Interactive cryptography

Trusted Setup Ceremonies

Follow the transcript from first public parameters to final protocol artifact, then compare Ethereum KZG, Zcash Sprout, and Zcash Sapling.

Read blog
Current step

Define the artifact

A ceremony starts by naming the exact public parameters future users will rely on and the exact trapdoor that must not survive.

Role play enabledProtocol designer

Declare exactly what artifact users will trust and what attack the setup must prevent.

Your timed turn

Name the public artifact and the failure consequence you are trying to prevent.

45s
  • mentions the artifact or parameters
  • mentions trapdoor or toxic-waste risk
Validated 0 of 6 sections0%
  • Protocol use is explicit
  • Parameter size is fixed
  • Failure consequence is written down
requirementsProtocolNeedCoordinatorEntropyParticipantTranscriptSRSVerifierProtocolRelease
Secrets and data flow

Ethereum KZG Ceremony end to end

Private material is simulated here so the flow is visible without exposing real ceremony secrets.

KZG tau
PhaseRolePrivate materialPublic evidenceState
1. ScopeProtocol designerKZG tau is named as the danger, not used yetA KZG trusted setup transcript for EIP-4844 and future danksharding work.threat model declared
2. InitializeCeremony coordinatorinitial seed or prior-phase randomness must stay unrecoverableT0 bytes, transcript format, starting hashpublic transcript starts
3. ContributeEntropy contributor4 contribution secrets tracked; not generated until you add a simulated contributionupdated transcript hash, contribution proof, inclusion handle4 listed secret sources marked deleted
4. VerifyTranscript verifierno trapdoor needed by verifiertransition proof, subgroup checks, transcript hash chainvalid transitions advance; malformed updates stop
5. PublishRelease engineerno ceremony secret should remain in releases, logs, or machinesfinal artifact bytes, final hash, verifier scripts, source linkspublic parameters become protocol input
6. TrustAdversarial auditortau_final = tau0 * secret_1 * secret_2 * ... * secret_nThe setup is secure under the 1-of-N assumption: one honest hidden contribution is enough.valid if at least one required secret was deleted
Concrete toy SRS

Real numbers for [G, tau*G, tau^2*G, tau^3*G]

This is a hand-checkable additive-group model modulo 97. Real KZG ceremonies use elliptic-curve scalar multiplication, but the data-flow shape is the same.

G = 5tau = 7mod = 97
Initial transcript

Before contributions

TermScalarPoint data
G1 = 11 * 5 mod 97 = 5
tau^1 * G7^1 mod 97 = 77 * 5 mod 97 = 35
tau^2 * G7^2 mod 97 = 4949 * 5 mod 97 = 51
tau^3 * G7^3 mod 97 = 5252 * 5 mod 97 = 66
Participant updates

Mix two secrets

Alice secret a = 3
Bob secret b = 11

tau_final = tau * a * b mod 97
tau_final = 7 * 3 * 11 mod 97
tau_final = 231 mod 97
tau_final = 37
Final transcript

After honest deletion

TermScalarPoint data
G1 = 11 * 5 mod 97 = 5
tau^1 * G37^1 mod 97 = 3737 * 5 mod 97 = 88
tau^2 * G37^2 mod 97 = 1111 * 5 mod 97 = 55
tau^3 * G37^3 mod 97 = 1919 * 5 mod 97 = 95
Trust assumption

Credible under the ceremony assumption

The setup is secure under the 1-of-N assumption: one honest hidden contribution is enough. Toggle the adversary model to see the difference between one honest deletion and total compromise.

tau_final stays hiddentau_final = tau0 * secret_1 * secret_2 * ... * secret_n
Ceremony exercise

Continue until every section is validated

Each section needs a valid timed answer before the walkthrough is complete.

0/6
Contribution ledger

141,416 contributions

ContributorRoleEntropyEvidenceSecret
SIWE contributorspublic browser pathbrowser-generated randomnessaccount-authenticated contributiondeleted
GitHub contributorspublic browser pathbrowser-generated randomnessGitHub-authenticated contributiondeleted
CLI contributorslocal implementation pathlocal machine entropytranscript verificationdeleted
Special contributorsbespoke entropy and isolated setupshardware, physical, or creative entropypublic writeups and transcript locationsdeleted
Case study flow

Ethereum KZG Ceremony

  1. Ethereum specified a KZG Powers of Tau setup for EIP-4844.
  2. Participants joined through browser, CLI, and special contribution paths.
  3. The sequencer queued contributors and verified each contribution.
  4. The final transcript was published with hash and verification paths.
  5. Dencun brought EIP-4844 blobs to Ethereum mainnet on March 13, 2024.
Primary sources
KZG announcementKZG wrap-upEIP-4844KZG specs