Khám phá "trusted setup là gì" — tại sao một nghi thức tạo tham số bí mật lại quyết định độ an toàn của toàn bộ hệ thống zero-knowledge proof, và vì sao "chất thải độc hại" (toxic waste) phải bị tiêu hủy.
Imagine a village that trusts exactly ONE locksmith. Years ago, he made a master template that can cut a key to every single door in town. Convenient — one key, any house. But the moment that locksmith keeps a copy of the template, the whole village is hostage to one man. If he forges a key, every home is open. The only safe outcome is that the template is made, used to cut all the locks, and then destroyed forever.
This is the essence of a trusted setup. In the world of zero-knowledge proofs (ZK), "trusted setup là gì" is one of the most important questions a beginner must answer — because it is the quiet secret at the heart of some of the most powerful cryptography in use today.
The Single Key Cutter: A Village in Danger
Let's stay with the locksmith. The village's problem isn't the locksmith's skill — it's his power. Whoever holds the master template holds the ability to enter any home. The security of the whole system collapses to a single point of trust: will he really destroy the template?
In cryptography, the master template is called the secret setup exponent, usually written as τ (tau). The public parameters that everyone uses — the proving key and verification key — are built from τ, but carefully disguised so nobody can reverse-engineer the secret.
The cruel trick of trusted setup: the secret must exist briefly, be used, and then vanish. If even a copy survives, an attacker can forge proofs for statements that are false — like cutting a key to a door they were never allowed to open.
That surviving secret has a famous name in the ZK community: toxic waste. Possessing it doesn't just weaken the system — it breaks it.
From Locksmith to Math: What a Trusted Setup Actually Is
A zero-knowledge SNARK lets a prover convince a verifier that a statement is true without revealing why. But most practical SNARKs (like the famous Groth16) need a one-time, secret-dependent setup before they can run.
That setup produces a Structured Reference String (SRS) — a set of public parameters — plus a proving key and a verification key. The security guarantee is simple: as long as the secret randomness used to build them is destroyed, the system is sound.
If instead a single person generates that secret and keeps it, you have the single key cutter problem again — one person can forge anything.
Figure 1: The single key cutter problem — one person holding the master template
The Toxic Waste Problem
Here is the uncomfortable part. To build secure public parameters, someone (or some process) must first generate a secret. That secret is τ. Everything downstream trusts that τ is gone.
The danger is not hypothetical. In Zcash's original Sprout ceremony (2016), only six participants generated the parameters for shielded transactions. If all six colluded — or if even one of the six failed to destroy their shard while the others shared — an attacker could counterfeit shielded value.
That's why "one person holds the master key" is so dangerous. It asks you to trust a person, not a process.
The Fix: The Multi-Party Ceremony (Ceremony ZK Snark)
The breakthrough insight: you don't need to trust one locksmith. You can make the whole village participate — and as long as at least one villager keeps their own scratch a secret, nobody can reconstruct the master template.
This is the multi-party computation (MPC) ceremony, known in the community as a ceremony zk snark.
Here's the intuition:
- Participant 1 generates a secret, mixes it in, then destroys their shard.
- Participant 2 takes the result, adds their own secret, destroys their shard.
- …and so on, for dozens or hundreds of people.
At the end, the final public parameters are a blend of everyone's secrets. To recover the master template, an attacker would need to know every single participant's shard. If just one person — anywhere in the chain — was honest and destroyed theirs, the final parameters are safe.
The security model is called "1-of-n": among n participants, at least one must be honest.
Zcash's Powers of Tau (2017–2018) collected 87 contributions for the phase-1, circuit-agnostic parameters. The Ethereum Foundation's KZG ceremony (2023) collected an astonishing 141,416 contributions over 208 days for the blob-commitment setup behind EIP-4844. The more diverse the participants — different hardware, operating systems, and even physical entropy sources — the stronger the guarantee.
