►
From YouTube: The KZG Ceremony - or How I Learnt to Stop Worrying and Love Trusted Setups by Carl Beekhuizen
Description
Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/the-kzg-ceremony-or-how-i-learnt-to-stop-worrying-and-love-trusted-setups/
Danksharding, ProtoDanksharding, & EIP4844 make use of KZG commitments which require a trusted setup.
As usual, Ethereum does this differently by having an order of magnitude more participants than previous trusted setups. I will be running through why the trusted setup is needed, how it works, and why you should trust it.
Speaker(s): Carl Beekhuizen
Skill level: Intermediate
Track: Layer 1 Protocol
Keywords: Danksharding,KZG Ceremony,Trusted Setup
Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/
Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/
A
A
Yeah
so
I'm
going
to
be
talking
about
the
kzg
ceremony
or
how
I
learned
to
stop
worrying
and
love
trusted
setups
so
five
months
ago,
I
think
I
wasn't
the
only
one
who
stopped
using
the
chain
or
started
using
it
very
sporadically
and
the
the
demand
is
just
way
way
outstrips
the
supply
of
block
space,
and
this
is
this
is
not
a
future
we
can
continue
on
into
for
ethereum.
So
we
need
to
greatly
change
how
we're
doing
things
to
scale
our
capabilities.
The
l2s
are
the
promise
way
of
doing
this.
A
The
problem
is:
is
that
l2s
on
their
own,
don't
have
a
way
of
storing
this
data
enter
proto-dunk
sharding,
also
known
as
eip4844,
and
the
idea
behind
here
is
that
we
enable
incredible
amounts
of
data
for
these
l2s
to
use
and
just
for
them
such
that
they
can
provide
if
they're,
providing
the
compute
here's
the
storage
to
match
that
and
scale
ethereum
up
to
to
what
we
need.
So
what
does
this
protodank
sharding?
Look
like?
We
have
these
Notions
of
blobs.
It's
some
arbitrary
data.
From
the
protocol's
perspective.
A
We
don't
really
care
what
it
is,
but
to
the
roll
ups.
It's
basically
going
to
be
compressed
transactions,
and
then
we
use
this
device
called
the
kzg
commitment
to
compress
down
this
data
and
Only
Store
a
small
reference
to
it
on
chain.
Then,
once
the
block
proposer
has
proposed
this
data,
the
validators
there
in
the
bottom
check
that
this
data
is
available.
They
check
that
they
have
access
to
it
and
that
the
network
has
propagated
this,
and
if
so,
they
vote
that
they've
seen
this
data
and
biscuits
also
put
on
the
blockchain.
A
A
But
this
has
the
problem
which
ethereum
has
right
now,
which
is
where
we're
storing
incredible
amounts
of
data
again
and
the
idea
behind
Bank
charting
is
that
we're
scaling,
This,
Way
Beyond
ethereum's,
current
capabilities,
which
would
mean
for
the
people
who
are
already
struggling
to
run
their
their
nodes.
This
would
be
unacceptable.
A
So
the
final
step
in
this
is
two
weeks
later.
We
throw
away
the
data.
So
it's
not
that
we
promise
to
keep
this
data
around
forever.
That's
not
what
protodank
shotting
guarantees
protagon,
dank
shotting
guarantees
that
at
some
point
in
the
past,
this
data
was
available
for
people
to
download,
and
should
they
have
wanted
to
done
that
to
have
done
this
they
could.
It
is
then,
on
the
Roll-Ups
on
the
users
to
store
the
data
they're
interested
in.
So
if
you're
interested
in
certain
transactions,
you
could
store
just
your
transactions.
A
Roll
up
sequences
could
store
well,
we'll
be
storing
everything,
but
it's
just
no
longer
the
Chain's
responsibility
to
store
this.
You
can
put
a
host
on
ipfs.
It
doesn't
really
matter
just
that.
Validators
no
longer
need
to
store
this
so
effectively.
They
have
this
sliding
window
of
the
past
two
weeks
of
state
that
they
need
to
look
after.
Some
may
ask
why
kzg
there's
a
very
full
table:
I'm,
not
expecting
you
to
take
all
of
it
in
the
current
solution.
