Why a ceremony#
Each circuit has a proving key and a verifying key. Whoever knew all the randomness used to make them could forge proofs for that circuit. A multi-party ceremony splits that randomness between many people: the keys are safe as long as one of them threw theirs away.
Status#
| Circuit | Keys |
|---|---|
transaction2 (spend, from Privacy Cash, unmodified) | Privacy Cash's ceremony |
lock, unlock, claimStake, claimVolume | Development keys One local contribution. Test networks only. |
The program marks the development keys (DEV-ONLY in posl_vk.rs) and tools/mainnet-check.sh refuses a mainnet build while they are there.
How it will run#
- Phase 1 is the public Perpetual Powers of Tau (
ppot_0080_18.ptau, hash checked by the script). - The coordinator starts phase 2 for the four circuits:
ceremony.sh start r0, and publishes the hashes. - Each participant, in turn, adds a contribution:
ceremony.sh contribute rN rN+1 "name", and publishes their contribution hashes. - Anyone can verify the whole chain at any time:
ceremony.sh verify rN. - A public random beacon, announced in advance (for example a future drand round), closes it, so the last participant cannot bias the result:
ceremony.sh finalize rN <beacon>. - The verifying keys are written into the program, the full test suite runs again, and the record (participants, hashes, beacon) is published.
At least five independent participants are planned, including people outside the project. A full rehearsal ran on 19/09/2026: two contributions, ZKey Ok! on all four circuits, beacon, keys regenerated.