tensor product code for its commitment scheme [44]. Its construction yields a proof size of $O\left(\sqrt{n}\right)$, which represents a unique trade-off in the design space, and it also features a transparent setup. However, compared to lattice-based or hash-based alternatives, multivariate cryptography has seen less cryptanalysis and frequently suffers from large public parameters. Groups of unknown order, like RSA groups or class groups, are the foundation of another class of schemes. These groups are used by the DARK compiler to build polynomial commitments with transparent setup and constant-sized proofs. Since Shor’s method can compute group orders and subsequent cryptanalysis has found weaknesses in the DARK security proof, these groups are not considered post-quantum secure and perform more slowly than elliptic curve operations.

Security, efficiency, and practicality are fundamentally at odds in the quickly developing field of post-quantum polynomial commitments. The schemes covered in this section are compared in

Table 5. Comparison of Post-Quantum Polynomial Commitment Schemes.

Scheme	Primary Assumption	Setup	Proof Size	Verifier Time	Key Feature
Lattice-based	SIS/LWE	Transparent	$O(\mathrm{l}\mathrm{o}\mathrm{g} n)$	$O(\mathrm{l}\mathrm{o}\mathrm{g} n)$	Based on well-studied lattice problems
Brakedown	Linear Codes	Transparent	$O\left({\mathrm{l}\mathrm{o}\mathrm{g}}^2 n\right)$	$O\left({\mathrm{l}\mathrm{o}\mathrm{g}}^2 n\right)$	Uses tensor product codes
FRI/zk-STARK	Collision-Resistant Hashing	Transparent	$O\left({\mathrm{l}\mathrm{o}\mathrm{g}}^2 n\right)$	$O(\mathrm{l}\mathrm{o}\mathrm{g} n)$	No trusted setup, random oracle model
Polaris	Collision-Resistant Hashing	Transparent	$O(\mathrm{l}\mathrm{o}\mathrm{g} n)$	$O(\mathrm{l}\mathrm{o}\mathrm{g} n)$	Efficient verifier time
Libra	MQ Problem	Transparent	$O\left(\sqrt{n}\right)$	$O\left(\sqrt{n}\right)$	Multivariate-based, unique proof size

, with an emphasis on their salient features:

The pursuit of quantum resistance invariably departs from the ideal of constant-sized proofs and constant-time verification, as the table shows. The current generation of post-quantum schemes accepts larger proof sizes as a necessary trade-off in favor of transparent setup and strong security assumptions. The goal of ongoing research is to optimize these structures, lower their concrete overhead, and improve their performance so that it is more comparable to classical schemes like KZG without sacrificing their security in the post-quantum era.

6. Applications

Polynomial commitment schemes’ theoretical elegance is matched by their significant practical impact, opening the door for a new generation of cryptographic protocols that improve privacy, scalability, and verification in a variety of contexts. The applications listed below show how PCS have evolved from theoretical ideas to essential parts of practical systems.

One of the most significant applications of polynomial commitment schemes is the construction of concise non-interactive arguments of knowledge (zk-SNARKs). zk-SNARKs allow a prover to demonstrate that every calculation is carried out correctly using a proof that can be validated in milliseconds. Polynomial commitments are the basic mechanism that makes this possible [45]. A crucial element of protocols like PLONK, Marlin, and Sonic is the capacity to commit to polynomials that represent the computation’s arithmetic circuit and then effectively open them at random challenge points selected by the verifier [46,47]. Enhancing scalability and privacy need this functionality. Zk-SNARKs provide efficient off-chain computation verification in blockchain scaling solutions (like zk-rollups), which greatly increases transaction throughput, and they safeguard transaction data in cryptocurrencies like Zcash [48,49].

Another game-changing use is the Verkle tree, a data structure that might totally change blockchain state management. Traditional Merkle trees, which are utilized in Bitcoin and Ethereum, need proof sizes to grow linearly with tree depth [50]. Instead, then using the straightforward hashes included in a Merkle tree, Verkle trees employ vector commitments, which are derived from polynomial commitments. This allows proof sizes that are logarithmic in the tree’s breadth, which is a major gain. For example, lowering witness sizes from gigabytes to kilobytes using a Verkle tree for Ethereum’s state might make stateless clients a reality [51]. This will enable nodes to validate blocks without keeping the entire state, significantly improving decentralization and scalability by reducing the hardware requirements for node operators.