A
So
kcg
is
a
very
promising
looking
thing,
but
it
has
this
one:
big
red
negative,
as
you
see
over
there
and
that's
this
trusted
setup
and
that's
what
I'm
speaking
to
you
about
today,
trusted
setups,
thus
I
hope
should
make
everyone
a
little
bit.
Nervous.
Trust
is
not
a
thing
we
try
have
in
the
system
is
trust
but
verify
so.
Ideally,
you
shouldn't
need
to
do
this.
A
I'd
like
to
be
able
to
convince
you
today
that
in
this
case,
this
is
something
you
should
be
able
to
trust
and
that
you
can
verify
lots
of
things
about
it.
So
the
idea
is
that
collectively,
as
an
ethereum
community
and
hopefully
including
many
of
those
outside
of
our
community,
we're
going
to
summon
a
secret
there's,
not
a
single
person
entity
doesn't
matter
what
scale
that
will
be
able
to
know
what
the
secret
is.
A
But
together
we
will
have
generated
this.
It
runs
on
a
so-called
one
of
Interest
assumption.
The
idea
here
is
that
we
need
one
person
not
to
have
actively
been
malicious.
It's
not
that
we
need
one
person
to
be
good.
It's
we
need
one
person
not
to
be
bad
and
to
actively
like
pull
apart
the
code
and
try
to
figure
out
how
they
could
corrupt
this,
and
that
kind
of
thing
we
just
need
one
person
not
to
have
done
that.
A
So
what
is
this?
What
does
this
look
like?
The
ceremony
is
going
to
be
written
by
people.
People
make
mistakes,
so
there
will
be
bugs.
This
is
part
of
the
plan,
so
we
have
multiple
implementations
that
people
can
use.
You
can
write
your
own
implementation,
the
idea
being
that,
even
if
there
is
a
bug
in
one
of
the
implementations,
there
are
still
a
lot
of
a
lot
of
contributions
that
people
have
made
by
the
other
implementations
that
keep
us
safe.
There
will
be
malicious
people
in
the
blockchain
setting
it's
very
adversarial.
A
Theoretically,
if
you
could
collect
all
of
these
secrets
that
people
contributed,
it
would
be
worth
a
lot
of
money
because
you
could
do
a
lot
of
bad
things,
so
in
some
sense,
there's
some
value
behind
this,
not
really
because
you
really
need
to
get
all
of
them.
Having
one
short
is
not
enough,
but
there
will
be
some
people
who
will
try
to
be
malicious
and
try
spreadfad.
A
So
we
lose
a
few
more
of
these
contributions,
but
the
idea
is:
is
that
there'll
still
be
many
contributions
which
won't
have
this
problem
and
by
many
contributions,
I
really
mean
a
great
scale
like
that's
not
even
close.
Not
even
this
is
my
sort
of
lower
bound
goal
for
the
number
of
people
I'd
like
to
contribute.
This
is
8192
contributions.
A
This
graph
is
something
I
personally
care
about.
It's
a
bit.
Silly,
but
hopefully
this
ceremony,
we're
running
will
be
the
first
ceremony
ever
where
they
are
more
participants
than
we
have
powers.
So
normally
you
have
these
very
big
hard
to
run
ceremonies
and
one
or
two
people
contributing
here.
We
have
a
ceremony
with
that's
very
easy
to
run
and
we
have
ideally
tens
of
thousands
of
people
getting
involved,
ensuring
the
security
of
of
all
of
this
making
sure
that
those
candles
stay
lit.
A
So
a
lot
of
this
came
to
the
design
decisions
of
the
ceremony.
It's
designed
to
be
quick
and
easy
for
everyone
here
at
no
matter
what
your
level
of
technical
skills
there
is
an
easy
option
which
is
there's
a
website.
You
can
go
to
click,
contribute
and
it'll
walk
you
through
it
in
about
five
minutes
very
easy
to
run
on
your
computer.
A
There's
also,
the
idea
of
the
ceremony
is
updatable,
which
will
mean
something
to
the
cryptographers,
but
for
us
is
that
in
10
years
or
so,
when
our
communities
progress
when
hopefully
I'm
less
relevant
to
the
protocol,
because
we're
less
capturable
and
we've
grown
further,
and
we've
adopted
many
more
people
that
we
can
add
to
the
previous
ceremony,
build
upon
it
to
update
it
such
that
we'll
have
even
more
people
keeping
those
candles
alive.
