## What is Halo2

The term "Halo2" refers to two related but different concepts:
- A *concrete proving system*, devised by [Zcash](https://z.cash/), for **recursion** over the [Pasta Cycle](https://electriccoin.co/blog/the-pasta-curves-for-halo-2-and-beyond/) of curves; based on an extension of [PLONK](https://eprint.iacr.org/2019/953.pdf) and instantiated with the [inner-product argument](https://hackmd.io/@mimoo/ByuE81Q0_) (IPA for short) as the polynomial commitment scheme.
- A *general-purpose* [*library*](https://github.com/zcash/halo2) for zero-knowledge proofs, initially developed by Zcash to realize the above proving system.

The above vision of a recursive proving system was never completed by Zcash, but their research and efforts resulted in the above-mentioned, very powerful, popular and widely-used [library](https://github.com/zcash/halo2) for zero-knowledge proofs.

### The ZK library

Such library implements the PLONK system enhanced with a novel and very efficient [*lookup argument*](https://zcash.github.io/halo2/design/proving-system/lookup.html) and several optimizations related to the *permutation argument*, *selectors compression*, powerful *custom gates* for efficient (native) elliptic curve operations and many more.

This library became one of the most (if not the most) widely-used implementations of zero-knowledge proofs, especially one of its [forks](https://github.com/privacy-scaling-explorations) by a team of developers at [Ethereum](https://ethereum.foundation/).

### Midnight's version

Midnight's zero-knowledge library builds on top of the [PSE fork](https://github.com/privacy-scaling-explorations) of Halo2. Developed in collaboration with [Galois, Inc.](https://galois.com/research-development/cryptography/), Midnight's library *supports recursion* over the [Pluto-Eris Cycle](https://github.com/daira/pluto-eris) of curves; and uses the [KZG](https://www.iacr.org/archive/asiacrypt2010/6477178/6477178.pdf) polynomial commitment scheme in Pluto and the IPA polynomial commitment scheme in Eris.

> **Remark**. Internally, when we mention *"the switch to halo2"*, we mean moving from a plain PLONK implementation (that was being used in early stages of Midnight) to the above-mentioned library. This transition is more than a backend change as we now support important building blocks that were not supported before, like in-circuit SHA256 for a hash or Pluto-Eris for the curve. Note that these are slower than their predecessors in the previous system (respectively, Poseidon hash and the BLS12-381 curve), but they are necessary for the Midnight protocol.

## What are the benefits of using Halo2 for Midnight and its users

Halo2 is one of the most popular and consolidated libraries of zero-knowledge, making it a great choice for a system that needs to be reliable, robust and efficient.

Midnight's implementation supports efficient recursion. This makes it possible to build efficient bridges with other chains like [Cardano](https://cardano.org/).

Midnight uses curves that have an efficient *pairing*, which allows us to use the [KZG](https://www.iacr.org/archive/asiacrypt2010/6477178/6477178.pdf) polynomial commitment scheme and enjoy constant-time verification of proofs. This is an important advantage over other systems which use IPA.

## How is Halo2 different/better than other proving systems?

PLONK's arithmetization provides support for efficient *custom gates* and *lookup arguments*. This makes it a great choice over other popular systems like [Groth16](https://eprint.iacr.org/2016/260.pdf). Furthermore, PLONK is a *universal* SNARK, which (unlike Groth16) does not require a trusted setup ceremony for every ZK-circuit. This is a major advantage.

There exist other very recent techniques and proving systems. Some of them like [*folding*](https://eprint.iacr.org/2021/370.pdf) are compatible with Midnight's system and may be incorporated to Midnight in the future.
Others like STARKs over smaller fields can lead to systems with faster proving times, but would involve heavier architectural changes, and could have an impact in verification performance.

The advantage of Halo2 over these very recent constructions is its simplicity and the fact that it is a consolidated, widely-used and tested, and more reliable system.