Figure 2: The multi-party ceremony — as long as one participant is honest
Groth16 Setup: One Ceremony Per Circuit
Not all trusted setups are equal. Groth16 — the workhorse SNARK behind Zcash Sapling and countless rollups — requires a per-circuit trusted setup. That means:
- Every time you write a new circuit (a new program), you must run a new ceremony.
- If you change the circuit logic, you must run another ceremony.
- The payoff: the smallest proofs (~128–200 bytes) and the fastest verification.
This is the groth16 setup trade-off — tiny proofs, but a fresh "key-cutter event" for every door you want to protect. For a stable, high-value circuit (like Zcash's shielded payments), that's a price worth paying.
PLONK: The Universal Setup
PLONK (2019) solves the "new ceremony every time" problem with a universal and updatable trusted setup.
- One ceremony (like the Perpetual Powers of Tau) generates parameters that serve any circuit up to a fixed size bound.
- Add a new circuit later? No new ceremony needed — the existing parameters work.
- The cost: proofs are larger (~400–800 bytes) and verification is a bit more expensive on-chain.
PLONK's approach is why teams like Aztec and zkSync can iterate rapidly: they set up once, then ship many circuits without repeating the ceremony.
Figure 3: Groth16 per-circuit setup vs PLONK universal setup
The Transparent Escape Hatch: STARKs
What if you could avoid the key cutter entirely? That's the promise of transparent setups.
STARKs (and Halo2-style systems using IPA commitments) need no ceremony at all. There is no secret τ to protect, no toxic waste, and therefore no single key cutter. The public parameters are derived from public, verifiable randomness — anyone can re-derive them.
The trade-off: STARK proofs are much larger (~50–200 KB vs ~200 bytes for Groth16), and proving is slower. But they are also post-quantum resistant because they rely only on hash functions, not on elliptic-curve pairings that a quantum computer could break.
Zcash's newer Orchard shielded protocol (NU5, 2022) switched to Halo 2, dropping the trusted setup for that protocol entirely. The industry is slowly moving from "trust one ceremony" toward "trust no ceremony."
Figure 4: Trusted setup vs transparent setup
FAQ
Trusted setup là gì?
Trusted setup là quá trình tạo các tham số công khai (proving key, verification key) cho một hệ thống zero-knowledge proof bằng cách dùng một bí mật ngắn gọi là τ (tau). Bí mật này phải bị tiêu hủy sau khi tạo tham số — nếu lộ ra, kẻ tấn công có thể giả mạo bằng chứng.Why must the secret be destroyed?
Because the secret (τ) is the "master template." If it survives, an attacker can forge proofs for false statements, breaking the soundness of the entire system.Does a leak reveal my private data?
No. Leaking τ breaks soundness (proofs can be forged), but it does not reveal the private contents of transactions. Privacy and soundness are two different guarantees.Is one honest participant really enough?
Yes — in an MPC ceremony, the final parameters mix everyone's secrets. To reconstruct the master secret, an attacker needs all of them. One honest person who destroyed their shard blocks the attack.What's the difference between Groth16 and PLONK setup?
Groth16 needs a new per-circuit ceremony but gives the smallest proofs. PLONK uses one universal ceremony for any circuit up to a size bound, at the cost of larger proofs.Can we avoid trusted setup entirely?
Yes — STARKs and Halo2-style systems are transparent: no secret, no ceremony, no toxic waste. The price is larger proofs and slower proving.Conclusion
The "single key cutter" problem is the heart of trusted setup. Whether you use Groth16's per-circuit ceremony, PLONK's universal setup, or skip it entirely with transparent STARKs, the underlying question is always the same: who holds the master template, and will it be destroyed?
The elegant answer of the multi-party ceremony — as long as one honest person keeps their secret, the whole system is safe — is one of the most beautiful ideas in modern cryptography. And the march toward transparent setups shows that, increasingly, the best key cutter is the one who never exists at all.