A common reference string (CRS) is public setup data shared by a prover and verifier in a pairing-based zero-knowledge proof. It is derived for a particular quadratic arithmetic program (QAP), then reused to create and check proofs for individual records. Public statement values remain visible to the verifier; private witness values are used by the prover without being revealed. section 19.4 section 19.7
The CRS lets a prover demonstrate knowledge of values satisfying the QAP while preventing recovery of witness values from the public statement. It also binds proofs to the intended QAP: changing a formula or faking a CRS point breaks verification. Everyone can access the QAP formulas and CRS, so records can be proved and verified independently. section 19.4
Equation 19.12
\[\begin{gathered} α G, 𝛽 G, 𝛿 G,\left\{z^i G\right\}_{i=0}^{n-1},\left\{\dfrac{z^it(z)}{𝛿}G\right\}_{i=0}^{n-2}\\ \left\{\dfrac{𝜃_i}{𝛾}G\right\}_{i=0}^l,\left\{\dfrac{𝜃_i}{𝛿}G\right\}_{i=l+1}^m,\\ 𝛽 H, 𝛿 H, \left\{z^i H\right\}_{i=0}^{n-1} \end{gathered} \label{zq11}\]The CRS is a collection of G₁ and G₂ elliptic-curve points. It includes masked parameters, powers of a secret evaluation point z, QAP-derived θᵢ values split between statement and witness variables, and values involving t(z)/δ. section 19.4
CRS generation follows a concrete setup sequence:
- Read the pairing-friendly curve parameters and QAP dimensions, coefficients, wire ordering, and statement/witness split point l. section 19.5.3
- Choose random α, β, γ, δ, and z values modulo the curve torsion; these secret setup values are toxic waste. section 19.4 section 19.5.3
- Compute z powers and θᵢ = βvᵢ(z) + αwᵢ(z) + yᵢ(z), then divide θᵢ for statement variables by γ and for witness variables by δ. section 19.4 section 19.5.3
- Switch from torsion-field arithmetic to elliptic-curve arithmetic, multiply the scalars by G₁ or G₂ base points, and serialize the resulting point vectors as CRS data. section 19.5.3
Toxic waste must be lost after setup. If an adversary learns the random values used to generate the CRS, they could create proofs with arbitrary inputs. Structured reference strings (SRS) are described as updateable approaches to the same setup problem, but the essential role remains a public collection of curve points carrying QAP information. section 19.4 section 19.7
CRS in a zk-SNARK file pipeline
A fixed QAP is written first. A CRS generator reads that QAP and writes the points specified by the CRS construction. The prover reads both files to create proof points A, B, and C for a record; the verifier reads the CRS and record to evaluate the pairing check. This arrangement makes proof creation comparatively slow when many witness values exist, while verification remains fast. section 19.5 section 19.7
Figure 19.5 SNARK example code subroutine relationships
The program relationship diagram makes the dependency order explicit: generate the QAP, generate the CRS, create a proof, then verify it. section 19.5
During verification, the verifier combines the public statement contribution V with CRS points and proof points in a pairing equality. The prover’s private witness contribution is embedded in the proof, while the verifier needs only public statement values, the CRS, and the proof. Random prover values r and s make proofs for separate records distinct and limit information leakage across records. section 19.4 section 19.7
