# The KZG Ceremony - or How I Learnt to Stop Worrying and Love Trusted Setups by Carl Beekhuizen

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2023-10-07
- Duration: 27:28
- Watch: https://streameth.org/watch/yt-dTBy661ubgg
- YouTube: https://www.youtube.com/watch?v=dTBy661ubgg

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/the-kzg-ceremony-or-how-i-learnt-to-stop-worrying-and-love-trusted-setups/

Danksharding, ProtoDanksharding, & EIP4844 make use of KZG commitments which require a trusted setup.

As usual, Ethereum does this differently by having an order of magnitude more participants than previous trusted setups. I will be running through why the trusted setup is needed, how it works, and why you should trust it.

Speaker(s): Carl Beekhuizen
Skill level: Intermediate
Track: Layer 1 Protocol
Keywords: Danksharding,KZG Ceremony,Trusted Setup

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

foreign [Music] yeah so I'm going to be talking about the kzg ceremony or how I learned to stop worrying and love trusted setups so five months ago I think I wasn't the only one who stopped using the chain or started using it very sporadically and the the demand is just way way outstrips the supply of block space and this is this is not a future we can continue on into for ethereum so we need to greatly change how we're doing things to scale our capabilities the l2s are the promise way of doing this um for your multiple years now we've been hearing about the roll-up Centric design and how l2s aren't going to provide us with what we need but l2s are only part of what's required scale incomes in sort of two variants for ethereum there is scaling compute l2s take us from what ethereum is right now which is effectively a single threaded very slow computer to a massively multi-threaded much faster processor the problem is is that l2s on their own don't have a way of storing this data enter proto-dunk sharding also known as eip4844 and the idea behind here is that we enable incredible amounts of data for these l2s to use and just for them such that they can provide if they're providing the compute here's the storage to match that and scale ethereum up to to what we need so what does this protodank sharding look like we have these Notions of blobs it's some arbitrary data from the protocol's perspective we don't really care what it is but to the roll ups it's basically going to be compressed transactions and then we use this device called the kzg commitment to compress down this data and Only Store a small reference to it on chain then once the block proposer has proposed this data the validators there in the bottom check that this data is available they check that they have access to it and that the network has propagated this and if so they vote that they've seen this data and biscuits also put on the blockchain so from the blockchain's perspective we know that this data was around there was an opportunity at some point for all the Roll-Ups and roll-up users to download the data that they care about the validators then save the data locally to their own disks and this this gets stored but this has the problem which ethereum has right now which is where we're storing incredible amounts of data again and the idea behind Bank charting is that we're scaling This Way Beyond ethereum's current capabilities which would mean for the people who are already struggling to run their their nodes this would be unacceptable so the final step in this is uh two weeks later we throw away the data so it's not that we promise to keep this data around forever that's not what protodank shotting guarantees protagon dank shotting guarantees that at some point in the past this data was available for people to download and should they have wanted to done that to have done this they could it is then on the Roll-Ups on the users to store the data they're interested in so if you're interested in certain transactions you could store just your transactions roll up sequences could store well we'll be storing everything but it's just no longer the Chain's responsibility to store this you can put a host on ipfs it doesn't really matter just that validators no longer need to store this so effectively they have this sliding window of the past two weeks of state that they need to look after some may ask why kzg there's a very full table I'm not expecting you to take all of it in um the current solution we use for these kinds of commitments on chains are the are Merkle trees but as you can see there's lots of red on the Merkel that the Char Merkel tree column on the left there um what and what we really care about is this Top Line right if we're trying to enable um if we're trying to enable Roll-Ups and l2s lots of them are ZK EVMS or ZK Roll-Ups and they care about being able to prove things about this data inside the roll up and as you can see from this Top Line if we stick to our current mechanisms it's quite literally not possible the only realistic or other alternative would be ipas but there are several other trade-offs that they make so kcg is a very promising looking thing but it has this one big red negative as you see over there and that's this trusted setup and that's what I'm speaking to you about today trusted setups thus I hope should make everyone a little bit nervous trust is not a thing we try have in the system is trust but verify so ideally you shouldn't need to do this I'd like to be able to convince you today that in this case this is something you should be able to trust and that you can verify lots of things about it so the idea is that collectively as an ethereum community and hopefully including many of those outside of our community we're going to summon a secret there's not a single person entity doesn't matter what scale that will be able to know what the secret is but together we will have generated this it runs on a so-called one of Interest assumption the idea here is that we need one person not to have actively been malicious it's not that we need one person to be good it's we need one person not to be bad and to actively like pull apart the code and try to figure out how they could corrupt this and that kind of thing we just need one person not to have done that um so what is this what does this look like um the ceremony is going to be written by people people make mistakes so there will be bugs this is part of the plan so we have multiple implementations that people can use you can write your own implementation the