trusted setup

A trusted setup is a one-time ceremony that produces the public parameters — the Structured Reference String (SRS) — that a SNARK needs before anyone can make or verify proofs. The catch that gives it its name: generating the SRS requires sampling secret random values (often a number τ and a few others), and while only their public "in-the-exponent" encodings are kept, anyone who learns the underlying secret can forge fraudulent proofs that still pass verification. That secret is vividly called toxic waste, and the security of the whole system depends on it being destroyed and never reconstructed.

There are two flavors. A circuit-specific setup (as in Groth16) bakes the particular circuit into the SRS, so every new or changed program needs a fresh ceremony — secure but inflexible. A universal and updatable setup (as in PLONK or Marlin, built on KZG) produces one SRS usable for any circuit up to a size bound, and lets new participants keep contributing fresh randomness over time. Crucially, these ceremonies are run as multi-party computations where the final secret is the product of every participant's contribution, so the toxic waste stays safe as long as at least one honest participant erased their share — the "1-of-N honest" assumption.

Trusted setups are the main thing people dislike about SNARKs, because they introduce a trust assumption and a logistical burden that a buggy or malicious ceremony could quietly undermine. This is exactly the weakness that STARKs and Bulletproofs avoid by being transparent (their setup is just public randomness). In practice, large ceremonies like Zcash's and Ethereum's KZG ceremony recruit thousands of contributors to make the 1-of-N assumption overwhelmingly safe.