Lite-PoT: Practical Powers-of-Tau Setup Ceremony

Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARK) schemes have gained significant adoption in privacy-preserving applications, in decentralized systems (e.g., blockchain), and in verifiable computation due to their efficiency. However, the most efficient zk-SNARKs often rely on a one-time trusted setup to generate public parameters, often known as the ''Powers of Tau'' (PoT) string. The leakage of the secret parameter τ in the string would allow attackers to generate false proofs, compromising the soundness of all zk-SNARK systems built on it. Prior proposals for decentralized setup ceremonies have utilized blockchain-based smart contracts to allow any party to contribute randomness to τ while also preventing censorship of contributions. For a d-degree PoT string generated using randomness from m contributors, these solutions require a total of O(md) on-chain operations (i.e., in terms of both storage and cryptographic operations). These operations primarily consist of costly group operations, particularly scalar multiplication on pairing curves, which discourage participation and limit the impact of decentralization. In this work, we present Lite-PoT, which includes two key protocols designed to reduce participation costs: (i) a fraud-proof protocol to reduce the number of expensive on-chain cryptographic group operations to O(1) per contributor. Our experimental results show that (with one transaction per update) our protocol enables decentralized ceremonies for PoT strings up to a 215-degree (limited by Ethereum's 30M block gas limit), a ≈16× improvement over existing on-chain solutions; (ii) a proof aggregation technique that batches m randomness contributions into one on-chain update with only O(d) on-chain operations, independent of m. This significantly reduces the monetary cost of on-chain updates by m-fold via amortization.