powers-of-tau ceremony

The powers-of-tau ceremony is the specific multi-party computation used to generate a universal trusted setup safely. The goal is to publish group elements encoding consecutive powers of a secret τ — that is, encodings of τ, τ^2, τ^3, … up to the degree the circuits will need — without anyone ever learning τ itself. These "powers of tau" are exactly the structured reference string that KZG-based systems like PLONK, and Ethereum's EIP-4844 blob commitments, rely on.

The ceremony works as a relay. The first participant picks a random secret s1, raises the starting elements to its powers, and passes the result on; the second picks s2 and multiplies it into every element, so the running secret becomes s1·s2; and so on down a chain of contributors. Because the published values only ever appear "in the exponent," no one can extract the accumulated secret τ = s1·s2·…·sn, and the final SRS is safe as long as a single participant honestly discarded their own contribution. Each participant also publishes a proof that they genuinely transformed the previous transcript (rather than substituting their own), so anyone can verify the chain's integrity afterward.

This 1-of-N honest model is what makes the ceremony trustworthy at scale: with thousands of independent contributors, an attacker would have to have compromised every single one. Ethereum's KZG Summoning Ceremony for proto-danksharding drew over 140,000 participants, making it one of the largest cryptographic ceremonies ever; the "perpetual powers of tau" is an ongoing community SRS that many projects reuse so they do not each have to run their own.