Beyond blockchain technology, polynomial commitments play a major role in verifiable secret sharing (VSS) [52]. In a VSS system, a dealer distributes shares of a secret among many parties. By comparing their shares to a single polynomial of bounded degree, the parties using polynomial commitments can verify that their shares match a legitimate secret without the dealer disclosing the secret itself. This is a crucial aspect of secure multi-party computation (MPC) and distributed key generation (DKG) protocols and ensures resilience against a hostile dealer [53]. Because polynomial commitments’ binding and concealing characteristics enable effective verification of the shared secret’s correctness without compromising its security, they immediately contribute to more secure and trust-minimized distributed systems.

7. Comparative Analysis and Research Directions

7.1. Quantitative Performance Analysis of Post-Quantum Schemes

The asymptotic complexities in Table 4, Table 5,

Table 6. Concrete Performance of Promising Post-Quantum Schemes (Estimates for $\mathrm{n}=2^{20}$).

Scheme	Primary Assumption	Setup	Proof Size	Verifier Time	Source
FRI/zk-STARK	Collision-Resistant Hashing	Transparent	100–500 KB	10–50 ms	Ben-Sasson et al. [19]
Lattice SNARK	SIS/LWE	Trusted	∼1.5 KB	∼100 ms	Albrecht et al. [18]
Brakedown	SIS/LWE	Transparent	200–800 KB	20–100 ms	Golovnev et al. [15]

and

Table 7. High-Level Comparison of Polynomial Commitment Schemes.

Scheme	Primary Cryptographic Assumption	Setup	Post-Quantum?	Proof Size	Verifier Time	Key Trade-Off
KZG	d-SDH (Pairings)	Trusted	No	$\mathrm{O}\left(1\right)$	$\mathrm{O}\left(1\right)$	Optimal performance but quantum-vulnerable
Bulletproofs	Discrete Logarithm	Transparent	No	O (log n)	O(n)	Transparent but slower verification
DARK	Low Order/Adaptive Root	Transparent	Plausibly	$\mathrm{O}\left(1\right)$	O(n)	Transparent + constant proofs
FRI/STARK	Random Oracle (Hashes)	Transparent	Yes	$\mathrm{O}\left({\mathrm{l}\mathrm{o}\mathrm{g}}^2\mathrm{n}\right)$	$O(\mathrm{l}\mathrm{o}\mathrm{g} n)$	PQ-secure with larger proofs
Brakedown	SIS/LWE (Lattices)	Transparent	Yes	$\mathrm{O}\left({\mathrm{l}\mathrm{o}\mathrm{g}}^2\mathrm{n}\right)$	$\mathrm{O}\left({\mathrm{l}\mathrm{o}\mathrm{g}}^2\mathrm{n}\right)$	PQ-secure, uses error-correcting codes
Polaris	Collision-Resistant Hash	Transparent	Yes	$O(\mathrm{l}\mathrm{o}\mathrm{g} n)$	$O(\mathrm{l}\mathrm{o}\mathrm{g} n)$	Efficient PQ verifier
Lattice SNARK	SIS/LWE (Lattices)	Trusted	Yes	O(1) 1	$\mathrm{O}\left(\sqrt{n}\right)$ 1	PQ with trusted setup

¹ With preprocessing.

come directly from the theoretical analyses in the original papers that were cited. We got the exact numbers in Table 6 from published benchmarks when they were available. For schemes without published implementations (e.g., Lattice SNARK), we employ asymptotic analysis estimates with representative constants from the original articles. Readers should interpret cross-source comparisons as suggestive rather than definitive. Table 6 lists the sources of each figure. The issue of standardized benchmarking for all schemes on a single platform remains unresolved.

