A trusted setup is a one-time cryptographic ceremony that generates the initial parameters—often a Common Reference String (CRS) or structured public parameters—required to bootstrap a zero-knowledge proof system like zk-SNARKs. During this process, a secret is split among multiple participants, who must then securely delete their individual shares. The critical security assumption is that if at least one participant is honest and destroys their share, the overall secret remains hidden and the system is secure. If all participants collude or are compromised, they could theoretically generate fraudulent proofs, undermining the entire system built upon it.
LABS
Glossary
Trusted Setup
A trusted setup is a one-time cryptographic ceremony to generate public parameters (e.g., a Common Reference String) for certain proof systems, which must be performed honestly to ensure system security.
Chainscore © 2026
definition
CRYPTOGRAPHIC FOUNDATION
What is a Trusted Setup?
A trusted setup is a foundational ceremony in cryptography where a set of secret parameters is generated to initialize a system, requiring participants to be honest and destroy their secret shares to ensure the system's long-term security.
The necessity for a trusted setup arises from the need to create a structured reference string that allows provers to generate proofs and verifiers to check them without revealing the underlying information. Prominent examples include the original Zcash Sprout ceremony ("The Ceremony" or "Parameter Generation") for the first implementation of zk-SNARKs on a blockchain, and Groth16, a widely used zk-SNARK proving system. These setups are often conducted as multi-party computations (MPCs) to distribute trust, increasing security by reducing reliance on any single entity.
To mitigate the risks of a trusted setup, projects employ rigorous ceremony designs. This involves using secure hardware, conducting audits, and recruiting a diverse set of credible, independent participants. The process is often publicly recorded and verifiable. The goal is to make collusion statistically improbable and computationally infeasible. Despite these precautions, the requirement for initial trust is considered a security weakness compared to transparent (trustless) proof systems like zk-STARKs or Bulletproofs, which do not require a trusted setup.
The legacy of a trusted setup is permanent; the generated parameters are used for the lifetime of the cryptographic system. Consequently, a successfully executed ceremony with widespread participation and verification becomes a foundational pillar of trust. In blockchain contexts, this enables powerful privacy and scalability features—such as shielded transactions and validity proofs for rollups—but places immense importance on the integrity of that single historical event. Ongoing cryptographic research focuses on minimizing or eliminating this trust assumption through newer proof systems.
how-it-works
CRYPTOGRAPHIC CEREMONY
How a Trusted Setup Works
A trusted setup is a one-time cryptographic ceremony where a group of participants collaboratively generates the initial secret parameters, known as the 'toxic waste,' required to bootstrap certain advanced cryptographic systems like zk-SNARKs.
A trusted setup is a foundational, one-time procedure in cryptography where multiple participants generate the initial secret parameters, often called the toxic waste, required to create the common reference string (CRS) for advanced proving systems like zk-SNARKs. The core security assumption is that if at least one participant is honest and successfully destroys their portion of the secret, the final system parameters remain secure. This process is also known as a powers-of-tau ceremony or MPC (Multi-Party Computation) setup, where the goal is to decentralize trust among the participants to mitigate the risk of a single point of failure.
The ceremony typically involves a sequential or parallel multi-party computation. Each participant receives the current state of the parameters, contributes their own random secret, performs a computation to embed it, and then passes the updated parameters to the next participant. Crucially, each contributor must provide a cryptographic proof of correct computation (a PoT or attestation) and must verifiably destroy their secret entropy. The final output is a public structured reference string that contains no trace of the original secrets, provided at least one participant was honest. Famous examples include the Zcash Sprout ceremony (2016) and the Perpetual Powers of Tau initiative.
The security model is often described as a 1-of-N trust assumption, meaning the system is secure if at least one participant is honest. This is a significant improvement over a single-party setup, which requires absolute trust in that one entity. However, the requirement for any initial trust distinguishes it from transparent setups, like those used in zk-STARKs or Bulletproofs, which require no secret parameters. The primary risk in a trusted setup is a subversion attack, where all participants collude or are compromised to retain the toxic waste, potentially allowing them to create fraudulent proofs.
key-features
TRUSTED SETUP
Key Features & Characteristics
A trusted setup is a one-time, multi-party ceremony to generate the initial cryptographic parameters (common reference string or structured reference string) for a zero-knowledge proof system, where the security of the entire system depends on at least one participant destroying their secret.
