Trusted Setup

What Is a Trusted Setup?

A trusted setup is an initialization phase that produces public cryptographic parameters, known as a Common Reference String (CRS) or Structured Reference String (SRS), needed by certain zk-SNARK proof systems. During the ceremony, participants generate secret random values and use them to compute elliptic curve points that encode a hidden mathematical structure. These points become the public parameters that provers and verifiers rely on to create and check proofs.

The setup is called "trusted" because participants must be trusted to destroy the secret randomness after the parameters are generated. This secret randomness is often referred to as "toxic waste": if it is ever reconstructed, an attacker can forge proofs for false statements that pass verification. In a cryptocurrency context, this could mean creating counterfeit coins out of thin air with no way for anyone to detect the forgery.

The trust requirement is minimized through multi-party computation (MPC) ceremonies, where many independent participants each contribute their own randomness. The composite secret can only be reconstructed if every single participant colludes or is compromised. If even one participant honestly destroys their share, the system is secure.

How It Works

The most widely used ceremony protocol is Powers of Tau, which constructs the structured reference string through sequential contributions. Each participant builds on the work of the previous one, layering in additional randomness.

1. Participant 1 generates a secret value s₁, computes a series of elliptic curve points [s₁⁰]G, [s₁¹]G, [s₁²]G, ... [s₁ⁿ]G, publishes the result, and destroys s₁
2. Participant 2 receives the output, generates their own secret s₂, multiplies each point by the corresponding power of s₂ to produce [(s₁·s₂)ⁱ]G, publishes the result, and destroys s₂
3. This process repeats for all N participants, each layering in new randomness
4. The final output encodes the composite secret τ = s₁ · s₂ · ... · sₙ, which no single party knows

Each participant also provides a proof of knowledge: cryptographic evidence that they correctly multiplied by a value they know, preventing anyone from sabotaging the ceremony by submitting invalid data.

Circuit-Specific vs. Universal Setups

Not all trusted setups work the same way. The distinction between circuit-specific and universal setups determines how much ceremony overhead a project faces.

Groth16, the most compact proof system, requires a circuit-specific setup. The ceremony encodes the exact constraint structure of the computation being proved. If the circuit changes by even a single constraint, the entire ceremony must be re-run. This makes Groth16 impractical for rapidly evolving applications.

PLONK introduced a universal setup: one ceremony produces parameters usable for any circuit up to a bounded size. Circuit-specific preprocessing is done locally by the prover without any additional ceremony. Furthermore, PLONK's SRS is updatable: anyone can add randomness at any time to strengthen security, making the setup "perpetual."

Two-Phase Structure

For systems like Groth16 that require circuit-specific parameters, the ceremony typically runs in two phases:

1. Phase 1 (Powers of Tau): a generic, circuit-independent ceremony that generates powers of tau on the elliptic curve. This output can be reused across many different circuits.
2. Phase 2 (circuit-specific): takes the Phase 1 output and specializes it for a particular circuit by incorporating its constraint structure. Each distinct application needs its own Phase 2.

Verifying a Ceremony

Ceremony transcripts are publicly verifiable. Anyone can check that each participant correctly applied their contribution by verifying the proofs of knowledge in the transcript. A typical verification script checks pairing consistency:

# Verify Powers of Tau transcript consistency
# For each consecutive pair of contributions (i, i+1):
#   e(τ_new[1], G2) == e(G1, τ_new_g2[1])
#   e(τ_new[k], G2) == e(τ_new[k-1], τ_new_g2[1])
#
# This confirms each participant multiplied by
# a consistent secret across all powers.

Real-World Ceremonies

Zcash Sprout (2016)

The first major trusted setup ceremony was conducted for Zcash's Sprout launch in October 2016. Six participants, including cryptographer Peter Todd and (as later revealed in 2022) Edward Snowden, generated the initial parameters. Participants went to extraordinary lengths to destroy their secrets: burning optical discs, smashing computers, and physically destroying hardware. However, the small, pre-selected group raised concerns about collusion risk.

Zcash Sapling (2017-2018)

For the Sapling upgrade, Zcash ran a much larger ceremony with open participation. Phase 1 (Powers of Tau) attracted 87 contributors over several months, and the full ceremony involved approximately 90 participants. Unlike Sprout, anyone could join without pre-selection. The ceremony ran from November 2017 through April 2018, and the Sapling network upgrade activated on October 28, 2018, using the Groth16 proof system.

Ethereum KZG Ceremony (2023)

The largest trusted setup ceremony to date was Ethereum's KZG ceremony for EIP-4844 (proto-danksharding). Running from January to August 2023, it received 141,416 contributions: over 200 times the scale of any prior ceremony. Contributors authenticated via Ethereum addresses or GitHub accounts. Fourteen participants used unconventional entropy sources, including chemical reactions and lightning detection. The resulting parameters power blob transactions across all Ethereum Layer 2 rollups, which saw costs drop approximately 90% after EIP-4844 activated in March 2024.

