Mark Simkin retweeted
New from LayerZero Research: Aerie.
A new system capable of aggregating 32,000 post-quantum Falcon signatures in just 0.65 seconds on a MacBook Pro.
ML-DSA, NIST’s standardized default, is already working inside Aerie at high performance.
layerzero.network/blog/intro…
Mark Simkin retweeted
CLAUDE FOUND THE SEEDS
anthropic.com/research/ecdsa…
Mark Simkin retweeted
其实很费解为什么会觉得hash比lattice更安全(学术界显然是倾向于lattice更安全).
甚至ECC都可能比hash更能经得住考验。过去30年ECC的进展为0,而过去30年破掉的Hash算法两个手都数不过来。更何况Lattice问题可能几百年没啥大进展了。
显然AI解决数学问题的能力造成了更种恐慌,虽然那一串GitHub文章都没几个数学家看得懂。
I don't recommend anyone scramble to move their funds to new wallets today. But we should take the risks to cryptography from AI-accelerated math seriously, and minimize our exposure to not just quantum-vulnerable cryptography, but also potentially AI-vulnerable cryptography.
The core new area of risk from this viewpoint is, unfortunately, ML-DSA / FHE / lattices.
(and it's also another reason, along with quantum, why ECDSA might fall even faster than expected, hence the "fresh address" recommendation)
So far most people have been in the mode of thinking "elliptic curves broken, hashes safe, lattices safe". But there is a good chance that the concrete security of lattices will take serious hits from the next two years of AI math.
The basic threat model is: factoring is something that naively takes 2^(n/2) time, but over decades smart people have found and optimized number field sieves, and degraded that to 2^O(n^(1/3)), which is why RSA keys and signatures need to be ~400 bytes (and not 64 bytes). What if there are skeletons in the closet like that, both for elliptic curves and lattices, that we are simply not smart enough to discover - but bots soon will be?
This is a major part of the reason why for the past year ethereum's lean roadmap has been going in the "hash-only" direction: no lattices, no ML-DSA, no Falcon, no lattice-based commitments inside ZK proofs, etc. Signatures in lean ethereum are all hash-based, either WOTS or SPHINCS-.
For signatures and proofs, we already know how to go hash-only. The bigger challenge is for *public-key encryption* - and this goes far beyond blockchains. Secure communication, anonymizing protocols, lots of things need public-key encryption.
And unfortunately there are long-standing mathematical theorems showing why public-key encryption cannot be done with hashes alone. You have to have some kind of trapdoor object that has at least one form of usable "structure" - either group theory (incl. isogenies) or lattices or code-based or potentially in the future even more newfangled and spooky things (local mixing?). But for anything that has structure, you should assume that AI will make at least some progress in breaking that structure. Here, one reasonable inference is that if you want to make something plausibly long-term secure, multiply the key sizes by 10.
To me that's a very plausible world and something not at all extreme to predict. If AI will bring us 50 years of math in 2 years, then that 50 years of math may very plausibly include a "naive factoring -> GNFS" level of improvement to our ability to break lattices. In that world, lattices will still exist, but they will have to be significantly bigger to guarantee the same level of safety.
And at those new larger sizes, hash-based constructions will beat lattice-based constructions on concrete efficiency in every use case where hash-based constructions are possible at all.
Theoretically, of course it's possible that hashes are broken too (eg. P = NP would imply that). But I think P = NP is very unlikely. And intuitively, it's much more likely that a mathematical object has exactly no exploitable structure (like hashes are intended to), than that a mathematical object has exactly ~3 forms of exploitable structure (for elliptic curves: associativity, Schoof, pairings) and not some secret fourth form of structure we have not yet discovered that greatly degrades its security (for elliptic curves, ECDLP and pairing security). Similar for LWE, SVP, RLWE and the zoo of lattice problems.
For this reason, we do not yet see any reason to worry and start padding the byte size of hashes (if we start to worry more, we would pad the round count first before doing anything to the byte size).
Concrete TLDR, my own personal views:
* Hash-based > lattice-based, in those situations where hash-based is possible at all
* For anything lattice-based, be much more paranoid on param sizes. Remember that blockchains are only a small portion of the cryptography story; this point goes far beyond blockchains and applies to eg. access to websites, secure messaging, Tor / VPNs ...