Concrete performance measurements are essential for practical adoption, even when asymptotic complexity offers a theoretical basis. The hash-based FRI protocol (as used in zk-STARKs), the lattice-based Lattice SNARK, and the lattice-based Brakedown scheme are three well-known post-quantum polynomial commitment schemes that are quantitatively compared in this section. We estimate performance for a typical case, which involves committing to a polynomial of degree $n=2^{20}$ (about 1 million) and producing a single evaluation proof, in order to facilitate a direct comparison. Table 6 presents values that are indicative of existing implementations and emphasize the crucial trade-offs. These values were synthesized from the relevant literature and performance benchmarks. We stress that these figures are taken from published sources and may not be directly comparable because of differences in software, hardware, and parameter selections. A comprehensive empirical assessment of all systems on a single platform is still a significant unresolved issue and a promising avenue for future research.

All numbers come from the sources that were cited. Direct comparison is simply an estimate due to variations in device configurations and security settings. Since there is no public implementation, Lattice SNARK numbers are merely approximations. One unresolved research difficulty is standardized benchmarking across all schemes on a single platform.

The performance figures in this table are compiled from the respective original papers and subsequent benchmark reports. Direct comparisons should be treated with caution due to differing implementation platforms, security parameters, and optimization levels. Standardized benchmarking across all schemes on a single machine remains an important direction for future work. The ranges are based on recent research; proof sizes and verifier durations are highly dependent on particular implementations and security factors.

The information in Table 6 illustrates the basic conflict in the post-quantum environment between the efficiency of verification, the conciseness of proofs, and trust assumptions.

The Lattice SNARK framework has a significant advantage in proof size, providing proofs two to three orders of magnitude less than its transparent competitors. For bandwidth-constrained contexts, this makes it the only post-quantum contender that comes close to the classical schemes’ ideal succinctness, such as KZG. However, this benefit comes at the expense of a reliable setup, bringing back the single point of failure and logistical complexity that transparent systems aim to prevent. Because its lattice-based operations are computationally expensive, its verification time is a little longer.

On the other hand, both the Brakedown scheme and the FRI protocol provide a transparent setup, which is essential for long-term cryptographic maintenance and decentralization. This clarity comes at the cost of much bigger proof sizes. Because it is hash-based, FRI usually produces proofs that are hundreds of kilobytes in size. Brakedown is a lattice-based design that frequently yields proofs at the bigger end of this range since it uses linear-time encodable codes. Both have comparable and somewhat efficient verification speeds, frequently lasting less than 100 milliseconds, which is suitable for a wide range of applications.

This quantitative analysis highlights a clear, priority-based decision matrix for practitioners. For scenarios where maximum conciseness is required and a trusted configuration is acceptable (such a well-audited blockchain rollup), Lattice SNARKs are the most promising choice. Even if its evidence size is larger, FRI’s transparent setup is essential for applications that must minimize trust and enhance decentralization, such base-layer blockchain consensus. Brakedown is an active research path for achieving transparent setup from lattice assumptions, despite its current high proof size cost.

There is still a major problem: not one method can yet do millisecond verification, sub-kilobyte proof sizes, and transparent setup all at the same time. Ongoing research is primarily focused on closing this performance difference.

7.2. High-Level Comparative Overview

In the complex trade-off space that is the landscape of polynomial commitment schemes, no single construction can simultaneously achieve all desired properties of succinctness, efficiency, transparency, and quantum resistance. The schemes discussed in previous sections are thoroughly compared in this section, which also examines how well they perform on key metrics and identifies persistent issues and unexplored areas for future research in this rapidly evolving field.

A meaningful comparison requires a deep understanding of the key performance metrics and security features that define the feasibility of polynomial commitment systems. Table 7 provides a detailed comparison of the security foundations, trust model, and asymptotic performance of the primary schemes discussed in this paper.