So
how
does
it
work?
A
A
The
second
person
adds
the
number
five
to
the
secret,
and
then
the
third
person
multiplies
the
number
two
in.
So
the
idea
is
that
this,
this
brown
colored
30,
is
the
mix
of
all
the
colors,
slash
all
the
secrets
from
the
various
people
that
came
before
and
that
it
represents
all
these.
These
these
secrets
and
these
people
generated
these
numbers
randomly,
but
there's
a
problem
with
this,
and
that's
that
as
it
stands
here,
anyone
can
read
this
right.
A
It's
just
a
number
30,
that's
not
a
great
secret,
so
you
need
to
encrypt
these
and
we
encrypt
these
by
quote:
unquote,
hiding
them
the
exponent.
We
turn
them
into
elliptical
of
points.
This
allows
us
to
still
perform
the
math.
That
I
was
saying
it
is
quite
literally
multiplication,
but
it
is
done
in
this
in
this
encrypted
form
so
that
no
one
can
read
the
overall
secret
there's
one
other
thing,
and
that's
that
we
have
the
role
of
the
sequencer.
A
The
sequencer's
job
is
to
do
two
things.
One
is
to
decide
who's
going.
Next,
there
are
thousands
of
people
who
want
to
participate,
how
we
decide
who's
the
next,
the
next
contributor
and
the
sequencer
basically
holds
the
files
and
when
there's
when
someone
asks
for
it
and
it's
they're
available
they'll
pass
over
the
files
to
the
next
person
to
contribute.
The
second
thing
they
do
is
they
verify
these
contributions,
so
we
need
to
be
sure
that
these
contributions
that
people
give
back
to
the
sequencer.
A
Someone
hasn't
tried
to
delete
some
of
the
points
or
try
to
do
some
weird,
crazy
math
that
breaks
it.
So
the
sequencer
just
double
checks
that
the
files
that
they're
getting
back
are
still
valid
files
so
that
the
ceremony
can
keep
progressing.
The
sounds
like
the
sequencer
has
incredible
amounts
of
power.
This
is
not
true,
so
the
sequence's
abilities
are
basically
the
only
thing
they
can
do
is
censor
things.
A
They
could
lie
and
say
that
the
file
you
gave
them
was
corrupt
or
invalid,
and
they
could
also
just
not
give
you
a
turn,
so
you
would
log
in
with
your
ethereum
account
and
then
they'd
be
like.
Oh,
no,
sorry,
your
therm
account's
not
valid
or
we've
got
certain
validity
conditions.
It
doesn't
meet
those.
In
this
case
we
have
signatures
which
hold
the
sequencer
accountable
for
this
role.
So
should
they
try
to
do
these
kinds
of
things?
A
It
is
just
a
server
that
runs
a
very
simple
algorithm,
just
verifies
things
and
passes
them
on
in
the
end,
it'll
be
up
to
the
community
to
verify
that
the
sequencer
did
their
job
correctly.
So
there's
a
transcript
file
that
should
be
split
out
of
the
ceremony
at
the
end,
which
contains
the
secret
this
final
secret,
and
we
can
verify
that
what
the
sequencer
did
along
the
way
was
correct
and
valid
I
kind
of
lied
a
little
bit
earlier
when
I
said
that's
how
it
works
is
a
little
bit
more
complexity.
A
So
how
does
it
really
work
here?
You
might
have
heard
of
something
called
the
powers
of
Tau.
These
are
the
powers,
so
it's
not
actually
a
single
secret.
We
store
multiple
copies
of
the
secret.
We
stole
the
secret,
the
Secret's
a
number.
By
the
way
we
saw
the
secret,
the
secret,
squared,
cubed,
etc,
etc.
A
All
the
way
up
to
the
secret
to
the
power
of
2
to
the
twelve
or
as
these
encrypted
points,
then,
when
it's
your
turn
to
contribute,
the
sequencer
will
pass
you
this
this
file
and
you
will
come
up
with
a
secret
with
obviously
with
the
hope
of
your
computer
right
and
you
do
some
some
computations.
