It requires a trusted setup. As far as I can tell we will only need to run the trusted setup once, we can reuse the group it generates for each commitment.
Correct. That said, the size of the trusted setup would be small (\approx 2^{10} would suffice, compared to the usual \approx 2^{24} to \approx 2^{28}). This means that we could make it extremely easy to participate (eg. you can participate in-browser), leading to a setup with many thousands of participants.
How much time does it take to create a commitment, create a proof, or verify a proof?
Creating a commitment requires ~1 elliptic curve addition per byte (naively it’s 1 per bit, but you can use fast linear combination algorithms or even just precomputation tables over the trusted setup to greatly accelerate this). A normal ECMUL operation requires ~384 EC additions. So committing to 24 kB code is equivalent to ~62 ECMULs in cost. So the gas cost equivalent of making the commitment would be much lower than the 200 gas per byte in creating a contract.
What does running our own trusted setup require? We will have to pick an MPC protocol, write multiple independent implementations of the setup client, then advertise it and ask many people to run it. How much will this work delay stateless ethereum?
In a universal updateable setup, the MPC is trivial. It’s just “I do my processing, pass the output to you, you do your processing, pass the output to Bob, Bob does his processing, passes his output to Charlie…”. As mentioned above, for trusted setups of this size you could even make the implementation in-browser, so lots of people could participate.
I can’t tell for sure, but it seems that Kate commitments are not quantum-secure. Do we want to build a system which we’ll need to replace with something else in 5-10 years.
Neither are ECDSA signatures, or for that matter the BLS signatures that eth2 relies on. But I think we’re all assuming that by the time quantum computers hit we’ll have STARKs over Merkle proofs running extremely smoothly and we can just upgrade to that.