Inquiry about PLONK Proving and Verifying keys.

[Ghost8345]

Hello.

From what I understand PLONK is a universal setup backend system where we need only one trusted setup ceremony and we can use it for all our circuits. So by extension I inferred that this trusted setup would generate Global Proving and Verifying keys that will be used for all circuits and will be circuit-independent.

When working with PLONK in Gnark I noticed that we can Create a Single SRS that can be used for all circuits but the lagrange SRS is circuit specific and also to setup PLONK we have to enter the circuit constraint system and the lagrange SRS to generate Proving and Verifying keys which makes them circuit-dependent.

Now my question is if this behaviour is actually intended and does plonk work that way, or is there something wrong here?

Thanks in advance.

[ThomasPiellard]

Hello, yes it's intended, in fact using the SRS in Lagrange form allows for some optimisations in the plonk prover. We need to do it for each circuit yes, but with the same original SRS so no need to re run a ceremony, the base SRS is still universal. We could avoid doing that by using the original SRS all the way but the prover will be slightly less efficient, we contemplated using an option for that but we decided to keep the version where the SRS in Lagrange form is needed

[ivokub]

To add, have a look at plonk recursion unit test how to construct different PLONK keys from a single SRS when the circuits are of different size.

[gbotrel]

This may also help :)