* For privacy protocols, strongly favor NOT putting encrypted notes onchain. Instead, send them offchain through some third-party mechanism.
* If it's not difficult for you, keeping your funds in addresses which have not yet been used to make a transaction is a good idea. If it's easy for you, do it. **But be careful about migrations; I personally have lost more money in botched migrations than I have lost in all hacks combined**.
* For multisig wallets, doing confirmations offchain is better than onchain, because this way the signatures of signer wallets do not get exposed to the public, so if ECDSA falls to AI much faster than expected, at least the multisig "gracefully degrades" to a 1-of-1 where the 1 is whoever was gathering the signatures - a much better place to be than "anyone can take the money"
firefly.social/post/x/210783…
Mark Simkin retweeted
PSA: Practical cryptographic hash functions have a lot of structure, less mathematics backing up their security, and are often assumed to satisfy properties they do not achieve (in particular, being random oracles).
Mark Simkin retweeted
Very proud of this work and honoured that it is receiving an Outstanding Paper Award at TCC'26! H/t to my co-authors and huge thanks to @zksecurityXYZ for the support
FRI is a fundamental protocol yet few people confidently say they understand the security proof. This ends today
Congratulations to @0xAlbertG (Nethermind), @nico_mnbl (zkSecurity), and Benedikt Wagner (Ethereum Foundation) on winning one of three Outstanding Paper Awards at TCC 2026, the Theory of Cryptography Conference, for "A Simplified Round-by-round Soundness Proof of FRI."
FRI sits at the core of most STARK-based proof systems, including Starknet's. Its existing soundness proofs are long and hard to check. This paper gives a much simpler one, which is a step toward formally verifying the systems built on it. eprint.iacr.org/2025/1993
Mark Simkin retweeted
STOC call for papers is out. Deadline is November 2.
acm-stoc.org/stoc2027/stoc20…
New rules for the AI era: limited submissions, public posting and a required video. Is it a coincidence that the camera-ready deadline is April Fools Day?
Mark Simkin retweeted
Whoa: arxiv.org/abs/2609.18275
EIP-8198 introduces infra for variable slot timing, enabling Ethereum to gradually shorten slots as bottlenecks are better understood.
We published our take on it, supporting the move toward shorter slots while arguing that geo incentives should remain part of the evaluation 👇
Linear Hashing is Not That Awesome: There is a set of size n such that when we use the canonical ((ax+b)%p)%m to hash it into m=O(n) buckets, the largest bucket will have super-polylog load n^(1/lglgn). This is the first non-trivial lower bound for this.
arxiv.org/abs/2608.23502
Mark Simkin retweeted
First Principles Ep. 6 with Shafi Goldwasser
What if you could prove something is true without revealing why it’s true? Turing Award winner Shafi Goldwasser tells the origin story of zero-knowledge proofs: how a playful question about playing poker securely over the telephone led her, Silvio Micali, and Charles Rackoff to rethink what a mathematical proof could be.
Goldwasser traces those ideas through interactive proofs, the sum-check protocol, SNARKs, and the systems now used to verify computation and preserve privacy on blockchains.
She also reflects on why breakthrough ideas are often rejected at first, how toy problems can produce foundational theories, and whether AI systems should have to prove their answers.
Hosted by @Tim_Roughgarden with @SuccinctJT
00:00 Intro
03:36 How mental poker inspired zero-knowledge proofs: Proving that something is true without revealing the underlying information
06:30 The simulation paradigm and the meaning of “zero knowledge”
08:33 Why the original paper was repeatedly rejected
10:33 How interactive proofs became more powerful than conventional proofs
13:36 The road to modern SNARKs
19:02 Why the sum-check protocol is so useful for verifiable computation
25:31 Why many so-called “zk proofs” are not actually zero knowledge
34:06 Why toy examples, playfulness, and narratives can produce deep theory
37:23 The role of rigor and computational assumptions in cryptography
42:44 Applying zero-knowledge proofs to law, evidence, and secret software
45:23 Training AI systems to provide proofs alongside their answers
54:27 Why genuinely new ideas are often difficult for experts to recognize
Wrote a small command line tool for conveniently accessing and using ePrint: github.com/msimkin/eprint
What a shocker. Better late than never. 😅
Goodbye, Poseidon!