So
you
also
calculate
your
own
personal,
local,
secret
or
entropy.
A
You
calculate
the
powers
of
this
and
you
do
basic
multiplication,
so
you
multiply
the
the
corresponding
power
with
the
the
corresponding
elliptical
Point,
given
to
you
from
the
sequencer
and
by
the
linear
properties
of
elliptic
curve
multiplication.
We
end
up
with
this
final
thing,
which
is
basically
showing
that
now
your
secret
has
been
incorporated
into
this
overall
secret,
and
you
can
now
pass
this
on
to
the
next
person
that
you
then
take
this
powers
and
hand
it
back
to
the
sequencer
who
verifies
that
what
you
did
was
correct.
A
A
We've
already
had
a
first
audit
on
that,
but
there
are
a
bunch
of
ux
bugs
that
we
need
to
sort
out
and
we're
handling
that
and
that's
a
part
of
the
test
net
is
to
get
people
to
participate
and
help
make
this
the
the
best
process
it
could
be.
We've
got
a
final
audit
launching
early
November,
which
will
hopefully
be
concluding
after
that.
A
Should
anything
arise
in
that
audit,
we'll
we'll
squash
those
bugs
review
that
and
then
hopefully
launch
the
ceremony
by
the
end
of
November,
eip4844
I,
don't
show
lots
of
people
have
heard
discussions
as
to
when
that's
going
to
be.
Ultimately
it's
up
to
the
client
devs
and
the
community
demand
for
when
this
gets
shipped.
But
as
this
is
a
prerequisite,
we'll
basically
be
running
the
ceremony
up
to
until
that
point,
which
is
a
minimum
of
two
months,
but
obviously
we'll
run
longer,
should
it
take
longer
to
get
to
eip4844.
A
All
that's
needed
to
to
implement
this,
like
from
scratch,
is
to
do
elliptic
curve
multiplication.
Maybe
some
of
you
have
heard
of
this
or
like
had
it
explained
to
you
on
a
whiteboard?
It
really
is
a
like
relatively
simple
thing
to
do.
You
have
quite
a
lot
of
time
to
do
this
participation.
So
if
you
are
going
to
write
your
own
implementation,
you
don't
it
doesn't
need
to
be
super
optimized.
A
So
if
you
would
like
to
go
on
some
weird
Vision
trip
that
somehow
is
going
to
bring
out
this,
the
the
secret
that
you
can
prove
to
other
people
has
been
done
in
an
interesting
way
or
you
want
to
have
use
your
local
Ant
Farm
to
like
measure
the
location
of
ants
or
something
weird
to
sample
Randomness,
something
that
is
very
hard
to
bias.
Such
you
can
convince
other
people
that
your
contribution
was
valid,
that
you
generated
Randomness
in
a
novel
and
interesting
way
functionally.
A
These
are
less
important
because
your
computer
should
do
this
Randomness
for
you.
We
all
rely
on
our
computer's
ability
to
generate
Randomness
already
for
all
of
the
encryption
and
cryptography
used
within
this
ecosystem
and
like
The
Wider
web,
but
it's
even
more
interesting
and
we
can
make
even
more
assurances
if
you
start
doing
things
like
this
and
then.
Finally,
as
I'm
sure
some
people
have
seen
from
past
ceremonies,
you
can
destroy
that
destroy
the
hardware
used
to
generate
the
secret.
A
But
we
give
ourselves
the
ability
to
scale
what's
that
16
times
over,
that
should
we
need
more
growth
in
the
future,
and
if
we
need
anything
beyond
that,
we'll
rerun
the
setup
there's
also
an
optimization
we
made,
which
is
pretty
fun
and
interesting,
which
is
where,
instead
of
having
one
large
setup
and
then
using
subsections,
we
can
instead
do
several
smaller
setups
and
then
we
can
skip
the
low
degree
proofs,
because
these
setups
are
disjoint.
So
you
don't
have
more
Powers.
A
C
If
I
stand
correct,
if
I
understand
correctly,
then
everyone
who's
participating
in
a
ceremony
could
have
like
the
chance
to
see
what
the
current
secret
is.
So
is
there
a
chance
that
if
you
we
the
last
one
picked
in
the
sequence,
then
you
would
have
a
higher
chance
to
kind
of
ruin.