idea being that even if there is a bug in one of the implementations there are still a lot of a lot of contributions that people have made by the other implementations that keep us safe there will be malicious people in the blockchain setting it's very adversarial theoretically if you could collect all of these secrets that people contributed it would be worth a lot of money because you could do a lot of bad things so in some sense there's some value behind this not really because you really need to get all of them having one short is not enough but there will be some people who will try to be malicious and try spreadfad so we lose a few more of these contributions but the idea is is that there'll still be many contributions which won't have this problem and by many contributions I really mean a great scale like that's not even close not even this is my sort of lower bound goal for the number of people I'd like to contribute this is 8192 contributions um this graph is something I personally care about it's a bit silly but hopefully this ceremony we're running will be the first ceremony ever where they are more participants than we have powers so normally you have these very big hard to run ceremonies and one or two people contributing here we have a ceremony with that's very easy to run and we have ideally tens of thousands of people getting involved ensuring the security of of all of this making sure that those candles stay lit so a lot of this came to the design decisions of the ceremony um it's designed to be quick and easy for everyone here at no matter what your level of technical skills there is an easy option which is there's a website you can go to click contribute and it'll walk you through it in about five minutes very easy to run on your computer if you want to write your own implementation the specifications have been kept to an absolute minimum even at the cost of some efficiency of the setup just to ensure that it's very easy to do um and then in other ways we've just tried to keep the ceremony as as minimal as possible there's also the idea of the ceremony is updatable which will mean something to the cryptographers but for us is that in uh 10 years or so when our communities progress when hopefully I'm less relevant to the protocol because we're less capturable and we've grown further um and we've adopted many more people that we can add to the previous ceremony build upon it um to update it such that we'll have even more people uh keeping those candles alive so how does it work that sounds like some big scary math but in reality it's not so the idea is that each individual generates a secret and they mix in their secrets with everyone else so in this example the first person mixes in the number three into like the overall Secret the second person adds the number five to the secret and then the third person multiplies the number two in so the idea is that this this brown colored 30 is the mix of all the colors slash all the secrets from the various people that came before and that it represents all these these these secrets and these people generated these numbers randomly but there's a problem with this and that's that as it stands here anyone can read this right it's just a number 30 that's not a great secret so you need to encrypt these and we encrypt these by um quote unquote hiding them the exponent we turn them into elliptical of points um this allows us to still perform the math that I was saying it is quite literally multiplication but it is done in this in this encrypted form so that no one can read the overall secret there's one other thing and that's that we have the role of the sequencer the sequencer's job is to do two things one is to decide who's going next there are thousands of people who want to participate how we decide who's the next the next contributor um and the sequencer basically uh holds the files and when there's uh when someone asks for it and it's they're available they'll pass over the files to the next person to contribute the second thing they do is they verify these contributions so um we need to be sure that these contributions that people give back to the sequencer someone hasn't tried to delete some of the points or try to do some weird crazy math that breaks it so the sequencer just double checks that the files that they're getting back are still valid files so that the ceremony can keep progressing the sounds like the sequencer has incredible amounts of power this is not true so the sequence's abilities are basically the only thing they can do is censor things they could lie and say that the file you gave them was corrupt or invalid and they could also just not give you a turn so you would log in with your ethereum account and then they'd be like oh no sorry your therm account's not valid um or we've got certain validity conditions it doesn't meet those in this case we have signatures which hold the sequencer accountable for this role so should they try to do these kinds of things we'll have a proof that we can publicize to show that this was happening and we can decide how to progress from then um so realistically the sequencer doesn't have any weird and funny Powers um it is just a server that runs a very simple algorithm just verifies things and passes them on in the end it'll be up to the community to verify that the sequencer did their job correctly so there's a transcript file that should be split out of the ceremony at the end which contains the secret this final secret and we can verify that what the sequencer did along the way was correct and valid I kind of lied a little bit earlier when I said that's how it works is a little bit more complexity so how does it really work here you might have heard of something called the powers of Tau these are the powers so it's not actually a single secret we store multiple copies of the secret we stole the secret the Secret's a number by the way we saw the secret the secret squared cubed etc etc all the way up to the secret to the power of 2 to the twelve or as these encrypted points then when it's your turn to contribute the sequencer will pass you this this file and you will come up with a secret with obviously with the hope of your computer right and you do some some computations so you also calculate your own personal local secret or entropy you calculate the powers of this and you do basic multiplication so you multiply the the corresponding power with the uh the corresponding elliptical Point given to you from the