Does zero-knowledge proof automatically mean 100% trustless?
It sounds like it should. Nobody sees the secret, the math verifies the proof.
But Dusk's own Citadel paper points to a less comfortable layer underneath PLONK: the trusted setup.
Dusk's PLONK implementation runs over BLS12-381 and uses KZG10 as its default polynomial commitment scheme. KZG needs a Common Reference String generated from secret randomness. If that “toxic waste” survives and reaches an attacker, the soundness assumption can break.
The Citadel paper says this plainly: compromised setup randomness could enable false transactions and “huge losses of money.” For Citadel, it says the consequence would be user impersonation and use of other people's licenses.
So what does “trusted setup” actually mean?
Not trusting one company with a master password.
A ceremony lets multiple participants sequentially add their own randomness. Each destroys their private contribution afterward. The key property is that the setup remains secure if even one participant was honest and permanently discarded their secret.
That made me ask: who participated in Dusk's ceremony?
This is actually more documented than I expected.
Dusk's public trusted-setup repository says it started from verified Zcash Powers-of-Tau response #87, then added 15 listed Dusk contributors. The repo exposes contribution records and verification steps, while Dusk said the results would be public for others to verify.
That doesn't prove every operational assumption forever. I'd still want to know whether production parameters correspond to that published transcript and how independently that linkage has been checked in practice today.
So the fair question becomes more specific: can I trace the live cryptographic parameters back to the publicly verifiable ceremony?
When a project openly admits a cryptographic weakness in its own paper, does that build more trust through transparency — or just make you want to know exactly how real that risk still is?
#dusk $DUSK @Dusk
It sounds like it should. Nobody sees the secret, the math verifies the proof.
But Dusk's own Citadel paper points to a less comfortable layer underneath PLONK: the trusted setup.
Dusk's PLONK implementation runs over BLS12-381 and uses KZG10 as its default polynomial commitment scheme. KZG needs a Common Reference String generated from secret randomness. If that “toxic waste” survives and reaches an attacker, the soundness assumption can break.
The Citadel paper says this plainly: compromised setup randomness could enable false transactions and “huge losses of money.” For Citadel, it says the consequence would be user impersonation and use of other people's licenses.
So what does “trusted setup” actually mean?
Not trusting one company with a master password.
A ceremony lets multiple participants sequentially add their own randomness. Each destroys their private contribution afterward. The key property is that the setup remains secure if even one participant was honest and permanently discarded their secret.
That made me ask: who participated in Dusk's ceremony?
This is actually more documented than I expected.
Dusk's public trusted-setup repository says it started from verified Zcash Powers-of-Tau response #87, then added 15 listed Dusk contributors. The repo exposes contribution records and verification steps, while Dusk said the results would be public for others to verify.
That doesn't prove every operational assumption forever. I'd still want to know whether production parameters correspond to that published transcript and how independently that linkage has been checked in practice today.
So the fair question becomes more specific: can I trace the live cryptographic parameters back to the publicly verifiable ceremony?
When a project openly admits a cryptographic weakness in its own paper, does that build more trust through transparency — or just make you want to know exactly how real that risk still is?
#dusk $DUSK @Dusk