The
whole
process.
A
So
not
really,
and
that's
because
we
don't
operate
over
the
secret
and
plain
text.
We
operate
over
the
secret
encoded
as
an
elliptic
curve
point.
So
it's
not.
We
don't
use
it.
In
my
example
where
the
secret
was
30,
we
don't
actually
use
30..
We
use
30
times
the
generator
of
the
curve,
so
some
elliptic
curve
point,
which
means
when
I
give
you
the
powers
I,
actually
hand
you
this
elliptic
curve
point,
which
means
you
can't
see
into
what
the
secret
is.
A
D
A
A
So
if
we
want
to
switch
away
from
this
to
a
less
Quantum
vulnerable
things,
we
would
have
to
switch
to
probably
hash
based
commitments.
Local
trees,
the
issue
about
it
being
not
verifiable
easily
inside
of
snox
would
go
away
because
Snorks
would
also
be
broken
so
like
depending
on
like
what
your
commitment
schemes
are.
A
You
would
have
to
tail
all
of
that,
but
we'd
have
to
see
quite
a
big
re-architecting
of
this
entire
system,
and
so
it's
not
something
we
have
like
a
built-in
backup
like
we
do
for
many
of
the
the
other
seams
in
answer
to
your
BLS
aggregation
or
whatever
question
for
the
signatures,
we're
using
for
ethereum
right
now
under
the
hood
for
your
private
Keys,
there's
also
a
Lamport
keeper,
like
Lamport
signature
key
pair,
so
we
can
always
revert
to
that
to
execute
a
one-time
transfer.
Should
that
need
to
happen.
A
D
E
A
A
So
the
thing
here
is
that
there
there's
basically
just
one
validity
condition:
I,
can
sort
of
okay
I'm
already
on
the
next
person's
slides,
never
mind.
Click
is
not
working.
I
just
slide
on
this.
Basically
one
validity
condition
or
two
checks.
We
need
to
do
to
assert
that
the
update
has
been
done
correctly.
A
So
it's
not
that,
like
there's
a
weird
subset
of
collusion
or
something
that
can
break
things,
it's
that
have
we
built
the
sequencer
in
a
way,
that's
such
that
it
can't
be
dosed
or
crashed,
which
we
can
use
fairly
standard
testing
infrastructure
for
and
when
you're
submitting
these
these
files,
we
can
like
try
corrupt
them
and
that
kind
of
thing,
but
that's
going
to
be
rejected
immediately
by
the
sequencer.
So
it's
a
bit
different
from
standard
test,
Nets
that
we
see
from
blockchain
networks,
because
the
adversary
looks
very
different.
F
F
A
Hard
to
know,
I
think
a
lot
of
that
comes
down
to
the
execution
things
like
how
many
participants
have
you
have
you
had
come
on
board
or
how
many
different
implementations
do
you
have
we
already
have
a
few
floating
around
I
think
we
could
get
something
like
10
or
12
different
implementations,
these
kinds
of
things.
The
good
news
is
that
once
this
is
up,
there's
now
more
infrastructure
for
smaller
projects
to
leverage
in
terms
of
like
just
extending
these
powers.
A
A
So
while
it
would
be
a
good
base
from
the
perspective
of
not
knowing
what
the
secret
is
from
the
security
things
we
care
about
in
our
application,
it
doesn't
add
anything
and
then
it's
more
of
like
arguing
about
nothing
about
Sleep,
Numbers
kind
of
thing,
it's
much
easier,
just
to
start
with
the
generator,
which
is
what
we're
going
to
be
doing.
Oh,
yes,
it's
a
sequential
process.
So
sorry,
the
question
was:
do
you
run
it
in
sequence
and
how
do
we
handle
civil
attacks?
A
A
A
The
simple
attacks
here
in
the
black
low
orders
like
if
we
have
some
people
contributing
five
times
or
so
it
doesn't
really
matter
because
they
just
mix
in
five
sets
of
Secrets.
But
if
we
extend
this
out,
it
does
start
to
matter.
So
if
everyone
like,
if
everyone
manages
to
sublet
and
everyone
was
the
same
person
replicated,
that
would
be
bad.
So
we
don't
need
per
flexible
prevention
just
moderately.
So.