Trusted Setup

A trusted setup is a one-time cryptographic ceremony that generates the initial parameters, often called the Common Reference String (CRS) or structured reference string (SRS), for a zero-knowledge proof system like zk-SNARKs. During this process, one or more participants use random secrets to create public parameters that will be used by all future users to generate and verify proofs. The critical security assumption is that these participants must honestly delete their secret random values, known as toxic waste; if any single participant retains this waste, they could potentially create fraudulent proofs that appear valid to the network, compromising the entire system.

The process often employs a multi-party computation (MPC) ceremony to distribute trust among many participants, a method known as a MPC-based trusted setup. In this model, each participant sequentially contributes their own randomness to the setup, with the final parameters being a product of all contributions. The security guarantee improves dramatically: as long as at least one participant is honest and destroys their secret, the toxic waste is effectively erased and the system remains secure. High-profile examples include the Perpetual Powers of Tau ceremony for Ethereum and the setup for Zcash's original Sprout protocol, which involved six participants in a detailed public ceremony.

The primary critique of trusted setups is the inherent trust assumption they introduce, which conflicts with the trust-minimization ethos of blockchain. A compromised setup creates a systemic, undetectable backdoor. Consequently, cryptographic research strongly favors transparent setups (like those used in zk-STARKs and Bulletproofs) that require no secret parameters and no trust. However, for many efficient zk-SNARK constructions, a trusted setup remains a practical necessity, making robust, publicly auditable MPC ceremonies the best available method to bootstrap trust for these powerful privacy and scaling technologies.

In a trusted setup ceremony, multiple independent participants sequentially contribute random secret values, or toxic waste, to a shared computation. Each participant receives the output from the previous contributor, adds their own secret randomness, and passes the updated parameters forward. This process creates a chain of dependencies where the final public parameters are secure as long as at least one participant was honest and successfully destroyed their secret. Famous examples include the Perpetual Powers of Tau ceremony for SNARKs and the ceremony for the Zcash cryptocurrency's original Sprout protocol.

The security model is often described as a 1-of-N trust assumption. If all participants collude or are compromised, they could collectively reconstruct the master secret and generate fraudulent proofs. However, the ceremony's design makes such collusion statistically improbable as the number of honest, independent participants grows. Techniques like multi-party computation (MPC) and public attestations (e.g., video recordings of the secret destruction) are used to enhance transparency and verifiability. The final output is a set of public parameters that can be universally used and verified by anyone.

For developers, the ceremony's output is typically a structured reference string or common reference string (CRS), which is essential for generating and verifying zero-knowledge proofs in systems like Groth16, PLONK, or Halo2. Once generated, these parameters are considered universal or updatable, allowing future ceremonies to extend security rather than requiring a full restart. This process is critical for bootstrapping privacy-preserving blockchains and layer-2 scaling solutions, as it establishes the foundational cryptographic trust for the entire system without relying on a single trusted entity.

In a trusted setup ceremony, participants collaborate to generate the common reference string (CRS) or public parameters for a cryptographic system, such as a zk-SNARK circuit. During this process, each participant generates a secret random value, often called a 'toxic' or 'toxic waste' value. These secrets are used to compute the final public parameters, but if even one piece of toxic waste is retained by any participant, it could compromise the entire system. The fundamental security assumption is that all participants successfully delete their secret values, making it computationally infeasible to forge proofs or break the protocol's soundness.

The term 'toxic waste' vividly illustrates the danger of these retained secrets. If not properly disposed of, they act as a master key or a trapdoor, allowing a malicious actor who possesses them to create fraudulent cryptographic proofs. For example, in a zk-SNARK system for a private transaction, someone with the toxic waste could generate a valid proof for an invalid transaction, potentially creating counterfeit assets or double-spending. Therefore, the security of the entire application built on these parameters hinges on the ceremony's integrity and the verifiable destruction of this material.

To mitigate the risk, trusted setup ceremonies employ multi-party computation (MPC). In a multi-party ceremony, the toxic waste is split among many participants, and security is guaranteed as long as at least one participant is honest and destroys their share. High-profile examples include the Perpetual Powers of Tau ceremony for Zcash and the setup for Ethereum's KZG polynomial commitments. These ceremonies are often publicly recorded and involve diverse, credible participants to increase trust in the process, moving from a 'trusted' setup to a 'trust-minimized' or ceremonial setup.