Trusted setup ceremony

Many zero-knowledge proof systems and polynomial commitments, including Groth16 SNARKs and KZG commitments, need a structured reference string created from secret random values. If anyone kept those values, often called toxic waste, they could forge proofs that look valid. A ceremony spreads the generation across many participants, each adding their own randomness and destroying it, so the result is safe as long as at least one participant was honest.

Early ceremonies were small: Zcash's 2016 launch used six participants. Later designs such as Powers of Tau allowed thousands. Ethereum's KZG ceremony in 2023, which prepared parameters for blob transactions, collected over 140,000 contributions from people around the world, many through a browser, making it one of the largest such efforts.

The trust assumption is weak but real: users must believe that at least one contributor destroyed their secret and that the ceremony software worked correctly. Some proof systems, such as STARKs and Bulletproofs, avoid trusted setups entirely, at the cost of larger proofs or slower verification. Ceremonies also need careful public verification of each step.