Researchers and practitioners usually take into account a number of important factors while assessing polynomial commitment schemes. The first is proof size, which ranges from the optimal constant-sized proofs $\left(O\right(1\left)\right)$ achieved by KZG and DARK to the larger logarithmic $\left(O\right(\mathrm{l}\mathrm{o}\mathrm{g} n\left)\right)$ and polylogarithmic $\left(O({\mathrm{l}\mathrm{o}\mathrm{g}}^2 n)\right)$ proofs of lattice-based and hash-based constructions. Verification time shows similar variation, with KZG offering constant-time verification $\left(O\right(1\left)\right)$ while most post-quantum schemes require logarithmic verification time $\left(O(\mathrm{l}\mathrm{o}\mathrm{g} n)\right.$ or $\left.O({\mathrm{l}\mathrm{o}\mathrm{g}}^2 n)\right)$. The prover complexity represents another critical dimension, with most schemes requiring quasilinear time $\left(O\right(n\mathrm{l}\mathrm{o}\mathrm{g} n\left)\right)$ for proof generation, though some like Orion aim for linear prover time $\left(O\right(n\left)\right)$. While all known post-quantum safe techniques need transparent setup yet have significant performance overheads, the most successful systems (KZG) require trusted setup and are quantum-vulnerable. Perhaps the most basic trade-off between quantum resistance and trust assumptions is this one.

The comparative performance of these schemes can be visualized through several key metrics. For a polynomial of degree $n=2^{20}$ (approximately 1 million), KZG produces proofs of approximately 128–192 bytes verifiable in milliseconds, while lattice-based schemes like Brakedown generate proofs of 100–500 KB requiring tens of milliseconds for verification, and FRI-based schemes produce proofs of 200–1000 KB with similar verification times. These specific figures demonstrate the significant difference that still exists between classical and post-quantum methods.

These constructions’ underlying security assumptions also differ greatly: bulletproofs rely on the discrete logarithm assumption, lattice-based schemes on SIS/LWE problems, hash-based schemes on the random oracle model and collision-resistant hashing, and KZG is based on the d-SDH assumption [54,55]. Although this variety of presumptions offers several construction routes, it also makes direct comparison and standardization more difficult.

7.3. Security Analysis

In addition to performance, each scheme’s security foundations are crucial for determining its long-term viability. This analysis takes into account the necessary trust model, the difficulty of the underlying mathematical problems, and their resistance to cryptanalysis.

Because they rely on cryptographic hash functions that are well-understood and characterized as random oracles, hash-based constructions, like those that use FRI, have an advantage over alternative post-quantum systems. The security of SHA-3 and other modern hashes has been extensively studied [56], making this a sensible and reliable assumption. The complexity of the Learning with Errors (LWE) and Short Integer Solution (SIS) problems determines lattice-based techniques. Since these issues have undergone significant cryptanalysis and are the foundation for several NIST post-quantum standardization candidates, there is a high degree of trust in their security. However, the specific instantiations in PCS are more recent and may require further investigation.

Schemes based on multivariate issues and groups of unknown order (DARK) are based on less standardized assumptions. Their security levels are less guaranteed and have not received as much cryptanalytic attention as hashes and lattices.

Lastly, a direct security consideration is the trust model. As in KZG and Lattice SNARKs, a trusted setup creates a cryptographic “single point of failure.” The security of the entire system is compromised if the setup ceremony’s secret trapdoor is compromised. All other schemes that have been discussed use transparent setups, which completely remove this risk and provide a more robust and decentralized security guarantee.

There are still many difficult research issues in the field of polynomial commitment schemes, despite tremendous progress. Improving the concrete efficiency of post-quantum schemes, specifically cutting down on proof sizes and verification times to get closer to practical usability for real-world applications is one of the most urgent challenges. Current work focuses on creating new cryptographic methods that could, through sophisticated recursive composition techniques or innovative cryptographic assumptions, produce constant-sized proofs without the need for a trusted setup. Another promising avenue is the development of aggregation techniques, which allow several proofs to be combined into a single proof that can be verified more quickly than if each proof were verified separately [57]. In applications that need a lot of polynomial evaluations, these methods could greatly reduce the overhead of post-quantum schemes.

