Universal Setup

Unlike circuit-specific setups (e.g., Groth16), a universal setup generates a Structured Reference String (SRS) once. This single SRS can then be reused to prove any statement, provided the arithmetic circuit representing that statement does not exceed the pre-defined maximum number of gates. This decouples the expensive, security-critical setup phase from application development.

The security of the initial SRS can be strengthened over time through updatable setup ceremonies. New participants can contribute randomness to the existing SRS without invalidating prior proofs. As long as a single participant in the entire chain of updates destroys their secret randomness (the 'toxic waste'), the final SRS is secure. This allows for continuous, trust-minimized security hardening.

The universal SRS is fundamentally a sequence of powers of a secret scalar encoded in an elliptic curve group, structured to support polynomial commitment schemes like KZG. During a preprocessing phase, the specific constraint system of an application circuit is encoded into polynomials and committed to using this universal SRS, generating a circuit-specific proving key and verification key without a new trusted setup.

The 'universality' is bounded. The SRS is generated with a parameter n, representing the maximum number of gates the system can support. A circuit with n+1 gates cannot be proven using an SRS generated for size n. This requires developers to estimate an upper bound for their application's complexity before the ceremony, balancing future flexibility against the size and generation cost of the SRS.

The universal setup is a core architectural innovation of the Plonk proving system and its derivatives. It enables a single, large-scale ceremony to serve an entire ecosystem. This contrasts sharply with Groth16, which requires a unique, application-specific setup for each new circuit, making universal setups far more practical for platforms and protocols with evolving logic.

The generation of the universal SRS is a Multi-Party Computation (MPC) protocol. Participants contribute randomness sequentially, and the final parameters are a composite of all contributions. The protocol is designed so that the output is correct if at least one participant is honest and destroys their contribution. This '1-of-N' trust assumption is the bedrock of the ceremony's security model.

A property allowing new participants to refresh the structured reference string by contributing additional randomness without invalidating existing circuits or proofs. In a universal setup, updatability works via the powers-of-tau structure: a new participant takes the current SRS [s^i]_1 and outputs [s'^i]_1 where s' = s * r for their secret r. This enables continuous security hardening—even if all prior participants colluded, a single honest update restores soundness. Critical for long-lived deployment ecosystems.