A zero-knowledge proof system needs public parameters, called a common reference string (CRS). A transparent setup creates those parameters without asking a trusted third party to generate them, avoiding secret “toxic waste” held by a ceremony participant. section 15.3
The setup choice changes the trust model:
- Trusted setups may be efficient and produce short proofs, but their creators can hold secrets capable of forging proofs. section 15.3
- Multiparty computation can reduce trusted-setup risk if at least one participant is honest and deletes their secret. section 15.3
- Transparent schemes require no trusted third party and are universal by design, meaning they can prove any circuit within a stated size bound. section 15.3
Figure 15.11 General-purpose ZKPs allow a prover to convince a verifier about the integrity of an execution trace (the inputs of a program and the outputs obtained after its execution) while hiding some of the inputs or outputs involved in the computation. An example of this is a prover trying to prove that a sudoku can be solved.
Use the execution-trace example to see the broader zero-knowledge setting in which setup choices support proofs about hidden inputs or outputs. section 15.3