Improving the security and functionality of polynomial commitments is another important area of research. For dynamic applications like blockchain state commitments and verifiable databases, the creation of universal updatable commitments would enable effective updating of commitments when polynomials change. A significant challenge is still making these schemes more composable within larger cryptographic protocols, including making them secure under composition frameworks such as the universal composability framework [58]. Furthermore, even though some schemes provide optional hiding properties, more research is needed to create effective strongly hiding commitments that hide every detail about the committed polynomial without suffering appreciable performance costs.

There are also many obstacles in the way of these schemes’ standardization and actual implementation. It takes a lot of optimizations to close the gap between theoretical constructions and real-world applications, such as hardware acceleration with GPUs, FPGAs, or specialized hardware for the computationally demanding operations in hash-based and lattice-based schemes [59,60]. To enable fair comparison across various schemes and speed up the standardization process for post-quantum polynomial commitments, the community must also create thorough benchmarking frameworks and evaluation metrics. In order to ensure a seamless transition to quantum-resistant cryptographic infrastructure, these research efforts must be coordinated across theoretical cryptography, practical implementation, and standardization bodies as quantum computing capabilities advance.

There will probably be multiple interrelated pathways in the future development of polynomial commitment schemes. For transitional security, short-term efforts will concentrate on refining current structures and creating hybrid strategies that blend post-quantum and classical methods. Long-term endeavors will strive toward fundamental discoveries that could lead to the efficiency of classical schemes with the security of post-quantum constructions, while medium-term research will probably investigate new mathematical underpinnings and cryptographic techniques to achieve better efficiency trade-offs. Polynomial commitment schemes will remain essential components of the next generation of cryptographic systems as these advancements develop, opening up new applications in decentralized systems, verifiable computation, and privacy-preserving technologies while ensuring security in both classical and quantum threat models.

8. Research Questions and Degree of Accomplishment

The four research topics from Section 2 are first mapped to the corresponding sections. Section 4 and Section 5 cover Research Question 1, which relates to fundamental works. Section 5 and Section 6, and Table 7 address Research Question 2, which relates to performance trade-offs and present trends. Section 7.3 addresses Research Question 3, which relates to constraints and unresolved issues. Section 6 addresses Research Question 4, which relates to practical importance. After then, each research topic is covered in detail in the paragraphs that follow, along with an evaluation of how effectively the study has achieved its objectives.

The topic of polynomial commitments has shown that it is a basic and quickly changing part of cryptography that makes new systems possible that can be verified and scaled. The comprehensive literature reviewed in this study supports that, whereas classical schemes serve as a performance baseline, the shift to post-quantum secure constructs is both essential and currently in progress. The following paragraphs discuss the four main research questions that led this scientific survey and look at how well this study has met its goals.

RQ1. 

Which significant pieces of literature discuss the formation and conceptualization of polynomial commitments?

The goal of this research subject was to map the field’s formative and fundamental works. This objective is effectively achieved by the survey through the methodical identification and classification of the foundational literature. The review discusses the fundamental classical constructs, as described in Section 4 and Section 5. The pairing-based KZG scheme [61], which established a performance benchmark, is followed by transparent alternatives such as Bulletproofs [62] and DARK [63]. Additionally, the study provides a thorough documentation of the early research on post-quantum constructs, such as hash-based protocols like FRI [64] and later implementations like Polaris, as well as lattice-based schemes like Brakedown and Lattice SNARKs [65]. A comprehensive visual map of this literature is shown by the taxonomy [66] in Section A Taxonomy of Polynomial Commitment Schemes and the chronology in Figure 2, that demonstrate a high level of success in answering RQ1.

RQ2. 

What are the latest scientific tendencies, particularly in post-quantum security and the accompanying performance trade-offs?