01
Ceremony Structure
A trusted setup is a multi-party computation (MPC) ceremony where participants sequentially contribute randomness to generate the final parameters. Each participant receives the output from the previous contributor, adds their secret, and passes it on. The final parameters are secure as long as at least one participant was honest and destroyed their secret contribution (the 'toxic waste').
02
Toxic Waste
The toxic waste refers to the secret random values (often called 'tau' or 's') generated during the ceremony. If retained, this secret allows an attacker to forge proofs. The security assumption is that all participants perform a secure deletion of their toxic waste. Systems like Groth16 require a universal setup, while PLONK and Marlin use updatable or structured setups.
03
Universal vs. Updatable
- Universal Setup (Groth16): A single ceremony generates parameters for a specific circuit size cap. It is not updatable; a new ceremony is required for larger circuits.
- Updatable/Powers of Tau Setup (PLONK, Marlin): The ceremony produces a structured reference string (SRS). New participants can contribute later, reinforcing security. This allows the same SRS to be used for many different circuits, making it more flexible and sustainable.
04
Security Model & Trust Assumptions
The ceremony moves from a trusted third party model (high risk) to a trusted initializer model. The goal is to maximize the number of independent, credible participants to make collusion statistically improbable. Security is often framed as 1-of-N trust, where only one honest participant is needed. Real-world ceremonies use diverse participants, public livestreams, and hardware security modules to increase confidence.
05
Notable Ceremonies
- Zcash's original Sprout setup (2016): A 6-party ceremony for the first major zk-SNARK implementation.
- Ethereum's Perpetual Powers of Tau (2018-): A continuous, contributor-driven universal MPC for the BN128 and BLS12-381 curves, with hundreds of participants.
- Filecoin's Trusted Setup (2018): A large-scale ceremony for their Proof-of-Replication and Proof-of-Spacetime circuits.
- Zcash's Sapling Powers of Tau (2018): A 90+ participant ceremony for the newer Sapling protocol.
06
Trust Minimization Techniques
Ceremonies employ multiple techniques to minimize required trust:
- Multi-Party Computation (MPC): Distributes trust across participants.
- Public Verification: Contributions are cryptographically verifiable by anyone.
- Transparent Ceremonies: Use public livestreams, detailed logs, and open-source software.
- Diverse Participants: Include cryptographers, auditors, community members, and public figures to reduce collusion risk.
- Hardware Security Modules (HSMs): Used to generate and securely delete secrets in isolated environments.
examples
TRUSTED SETUP
Protocols & Examples
A trusted setup is a cryptographic ceremony where a secret parameter is generated and then destroyed, establishing a foundation of trust for protocols like zero-knowledge proofs. The security of the entire system depends on the assumption that the initial secret was not retained.
01
The Ceremony Process
A trusted setup is a multi-party computation (MPC) ceremony where participants collaboratively generate a common reference string (CRS) or structured reference string (SRS). Each participant contributes randomness to create a secret, performs computations, and provides a proof. The final security relies on the assumption that at least one participant was honest and destroyed their secret contribution, a concept known as the "1-of-N trust assumption."
03
Perpetual Powers of Tau
The Powers of Tau is a universal, updatable trusted setup for pairing-based zk-SNARKs. Unlike one-time ceremonies, it creates a structured reference string (SRS) that can be re-used and extended by future projects. Notable ceremonies include:
- Filecoin's Phase 2
- Ethereum's KZG Ceremony for EIP-4844 (proto-danksharding) This approach allows for trust amortization, where many protocols inherit security from a single, large-scale public ceremony.
04
Trustless vs. Trusted Alternatives
Not all proving systems require a trusted setup. Key trustless alternatives include:
- zk-STARKs: Use publicly verifiable randomness, eliminating the need for a trusted ceremony.
