As Ar-Curunir mentioned, you can use a technique called non-interactive zero knowledge proofs (NIZKs). Usually in ZKPs the prover will go through a part of the proof, send it to the verifier, the verifier will then send back a challenge, and the prover will reply with the final part of the proof based on the challenge. The basic flavor of NIZK I've seen is that instead of getting a challenge from the verifier, the prover simply does hash(prover id | first part of proof) and uses the result as the challenge. The `prover id` part is there such that they don't have complete control over the input to the hash. Doing it this way allows the prover to do the entire proof on their own and then send the whole thing to the verifier who can check the proof without any further interaction, saving network costs in exchange for a single hash.

Yes, exactly, lots of round trips, quite expensive to calculate each. SMP, the ZKP protocol they're using, is quite expensive itself, but promises even better security and nifty set of additional features, based info from presentation linked in the article.

However, I think that ZKP is not what you want for regular authentication: just for specific cases, where ZKP properties shine the most.

You have NIZKs that can do this efficiently.