The Toxic Waste Problem

The security of every system built on a trusted setup depends entirely on the destruction of the secret randomness. This "toxic waste" problem is the central risk.

If an attacker reconstructs the composite secret τ, they can construct valid-looking proofs for false statements. In a Groth16-based system, a proof consists of three elliptic curve points (A, B, C) that satisfy a pairing equation. Knowledge of the trapdoor values allows an attacker to manipulate these points to satisfy the equation without knowing the actual witness: the computation being proved.

The consequences vary by application:

• In privacy coins: the attacker can mint unlimited counterfeit currency within the shielded pool, invisible to auditors
• In zk-rollups: false state transitions could be proved valid, enabling theft of user funds
• In identity systems: forged credentials could bypass verification checks

Critically, forged proofs are indistinguishable from legitimate ones. There is no way to detect that a forgery has occurred by examining the proof itself.

Transparent Alternatives

The risks of trusted setups have driven significant research into transparent proof systems that require no ceremony at all. These systems trade off proof compactness for the elimination of setup trust.

zk-STARKs

STARKs (Scalable Transparent Arguments of Knowledge) use hash functions and algebraic coding theory instead of elliptic curve pairings. They require only a public random string as a parameter, which can be generated from a seed or random beacon with no ceremony. STARKs are also resistant to quantum computing attacks because they rely on collision-resistant hash functions rather than the discrete logarithm problem. The tradeoff: STARK proofs are significantly larger, typically 40 to 200 KB compared to under 300 bytes for Groth16.

Bulletproofs

Bulletproofs use Pedersen commitments and an inner product argument to produce proofs without any trusted setup. Proof size scales logarithmically with the statement size: a 64-bit range proof is approximately 576 to 672 bytes. Monero adopted Bulletproofs in October 2018, reducing transaction sizes by roughly 80% and fees by approximately 96%. The tradeoff is linear verification time O(N), which makes Bulletproofs slower to verify than SNARKs for large circuits.

Comparison

The choice between these systems depends on application requirements. On-chain verification on Ethereum favors Groth16 or PLONK due to their constant-size proofs and low gas costs. Applications that cannot tolerate any setup trust, or that need quantum resistance, lean toward STARKs despite the larger proofs. For more on how these systems apply to Bitcoin, see the research article on zero-knowledge proofs in Bitcoin.

Why It Matters

Trusted setups sit at the foundation of some of the most important scaling and privacy technologies in cryptocurrency. Every zk-rollup that uses SNARK-based proofs, every privacy-preserving transaction system, and Ethereum's blob data layer all depend on parameters generated through these ceremonies.

Understanding trusted setups helps evaluate the security assumptions of any protocol that uses zero-knowledge proofs. A system built on Groth16 with a 6-person ceremony carries fundamentally different trust assumptions than one built on PLONK with 141,000 contributors, or one using STARKs with no ceremony at all.

The trend in the industry is toward reducing or eliminating trusted setup requirements. Hybrid approaches like zkVMs (SP1, RISC Zero) wrap STARK proofs inside SNARK verifiers to achieve small proof sizes without per-circuit trusted setups. Newer transparent systems like Binius aim to close the proof-size gap further. However, Groth16 and PLONK remain dominant for on-chain verification due to their unmatched compactness, meaning trusted setups will remain relevant for the foreseeable future.

Risks and Considerations

Collusion Risk

While the 1-of-N honesty assumption is theoretically strong, it assumes that participants actually generate independent randomness and genuinely destroy it. A state-level adversary capable of compromising all participants (through surveillance, coercion, or supply chain attacks on their hardware) could potentially reconstruct the toxic waste. Larger ceremonies with diverse, geographically distributed participants significantly reduce this risk.

Implementation Vulnerabilities

Even a perfectly executed ceremony cannot protect against bugs in the underlying proof system. In 2018, a vulnerability was discovered in the BCTV14 proof system used by Zcash Sprout: anyone with access to the ceremony transcript could have forged proofs, regardless of whether the toxic waste was destroyed. The bug was in the mathematics of the proof system, not the ceremony itself. This was fixed in the Sapling upgrade.

Ceremony Coordination

Running a trusted setup ceremony requires significant coordination. Participants need reliable software, secure hardware, and the technical knowledge to contribute correctly. The ceremony coordinator must ensure availability, handle timeouts, and publish verifiable transcripts. On-chain ceremony protocols (like a16z's evm-powers-of-tau) aim to reduce this burden by running ceremonies permissionlessly via smart contracts.

Irrevocability

Once a trusted setup is complete and a system is deployed using its parameters, the security assumption is permanent. There is no way to retroactively verify that all participants destroyed their secrets. The system is either secure (at least one participant was honest) or compromised (all participants colluded), and there is no test to determine which. This is fundamentally different from transparent systems, where security relies only on public mathematical properties that anyone can verify at any time.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.