Trusted Setup Ceremony

The fundamental security guarantee of a trusted setup ceremony is the 1-of-N trust assumption. The entire protocol remains secure as long as a single participant is honest and destroys their secret randomness. Even if all other participants collude maliciously, they cannot reconstruct the toxic waste needed to forge proofs. This transforms a centralized trust assumption into a decentralized, probabilistic one where the ceremony's integrity scales with the number of independent, verifiable participants.

Toxic waste refers to the secret random values generated by each participant during the ceremony. If these values are retained, an attacker can construct false proofs that pass verification. The term originates from Zcash's original ceremony. Key properties:

• Each participant generates a secret scalar
• The secret is combined with the previous state using multi-exponentiation
• The participant must irretrievably destroy this secret after their contribution
• The final structured reference string is a function of all secrets combined

The ceremony proceeds as a sequential chain of contributions, not parallel. Each participant:

1. Downloads the current state of the Common Reference String (CRS)
2. Verifies all previous contributions using pairing checks
3. Generates fresh randomness and updates the CRS
4. Publishes the updated state with a proof of correct contribution This sequential structure ensures that the final parameters are a product of all independent randomness sources, creating a cryptographic ratchet that cannot be reversed.

Each participant must produce a proof of correct contribution that can be verified by all subsequent participants and external observers. This prevents malicious actors from sabotaging the ceremony by submitting invalid updates. The verification typically involves:

• Pairing-based checks confirming the update is consistent
• Zero-knowledge proofs attesting knowledge of the secret without revealing it
• Public transcripts allowing perpetual auditability of every contribution This ensures the ceremony is publicly verifiable from start to finish.

Trusted setups fall into two categories:

Circuit-Specific (e.g., Groth16)

• The ceremony is tied to a single circuit
• Any change to the circuit requires a new ceremony
• Produces the smallest proof sizes and fastest verification

Universal & Updatable (e.g., Plonk)

• A single ceremony supports any circuit up to a bounded size
• New circuits can be added without re-running the ceremony
• The setup can be perpetually updated with new contributions to strengthen security over time

Participants must generate high-quality randomness in an environment isolated from potential exfiltration. Best practices include:

• Air-gapped machines disconnected from all networks
• Multiple entropy sources: hardware RNG, mouse movement, radioactive decay
• Ephemeral operating systems booted from read-only media
• Physical destruction of storage media after contribution
• Witness encryption to protect secrets during the contribution process Compromised entropy generation can undermine the entire ceremony's security, making operational security paramount.

The structured public parameters generated as the direct output of a trusted setup ceremony. The CRS is shared between prover and verifier and encodes the circuit-specific or universal structure needed to create and check proofs. In pairing-based systems like Groth16, the CRS contains elements in both G1 and G2 groups. Security depends entirely on the integrity of the ceremony—if the toxic waste was not destroyed, the CRS enables undetectable forgery of proofs.

The secret random values generated by each participant during a trusted setup ceremony that must be destroyed to preserve soundness. If retained, toxic waste enables an attacker to construct fraudulent proofs that pass verification. The term originates from Zcash's original ceremony, where participants generated secret randomness and then securely deleted it. Multi-party ceremonies reduce risk: only one honest participant needs to destroy their toxic waste for the entire setup to be secure.

A single, one-time trusted setup ceremony that generates a structured reference string capable of supporting any circuit up to a pre-defined maximum size. Unlike circuit-specific setups (Groth16), a universal setup like Plonk's requires only one ceremony for an entire ecosystem. New applications can reuse the existing CRS without repeating the ceremony. The updatable nature allows new participants to continuously strengthen security by contributing fresh randomness to the existing parameters.

A compact cryptographic key derived from the CRS and circuit definition that a verifier uses to efficiently check proof validity. The verification key is typically small (a few hundred bytes) and can be embedded on-chain or in resource-constrained environments. In a trusted setup, the verification key's integrity is directly tied to the ceremony's security—a compromised setup produces a verification key that accepts forged proofs as valid.