An epic 8-year, 8-figure rabbit hole in post-quantum cryptography reaches its dream conclusion. The Ethereum Foundation is abandoning Poseidon for L1, pivoting to SHA or BLAKE. This milestone unlocks ultimate security for lean Ethereum and foreshadows a golden era of hash-based cryptography.
Since 2018, the Ethereum Foundation has invested in magic cryptographic bricks, so-called "SNARK-friendly hashes". In 2019, Poseidon was born. It held strong and became the dominant SNARK-friendly hash, securing billions via zkrollups and zkVMs.
In a stunning reversal, breakthrough SNARK designs show that SNARK-friendly hashes aren't necessary after all. Off-the-shelf traditional hash functions like SHA2 and BLAKE2s can now match Poseidon in a SNARK. In hindsight the key was not SNARK-friendly hashes, but hash-friendly SNARKs.
The secret is doing maths over the smallest prime number: 2. So-called "binary fields" natively speak the language of bits, aligning with the boolean operations inside traditional hashes. This is a stark departure from "prime fields", where awkward large-prime arithmetic makes bit manipulation painfully expensive.
We're talking sci-fi cryptography. 1M traditional hash calls proven per second, on a laptop. Just 100x overhead vs native CPU boolean compute. Nobody predicted such performance, not even the handful of binary-field visionaries. Hat tip to the research geniuses: Jim and Ben with Binius in 2023; Ron, Benedikt and William with Flock in June.
With SHA2, the lean aesthetic of minimal assumptions reaches its climax. The EF's principled stance on pure hash-based cryptography has aged like fine wine. We now enjoy foundations the world can trust for decades and centuries, foundations worthy of the dream of an internet of value.
Speed of deployment is a secondary win. There's no longer a need to wait years for Poseidon cryptanalysis to bake. Emile and Thomas from the EF post-quantum team are moving at breakneck speed with binary fields. The strawmap now points to a production-grade leanVM in 2027, with CL, DL, EL deployments in 2028.
As AI becomes exceptional at cryptanalysis, the contrarian bet to avoid riskier structures like lattices and isogenies is visibly paying off. The past weeks have been brutal. Lattice-based "HAWK" and isogeny-based "SQIsign", both signature schemes in NIST's Round 3, have suffered blows. Sources I trust say more blood is coming.
On AI, the open autoresearch trend kicked off by ECDSA[.]fail is spreading fast, with amazing outcomes from zk[.]golf and SNARK[.]fast. Days ago SNARK[.]fast crossed 1.8M BLAKE3/sec proven on an M3 Max. Stay tuned for fresh autoresearch challenges dropping tomorrow.
Also tomorrow: Ethproofs call #10, dedicated to binary fields. Possibly the most noteworthy Ethproofs call yet. Experts leading the charge will present the future of hash-based SNARKs at 2pm UTC. What an incredible time to be alive. To witness history, DM me for a calendar invite :)
Today I can confidently claim that hash-based cryptography has won out for blockchain post-quantum signatures. SNARK succinctness compresses arbitrarily many signatures into one small proof per block. SNARK flexibility yields k-of-n threshold signatures, complex multisigs, and more.
Ultimate security. Uncompromising performance. Full programmability.
Believe in something. Believe in hashes.
Mark Simkin retweeted
Oh my goodness…
eprint.iacr.org/2026/1630
Mark Simkin retweeted
All these mathematicians typing “solve famous open conjecture” and getting results, meanwhile I can’t get Fable to even consider most of the hard cryptography questions I’d like to solve. And when I manage to get one through, it sticks crayons up its nose.
Mark Simkin retweeted
The scary part about Anthorpic's Fable nerf is not that it refuses to answer biology or cryptography. It's that it foreshadows what's coming. A world where a couple companies decide what you can and cannot do. They're building a new ruling class and you're not in it...