- Bulletproofs: Also do not require a trusted setup, making them simpler to deploy. The trade-off is often between the proving/verification speed and size of proofs (better in SNARKs with setup) and the trust model (better in STARKs/Bulletproofs).
05
Security Risks & Trust Minimization
The core risk is toxic waste—if any participant records their secret contribution, they could generate fraudulent proofs. Mitigation strategies include:
- Multi-party computations (MPC) with many participants.
- Ceremony audits and public verification of transcripts.
- Subversion-resistant protocols that allow detection of compromised parameters. The goal is to make the cost of corruption astronomically high and publicly detectable.
security-model
THE SECURITY MODEL & TRUST ASSUMPTION
Trusted Setup
A trusted setup is a cryptographic ceremony where a secret parameter is generated for a system, requiring participants to be honest for the system's long-term security.
A trusted setup is a one-time cryptographic ceremony where a group of participants collaboratively generates a set of secret parameters, known as a Common Reference String (CRS) or Structured Reference String (SRS), which is essential for the operation of certain zero-knowledge proof systems like zk-SNARKs. The critical security assumption is that at least one participant must honestly delete their portion of the secret; if all participants collude, they could create fraudulent proofs. This process introduces a trust assumption into an otherwise trust-minimized system, as the security of all future proofs depends on the integrity of this initial event.
The ceremony is designed to be trust-minimizing through mechanisms like multi-party computation (MPC). In a multi-party setup, multiple participants sequentially contribute randomness to the parameter generation. The final parameter is secure as long as at least one participant was honest and discarded their secret "toxic waste." Famous examples include the Perpetual Powers of Tau ceremony for Ethereum and the original Zcash Sapling parameter generation. These ceremonies often involve public figures and use open-source software to enhance transparency and public scrutiny, making large-scale collusion highly improbable.
The necessity for a trusted setup is a key differentiator between proof systems. Systems requiring it, such as Groth16 zk-SNARKs, offer extremely efficient verification but carry this initial trust baggage. In contrast, zk-STARKs and some newer recursive SNARKs are designed to be transparent, meaning they require no trusted setup and rely solely on public randomness. The choice between systems often involves a trade-off: accepting a one-time, carefully engineered trust assumption for superior performance, or opting for transparency at the cost of higher computational overhead.
CRYPTOGRAPHIC CEREMONY COMPARISON
Trusted vs. Transparent Setup
A comparison of the security assumptions and properties of two types of cryptographic parameter generation ceremonies used in zk-SNARKs and other protocols.
| Feature | Trusted Setup | Transparent Setup |
|---|---|---|
Cryptographic Assumption | Requires at least one honest participant in the ceremony | No trusted setup; relies on public randomness |
Ceremony Process | Multi-party computation (MPC) with secret sharing | Publicly verifiable, non-interactive generation |
Toxic Waste | Generated and must be securely destroyed by participants | Not generated; no secret parameters to discard |
Post-Ceremony Trust | Requires ongoing trust that all participants deleted their secrets | No ongoing trust required after parameter generation |
Example Protocols | Zcash (original Sprout), Tornado Cash, Polygon zkEVM | Zcash (Sapling, Halo 2), Mina Protocol, Filecoin |
Security Failure Consequence | If all participants collude, they can create undetectable counterfeit proofs | Security is based on public cryptographic assumptions (e.g., discrete log) |
Ceremony Complexity | High; requires secure multi-party coordination | Low; parameters are generated from public data |
Auditability | Limited; relies on ceremony participants' honesty | Fully auditable; all steps are publicly verifiable |
security-considerations
TRUSTED SETUP
Security Considerations & Risks
A trusted setup is a one-time, foundational ceremony to generate the initial cryptographic parameters for certain zero-knowledge proof systems. Its security relies on the assumption that at least one participant in the ceremony was honest and destroyed their secret material.
01
The Ceremony & Secret Destruction
A trusted setup ceremony involves multiple participants sequentially contributing randomness to generate a final set of public parameters (e.g., a Common Reference String or Structured Reference String). The core security assumption is that at least one participant is honest and destroys their secret 'toxic waste'. If all participants collude and retain their secrets, they could potentially generate fraudulent proofs. This makes the ceremony's integrity and transparency paramount.