The aim of this study was to identify the current research paths and inherent trade-offs in the sector. The survey clearly demonstrates that the most significant development is the transition from classical to post-quantum secure polynomial commitments. This is a result of the vulnerability of discrete logarithms and pairing-based assumptions to quantum effects [67]. Currently, the majority of research is conducted using lattice-based [68] and hash-based approaches [69] as discussed in Section 5, Section 6 and Section 7. A key achievement of this paper is the explicit identification and quantitative analysis of the main performance trade-off, namely that quantum resistance is now achieved at the cost of increased computing overhead and bigger proof quantities. The comparison study in Section 7.2, which is summed up in Table 7, provides specific proof of this tendency. It shows that transparent post-quantum schemes have proof sizes orders of magnitude bigger than classical KZG, whilst the most condensed post-quantum option (Lattice SNARK) requires a trusted setup. Consequently, our work has successfully identified and measured the key scientific trends and the trade-offs they involve.

RQ3. 

What are the known shortcomings, restrictions, and unresolved issues with the current schemes?

This question aimed to critically analyze the state of the art in order to uncover outstanding concerns. The survey does this in full by devoting entire sections to these challenges. Section 6 (“Applications”) goes into great detail about persistent issues like the large common reference string (CRS) sizes, the lack of adaptive security for many lattice-based schemes, the underdeveloped batch verification for post-quantum schemes, and the verification efficiency bottlenecks in transparent settings [70]. Furthermore, the quantitative analysis in Section 7.1 clearly frames the performance overhead of post-quantum methods as the primary obstacle to their practical implementation. In addition to identifying the primary unsolved challenges and situating them within the broader framework of verifiable computation [10], this evaluation has consolidated these shortcomings from earlier research and arranged them into a clear research path that completely addresses the scope of RQ3.

RQ4. 

How significant is the scope of the evaluated study from a conceptual, scientific, and practical standpoint?

This investigation aimed to contextualize the theoretical work with practical applications and broader scientific relevance. The review discusses this in a variety of ways. Section 1 and the dedicated Section 6 (“Applications”) illustrate the basic conceptual and practical importance of polynomial commitments as the basis for zk-SNARKs, Verkle trees [71] for blockchain scalability, and verifiable secret sharing [72]. The creation of these schemes, as detailed in this review, represents a significant advancement in the concepts of verifiable computation from a scientific standpoint. Researchers and practitioners can benefit greatly from the comparative analysis in Section 7, which presents a clear framework for selecting schemes based on application-specific needs (e.g., emphasizing succinctness with a trusted setup against transparency with bigger proofs). By connecting the theoretical cryptographic structures to their ground-breaking applications in decentralized networks and privacy-preserving technologies, this study demonstrates the conceptual, scientific, and practical value of the research scope.

9. Conclusions

This systematic review directly addresses the four research topics from Section 2 as listed below.

Answer to RQ1 (Foundational works): Transparent alternatives Bulletproofs and DARK followed the pairing-based KZG method, which set the performance standard with constant-sized proofs and $\mathrm{O}\left(1\right)$ verification. FRI/STARK offers hash-based security for post-quantum foundations, whereas Brakedown and Polaris offer hash-based and lattice-based alternatives. Section 4 and Section 5 go into detail on them.

Answer to Question 2: The shift from classical to post-quantum safe polynomial commitments is the most important breakthrough. Although classical KZG is quantum susceptible, it achieves $\mathrm{O}\left(1\right)$ proofs and verification. Succinctness is sacrificed in post-quantum schemes: FRI generates $\mathrm{O}({\mathrm{l}\mathrm{o}\mathrm{g}}^2\mathrm{n})$ proofs (100–500 KB for $\mathrm{n}=2^{20}$). No system offers post-quantum security, constant-sized proofs, and transparent setup all at once. In Table 7, this trade-off is measured.

Answer to RQ3 (Limitations and outstanding problems): Unproven adaptive security for various lattice designs, the performance difference between classical and post-quantum methods (proof sizes 100–1000 times greater), and the absence of common benchmarking frameworks are persistent issues. Section 7.3 examines them.

Answer to RQ4 (Practical significance): Verkle trees, which reduce Ethereum state witness sizes from gigabytes to kilobytes, zk-SNARKs, which underlie Zcash and zk-rollups, and verifiable secret sharing are made possible by polynomial commitments. Section 6 goes into depth about these applications.

