Ceremony

The Redacted ceremony

Updated 30 September 20262 min read

Before a zero-knowledge system can keep secrets, it needs public parameters that nobody, including its creators, could have rigged. The ceremony is how those parameters are created, and it gives the community a part in the protocol's foundation.

One honest participant is enough

The ceremony works like a relay race. Each participant takes the current parameters, mixes in fresh secret randomness generated on their own device, passes the result on and destroys their secret.

The ceremony is a relay race The initial parameters pass from Alice to Bob to you and on through every participant, and each one adds a secret. A public beacon closes the chain, and the final keys are secure if any one participant was honest. One contribution after another Initial parameters Alice + a secret Bob + a secret You? + a secret Public beacon Final keys Secure if any one of them was honest Each participant mixes fresh randomness into the parameters on their own device, passes the result on and destroys the secret.

The final parameters have a useful property. If even one participant out of all of them was honest and discarded their randomness, the setup is secure permanently. You don't need to trust us or any single contributor. You only need to believe that someone in the chain was honest, and you can be that person yourself.

Contributing takes minutes

  1. Verify the current parameters and contribution chain.
  2. Contribute in your browser or terminal. Your device generates fresh randomness (move your mouse or draw on screen to stir in extra entropy) and transforms the parameters locally.
  3. Submit the public result. Your secret never leaves your device and is discarded after use.
  4. Check your name in the history, because every accepted contribution is recorded in the public transcript, which anyone can verify.

A contribution contains no wallet keys and no personal data, only mathematics with your randomness mixed in.

Finalization

When contributions close, a public randomness beacon applies the finishing step, and the proving and verification keys are derived. The full chain of contributions, circuits and final artifacts is published, so anyone can verify the whole lineage end to end, from the first parameter to the exact keys the contracts use.

To go deeper or verify everything yourself, see Technical participation.

← Previous
FAQ
Next →
Technical participation