sequencer and by the linear properties of elliptic curve multiplication we end up with this final thing which is basically showing that now your secret has been incorporated into this overall secret and you can now pass this on to the next person that you then take this powers and hand it back to the sequencer who verifies that what you did was correct what you did was valid and that you haven't tried to to to cheat the system so when can you participate um the we should be launching a test net very shortly ideally in the next few days um they were fairly certain that most of the cryptography is uh unlocked we've that that's pretty reasonable we've already had a first audit on that but there are a bunch of ux bugs that we need to sort out and we're handling that and that's a part of the test net is to get people to participate and help make this the the best process it could be we've got a final audit launching early November which will hopefully be concluding after that should anything arise in that audit we'll we'll squash those bugs review that and then hopefully launch the ceremony by the end of November um eip4844 I don't show lots of people have heard discussions as to when that's going to be um ultimately it's up to the client devs and the community demand for when this gets shipped but as this is a prerequisite we'll basically be running the ceremony up to until that point which is a minimum of two months but obviously we'll run longer should it take longer to get to eip4844 there are grants um I'm sure many of you have heard never to roll your own crypto I'm trying to tell you you should roll your own crypto um all that's needed to uh to implement this like from scratch is to do elliptic curve multiplication um maybe some of you have heard of this or like had it explained to you on a whiteboard it really is a like relatively simple thing to do you have quite a lot of time to do this participation so if you are going to write your own implementation uh you don't it doesn't need to be super optimized you don't need to read all the latest papers um so if you've ever wanted to understand what's really going on under the hood of elliptic curves this would be a great way of doing it um alternatively you could use an existing client uh sorry an existing elliptic curve library and on top of that you could just implement the client side of things like the secret generation how you how you sampling that Randomness and how that gets passed on to this elliptic curve Library and then the second category of Grants is for crazy Randomness generation and contribution so if you would like to go on some weird Vision trip that somehow is going to bring out this the the secret that you can prove to other people has been done in an interesting way or you want to have use your local Ant Farm to like measure the location of ants or something weird to sample Randomness something that is very hard to bias such you can convince other people that your contribution was valid that you generated Randomness in a novel and interesting way functionally these are less important because your computer should do this Randomness for you we all rely on our computer's ability to generate Randomness already for all of the encryption and cryptography used within this ecosystem and like The Wider web but it's even more interesting and we can make even more assurances if you start doing things like this and then finally as I'm sure some people have seen from past ceremonies you can destroy that destroy the hardware used to generate the secret what's a little bit different from our ceremony is that the secret only exists in the realm of your computer for a few seconds 30 40 seconds or so so it's not some something that gets stored to disk that you need to get rid of later or something like that so destroying your computer is much less necessary but should this be something you want to do or should you think that you can convince more people that this is secure by doing it reach out to to myself or Trent and we can be and you should be able to see a bit of shouting about this on Twitter about what are good places for Grants and I think those are the the major points I wanted to top on so are there any questions Y2 to the power 12. ah we actually have several ceremonies so um where the ceremony is consist consists of four sub-ceremonies two to the power of 12 13 14 and 15 which are basically all the sizes of data blobs we could see ever needing for dunk sharding um so 2 to the power of 12 basically gives us one megabyte blocks in expectation that could grow up to two megabytes but basically that's which we think is a reasonable Target and should be fine with current technology but we give ourselves the ability to scale um what's that 16 times over that should we need more growth in the future and if we need anything beyond that we'll rerun the setup there's also an optimization we made which is pretty fun and interesting which is where instead of having one large setup and then using subsections we can instead do several smaller setups um and then we can skip the low degree proofs because these setups are disjoint so you don't have more Powers should you need them but that like the low degrees in force by running out of points that sounds like the max live okay hello uh if I stand correct if I understand correctly then um everyone um who's participating in a ceremony could have like the chance to um uh see what the current secret is so is there a chance that if you we the last one picked in the sequence then you would have a higher chance to um kind of ruin the whole process um so not really and that's because we don't operate over the secret and plain text we operate over the secret encoded as an elliptic curve point so it's not we don't use it in my example where the secret was 30 we don't actually use 30. we use uh 30 times the generator of the curve so some elliptic curve point which means when I give you the powers I actually hand you this elliptic curve point which means you can't see into what the secret is so if you have something you build on top of there it it's useless to you just looks like a random elliptical point which is the same security assumption we depend on for the rest of ethereum's signatures Etc okay thank you ciao hello okay um you mentioned the quantum vulnerability yes uh what is the mitigation for that and also BLS signature aggregation and when is that going to be a problem when it's going to be a problem I wish I knew I think