I am interested in learning more about NIZK proofs in the CRS model.
The CRS must be random but 'trusted' by all parties.
How does these data get generated both in theory and in practice?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityI am interested in learning more about NIZK proofs in the CRS model.
The CRS must be random but 'trusted' by all parties.
How does these data get generated both in theory and in practice?
The state of the art for generating a structured CRS for a zk-SNARK is the multi-party computation that Zcash did for its Sapling upgrade. The paper, software, and information on security precautions taken for both the Sapling setup and the earlier Sprout setup are linked from https://z.cash/technology/paramgen.html .
The CRS must be generated in some trusted manner. One could use a secure coin tossing protocol involving a number of parties, and this would be fine as long as a majority of the parties are honest.
One could also apply a hash function to the New York Times of January 1st 2000 (or any other date) and use the result, although this would need a random oracle assumption.