Mark Simkin retweeted
Over the past year, many people I talk to have expressed worry about two topics:
* Various aspects of the way the world is going: government control and surveillance, wars, corporate power and surveillance, tech enshittification / corposlop, social media becoming a memetic warzone, AI and how it interplays with all of the above...
* The brute reality that Ethereum seems to be absent from meaningfully improving the lives of people subject to these things, even on the dimensions we deeply care about (eg. freedom, privacy, security of digital life, community self-organization)
It is easy to bond over the first, to commiserate over the fact that beauty and good in the world seems to be receding and darkness advancing, and uncaring powerful people in high places are making this happen. But ultimately, it is easy to acknowledge problems, the hard thing is actually shining a light forward, coming up with a concrete plan that makes the situation better.
The second has been weighing heavily on my mind, and on the minds of many of our brightest and most idealistic Ethereans. I personally never felt any upset or fear when political memecoins went on Solana, or various zero-sum gambling applications go on whatever 250 millisecond block chain strikes their fancy. But it *does* weigh on me that, through all of the various low-grade online memetic wars, international overreaches of corporate and government power, and other issues of the last few years, Ethereum has been playing a very limited role in making people's lives better. What *are* the liberating technologies? Starlink is the most obvious one. Locally-running open-weights LLMs are another. Signal is a third. Community Notes is a fourth, tackling the problem from a different angle.
One response is to say "stop dreaming big, we need to hunker down and accept that finance is our lane and laser-focus on that". But this is ultimately hollow. Financial freedom and security is critical. But it seems obvious that, while adding a perfectly free and open and sovereign and debasement-proof financial system would fix some things, but it would leave the bulk of our deep worries about the world unaddressed. It's okay for individuals to laser-focus on finance, but we need to be part of some greater whole that has things to say about the other problems too.
At the same time, Ethereum cannot fix the world. Ethereum is the "wrong-shaped tool" for that: beyond a certain point, "fixing the world" implies a form of power projection that is more like a centralized political entity than like a decentralized technology community.
So what can we do? I think that we in Ethereum should conceptualize ourselves as being part of an ecosystem building "sanctuary technologies": free open-source technologies that let people live, work, talk to each other, manage risk and build wealth, and collaborate on shared goals, in a way that optimizes for robustness to outside pressures.
The goal is not to remake the world in Ethereum's image, where all finance is disintermediated, all governance happens through DAOs, and everyone gets a blockchain-based UBI delivered straight to their social-recovery wallet. The goal is the opposite: it's de-totalization. It's to reduce the stakes of the war in heaven by preventing the winner from having total victory (ie. total control over other human beings), and preventing the loser from suffering total defeat. To create digital islands of stability in a chaotic era. To enable interdependence that cannot be weaponized.
Ethereum's role is to create "digital space" where different entities can cooperate and interact. Communications channels enable interaction, but communication channels are not "space": they do not let you create single unique objects that canonically represent some social arrangement that changes over time. Money is one important example. Multisigs that can change their members, showing persistence exceeding that of any one person or one public key, are another. Various market and governance structures are a third. There are more.
I think now is the time to double down, with greater clarity. Do not try to be Apple or Google, seeing crypto as a tech sector that enables efficiency or shininess. Instead, build our part of the sanctuary tech ecosystem - the "shared digital space with no owner" that enables both open finance and much more. More actively build toward a full-stack ecosystem: both upward to the wallet and application layer (incl AI as interface) and downward to the OS, hardware, even physical/bio security levels.
Ultimately, tech is worthless without users. But look for users, both individual and institutional, for whom sanctuary tech is exactly the thing they need. Optimize payments, defi, decentralized social, and other applications precisely for those users, and those goals, which centralized tech will not serve. We have many allies, including many outside of "crypto". It's time we work together with an open mind and move forward.
Mark Simkin retweeted
Replying to @phildaian
Excited to see this!
Network-layer anonymity has been a missing piece of all the privacy primitives we've been building - both the onchain stuff (eg. railgun) and the offchain stuff (eg. the ZK API tickets)
And there's a significant space of applications where the bandwidth reqs are small but latency matters a lot, so having something on the low-latency high-anonset side of the triangle matters a lot.





















