Trusted setup

A trusted setup runs as multi-party computation (MPC): many participants contribute randomness in sequence, and it is enough for a single one to be honest and erase their share for the SRS to be secure, the so-called 1-of-n assumption. There are two classes. The per-circuit setup, as in Groth16, requires a ceremony for each circuit. The universal, updatable setup, as in PLONK, Sonic or Marlin, produces a reusable, extendable ceremony. A common Powers of Tau phase, independent of the circuit, is typically followed by a circuit-dependent phase.

It is the point of greatest scrutiny for auditors: a compromised setup breaks the soundness of the whole system, since the secret could create valid proofs of false statements. That exposure motivates both universal setups and the adoption of zk-STARKs, which are transparent and need no ceremony. For tokenized financial infrastructure, documenting the ceremony well is part of technical due diligence.

The largest-scale case is Ethereum's KZG Ceremony, which ran through 2023 for the EIP-4844 upgrade (proto-danksharding): more than 141,000 contributions make the 1-of-n assumption extremely robust. Contributions are authenticated with digital signatures and recorded with hash functions, and can be documented through on-chain attestations. The absence of this requirement is precisely the advantage that zk-STARKs claim.