there's a lot of money to be able to answer that question um so if we want to switch away from this to a less Quantum vulnerable things we would have to switch to um probably hash based commitments local trees the issue about it being um not verifiable easily inside of snox would go away because Snorks would also be broken um so like depending on like what your commitment schemes are you would have to tail all of that but we'd have to see quite a big re-architecting of this entire system and so it's not something we have like a built-in backup like we do for many of the the other seams um in answer to your BLS aggregation or whatever question for the signatures we're using for ethereum right now under the hood for your private Keys there's also a Lamport keeper like Lamport signature key pair so we can always revert to that to execute a one-time transfer should that need to happen so there's more uh there's resilience built into that already and you don't think it's going to be within the next 10 years that the quantum will happen then I don't think so or at least not at the rate where all of a sudden we're gonna have to throw everything away um the good news is we probably won't need a trusted setup in the case that Quantum is broken so we should just be able to switch out the commitment scheme we're using um but yeah I don't see it happening in the next 10 years if it does I don't think it'll happen overnight thank you uh I was wondering how like on a on a test net do you what kind of tooling you're using to like execute these adversarial conditions so the thing with a do you mean adversarial against the sequencer or against the like setup in general uh so like on a test net you wanted to actually like have one of them like hide a secret or like not make something available like how easy it is to how easy is it to do that on these like Live Test Nets so the thing here is that um there there's basically just one validity condition I can sort of okay I'm already on the next person's slides never mind click is not working um I just slide on this basically one validity condition or two checks we need to do to assert that the uh update has been done correctly so it's not that like there's a weird subset of collusion or something that can break things it's that have we built the sequencer in a way that's such that it can't be dosed or crashed which we can use fairly standard testing infrastructure for um and when you're submitting these these files we can like try corrupt them and that kind of thing but that's going to be rejected immediately by the sequencer so it's a bit different from standard test Nets that we see from blockchain networks because the adversary looks very different it's more of a web 2 adversary in attacking the sequencer directly than what would happen otherwise okay it makes a lot of sense sure thanks very much for this for smaller projects would you still trust if if we're talking about a separate project would you still trust The Trusted setup or would you think about different strategy stocks or anything else trusting this setup or their own setup no if you would work on a project a ziki project now that is kind of thinking should we do trusted setup should we go with stock with something else it's hard to know I think a lot of that comes down to the execution things like how many participants have you have you had come on board or how many different implementations do you have we already have a few floating around I think we could get something like 10 or 12 different implementations these kinds of things the good news is that once this is up there's now more infrastructure for smaller projects to leverage in terms of um like just extending these powers that would be great but it like in intrinsically that it's like very much a case-to-case based thing um I I don't think trusted setups in general are safe I think there are ways of executing them that are safe um and I think some of these things I touched on are important to do that thanks um have you considered starting with an already established setup and basically adding your Randomness into it and if you're not doing this why not uh yeah we have there's been a lot of discussion on that um so we're using the the setup is done over the BLS 1231 curves um which I mean there have been setups done before um but not that many anyway um what I was referencing earlier with this optimization where we stopped doing the low degree proofs because we ran out of powers so we don't have to check that the polynomials of degree less than 2 to the power of 12 because there is no 2 to the power of 12 plus one point we literally run out this optimization Falls away when we use these other trusted setups that exist through to the safety of uh the the kcg commitments and the way we're using them in 4844 so for asset breaks things being able to use it so while it would be a good base from the perspective of not knowing what the secret is from the security things we care about in our application it doesn't add anything and then it's more of like arguing about nothing about Sleep Numbers kind of thing it's much easier just to start with the generator which is what we're going to be doing oh yes it's a sequential process so sorry the question was do you run it in sequence and how do we handle civil attacks so yes we do run it in sequence because of the way the um things are encrypted or whatever it fundamentally has to be that like the way the math works out it fundamentally has to be a sequential process we can't combine two parallel ones later um our civil processes are twofold that's that you need to authenticate with signing in with ethereum and we check certain properties of your account so like a fresh account is not going to work but an account that you've got even like you've sent one of two transactions uh should be good enough that in the past the alternative to this should you not want to use sign in with ethereum because you like only ethereum adjacent or something like that is GitHub and there we're verifying that in the past you've had a commit to uh on on some repo the simple attacks here in the black low orders like if we have some people contributing five times or so it doesn't really matter um because they just mix in five sets of Secrets but if we extend this out it does start to matter so if everyone like if everyone manages to sublet and everyone was the same person replicated that would be bad so we don't need per flexible prevention just moderately so