A trusted setup creates public parameters from secret randomness. The parameters let a prover perform hidden computations without revealing the secret value, but anyone who keeps that value may forge proofs. The secret is often called toxic waste. section 15.3 section 15.3.4
A typical trusted setup proceeds in three steps:
- Choose a random value r. section 15.3.4
- Publish commitments such as g, gr, gr², and gr³, allowing polynomial computations without revealing r. section 15.3.4
- Destroy r after the ceremony; multiparty computation reduces the risk because one honest participant can delete their contribution and flush the toxic waste. section 15.3 section 15.3.4
Polynomial evaluation without revealing r
For f(x) = 3x² + x + 2, a prover can compute (gʳ²)³ gʳ g². This commits to f(r) while the prover never learns r. If r became known, an invalid polynomial could still pass the equality check. section 15.3.4
Figure 15.12 The Schwartz-Zippel lemma says that two different polynomials of degree n can intersect in at most n points. In other words, two different polynomials will differ in most points.
The Schwartz-Zippel visualization shows why checking polynomials at a hidden random point makes different polynomials unlikely to agree. section 15.3.4