02
Permanent System Risk
Unlike ongoing consensus or cryptographic assumptions, a trusted setup creates a permanent, system-wide risk. If the ceremony is compromised, the entire cryptographic foundation of the application is broken, potentially allowing for:
- Counterfeit asset creation (minting tokens from nothing)
- Double-spending
- Censorship of valid transactions This risk cannot be patched post-deployment without a new setup and network migration.
03
Trust Minimization Techniques
Protocols employ several methods to minimize trust in the setup:
- Multi-Party Computation (MPC): Distributes trust among many participants.
- Public Ceremonies: Open participation increases the likelihood of an honest actor.
- Verifiable Delay Functions (VDFs): Can be used to create randomness without a trusted party, enabling trustless setups for some systems.
- Ceremony Audits: Public recording and verification of each participant's steps.
04
Real-World Examples & Impact
Major networks have undergone high-profile ceremonies, demonstrating the scale of the risk and effort involved:
- Zcash (2016): The original 'Powers of Tau' ceremony for zk-SNARKs, involving 6 participants.
- Ethereum's KZG Ceremony (2023): A massive public ceremony for EIP-4844 (proto-danksharding), with over 141,000 contributions, significantly raising the bar for collusion.
- Tornado Cash: Its initial setup required trust in a small group of developers, a point of centralization criticism.
05
Trusted vs. Trustless Systems
This is a key architectural distinction in cryptography:
- Trusted Setup Required: Systems like Groth16 zk-SNARKs require a one-time ceremony. The risk is 'front-loaded'.
- Trustless (Transparent) Setup: Systems like Bulletproofs and STARKs use publicly verifiable randomness, eliminating this specific trust assumption. The trade-off is often larger proof sizes or higher verification costs.
06
Auditing & Verification
For systems using a trusted setup, rigorous external security audits are non-negotiable. Auditors must verify:
- The correctness of the cryptographic implementation.
- The integrity of the ceremony procedure.
- The proper destruction of secret material by participants.
- The use of secure, air-gapped hardware during the ceremony. The audit report is a critical component of the system's security claims.
TRUSTED SETUP
Common Misconceptions
Clarifying the technical realities behind the most misunderstood security components in modern cryptography.
A trusted setup is a one-time cryptographic ceremony where a set of secret parameters is generated and subsequently destroyed, establishing the foundational public parameters for certain zero-knowledge proof systems like zk-SNARKs. It is necessary because these proof systems require a common reference string (CRS) that is generated with secret knowledge; if that secret is later compromised, an attacker could create fraudulent proofs. The ceremony's security relies on the assumption that at least one participant in the multi-party computation (MPC) was honest and destroyed their secret share, making the final parameters trustworthy. Notable examples include the Zcash Sprout ceremony (Powers of Tau) and Ethereum's KZG ceremony for proto-danksharding.
TRUSTED SETUP
Frequently Asked Questions
A trusted setup is a foundational cryptographic ceremony required to generate the initial parameters for certain zero-knowledge proof systems. These FAQs address common concerns about its necessity, security, and real-world implementations.
A trusted setup is a one-time cryptographic ceremony where a group of participants collaboratively generates the initial parameters, known as a Common Reference String (CRS) or Structured Reference String (SRS), for a zk-SNARK or similar zero-knowledge proof system. This process is "trusted" because if even one participant is honest and destroys their secret randomness, the final parameters are secure. However, if all participants collude, they could potentially create fraudulent proofs. The ceremony's output is a public parameter set used by all subsequent provers and verifiers on the network.
Key components:
- Participants: Multiple parties contribute secret randomness.
- Toxic Waste: The secret randomness that must be discarded.
- CRS/SRS: The final, public parameters generated from the ceremony.
ENQUIRY
Get In Touch
today.
Our experts will offer a free quote and a 30min call to discuss your project.
NDA Protected
Confidentiality24h Response
Time to ValueDirectly to Engineering Team
No Sales Fluff10+
Protocols Shipped
$20M+
TVL Overall