Polynomial commitment schemes are now a crucial cryptographic basic that enables verifiable computation in a variety of applications, including blockchain systems and privacy-preserving technologies [73]. These schemes have received a comprehensive examination that has examined their theoretical features, practical applications, and performance attributes, from their classical origins to the state-of-the-art in post-quantum secure constructions. The discipline has come a long way from the early pairing-based constructs to the more intricate lattice-based and hash-based techniques [74,75]. Regarding security assumptions, verification efficiency, and proof size, each method has distinct advantages and disadvantages [76].

The comparative research shows that no one strategy presently achieves all needed qualities simultaneously. Classical methods like KZG offer exceptional performance with constant-sized proofs and efficient verification, despite their reliance on a trusted setup and weak cryptographic assumptions. Bulletproofs provide transparency without a reliable setup, but they lack quantum protection and need bigger proof sizes. The new post-quantum approaches, notably hash-based methods like FRI and lattice-based structures like Brakedown, commit significant cost in terms of proof volumes and computing demands even if they offer quantum resistance. Researchers and practitioners must carefully consider the many trade-offs this environment presents based on specific application needs, security requirements, and performance restrictions.

Based on our comprehensive analysis, we identify three priority directions for future research:

Short-term research should concentrate on refining current post-quantum schemes. Although quantum-resistant, current lattice-based and hash-based architectures have substantial verification overhead and enormous proof sizes. Recursive composition, which permits effective verification of complex calculations, hardware acceleration to speed up computationally costly procedures, and aggregation approaches, which aggregate several proofs into a single compact proof are promising optimization avenues. Standardized benchmarking frameworks must also be developed in order to facilitate fair and repeatable comparisons across various platforms and implementations, allowing practitioners to make well-informed decisions.

In the medium run, investigating novel cryptographic presumptions provides a route to more effective constructs. Current lattice-based and hash-based methods have not yet succeeded in achieving constant-sized proofs with transparent setup and post-quantum security. Novel code-based assumptions, sophisticated constructions in groups of unknown order, and isogeny-based cryptography are examples of emerging fields that show promise for improving efficiency trade-offs. Schemes that approach the performance of classical constructs while retaining quantum resistance may someday be made possible by these alternate foundations.

In the long run, universal composability and standards must be addressed. Establishing thorough security models and standardized parameter sets is essential for moving critical infrastructure to quantum-resistant polynomial commitments as quantum computing capabilities develop. In order to ensure backward compatibility and progressive deployment, this involves creating hybrid schemes that combine classical efficiency with post-quantum security during the transition phase. Additionally, in order to maintain their security when included into larger cryptographic protocols under frameworks like universal composability, new constructions must be developed with composability in mind.

The field is changing quickly, as evidenced by the advances reviewed in this study. We seek to expedite the development of polynomial commitment schemes that are both feasible and quantum-resistant, enabling the next generation of verifiable and privacy-preserving digital systems, by methodically mapping the landscape, quantifying the trade-offs in Table 4, Table 5 and Table 6, and identifying these research directions.

Creating and implementing quantum-resistant polynomial commitments is becoming more and more crucial as quantum computing capabilities continue to develop. The current momentum in the study, standardization, and application of these essential primitives must be maintained by the cryptographic community. To guarantee a seamless transition to quantum-resistant cryptographic infrastructure, future work should place a high priority on cooperative efforts between theoretical cryptographers, real-world implementers, and standardization bodies. The advancements already made in this area show that the cryptographic community can adapt to new threats while still allowing for creative applications that depend on zero-knowledge proofs and verifiable computation [77].

In conclusion, polynomial commitment schemes are an active and important area of cryptography research that sits at the intersection of theoretical development and practical application. This systematic review provides a consistent taxonomy, a thorough history, and quantitative comparisons that highlight the basic trade-offs between classical efficiency and post-quantum security. The research roadmap presented here provides specific recommendations for reducing the remaining performance gap. As research progresses, these primitives will undoubtedly become essential components of modern cryptographic infrastructure, offering up hitherto unthinkable applications and possibilities.