Bitcoin research @Blockstream. @nixbitcoinorg maintainer. Former bitcoin/secp256k1, @donnerlab1 contributor 36C7 1A37 C9D9 88BD E825 08D9 B1A7 0E4F 8DCD 0366
Joined February 2012
- Tweets65
- Following179
- Followers0
- Likes0
. retweeted
The DahLIAS Eurocrypt talk by @real_or_random is online now!
It focuses on what it takes to deploy signature aggregation in Bitcoin: pitfalls, attacks, and practical requirements.
DahLIAS is not post-quantum, but many of these issues matter for PQ aggregate sigs too. 👇
Excited to share that our DahLIAS paper has been accepted to Eurocrypt 2026! 🎉
DahLIAS enables cross-input signature aggregation (CISA) on Bitcoin’s secp256k1 curve.
See you in Rome, May 10–14!
Thanks to @yannickseurin (@ledger), @real_or_random & @n1ckler (@blksresearch)!
. retweeted
New blog post "Understanding lattice risks: Many differences between marketing and reality." blog.cr.yp.to/20260630-risk.… #lattices #software #looseness #modules #asymptotics #worstcase
. retweeted
Thank you to my co-maintainers, all contributors, and everyone who provided feedback over the years. It was an honor to serve in this role, and I greatly enjoyed it.
secp256k1 has a strong group of people reviewing and contributing code. I’m glad to see it in good hands.
Big shout out to @n1ckler for a 7+ year stint as secp256k1 maintainer. Lots of valuable improvements made to the library, API, performance and otherwise, during that time. Looking forward to seeing any future Bitcoin research work!
. retweeted
Excited to announce Flock! A new SNARK for efficiently proving batched Boolean computations, in collaboration with @benediktbuenz and @kleptographic .
The key use case for Flock is proving standard hash function such as SHA-256, Keccak and BLAKE3. For example, on an m4 max MacBook Pro it proves over 660k BLAKE3 compressions per second.
xitter.cf/SuccinctLabs/status/20…
Introducing Flock: a new SNARK for proving batches of standard hash functions at just 250× the cost of computing them natively.
Developed by @benediktbuenz from @EspressoSys, @ronrothblum, and NYU's William Wang, Flock puts Ethereum's Post Quantum target in reach.
. retweeted
The BitVM2 paper has been accepted at #USENIX 2026, one of the big four academic security, privacy & blockchain conferences.
The BitVM2 paper will serve as basis for Bitcoin rollup & bridging research for the years to come.
usenix.org/conference/usenix…
. retweeted
☢️You remember? Google optimized Shor's algorithm. The algorithm that breaks asymmetric cryptography (RSA, elliptic curves) once you have a quantum computer with enough Qubits.
The US government blocked the paper. So Google published a Zero Knowledge proof instead: a mathematical proof that they have the result, without revealing how. Cryptographic sorcery 🧙
But the Internet is sneaky. Someone launched a contest to re-discover the result with AI. The LLM searches a huge space of circuits (each one a candidate optimization of Shor's), and tests whether it beats the previous best. The clever part: they use the ZKP verifier as the reward function. No false positives, and it turns out to be a very efficient signal.
In less than 2 days, the community re-discovered Google's result !!!
🔔15 days later, the LLMs are still improving it. They're already 44% ahead of Google.
Hard to say where this stops, ie. what the true minimum quantum complexity for Shor's is. But we will not close the full gap. You still need a Quantum Computer with a relatively large number of qubits. The only thing that changed is that this number drops a little every day, and it has been dropping for 15 days straight.
. retweeted
I've been working on mutation testing for libsecp256k1.
First, I worked on becoming the bcore-mutation tool suitable for secp. It includes adding specific operators, patterns to identify where it shouldn't create mutants, etc. All of this to create as much productive mutants as possible.
A dashboard with some results can be seen in: secp256k1.space
. retweeted
At Eurocrypt, @JanBobolz presented our work “UC4Free! Existing Threshold Signatures are UC Secure” with @cryptulf and @akiratk0355. We show that threshold signatures proven game-based secure are actually secure in the universal composability (UC) setting. eprint.iacr.org/2026/911
. retweeted
On May 26, 2015, @rusty_twit made his first commit to Core Lightning. What happened over the next eleven years speaks for itself.
Thank you, Rusty. ⚡
blog.blockstream.com/rusty-r…
. retweeted
SHRINCS
Generated by @BlockstreamJade, verified by Simplicity
xitter.cf/Blockstream/status/203…
Real transactions. Real production sidechain.
@blksresearch is running SHRINCS, an optimized hash-based signature scheme, on @Liquid_BTC right now.
This is what preparing Bitcoin infrastructure for the post-quantum era looks like.
blog.blockstream.com/blockst…
. retweeted
Conduition’s work will focus on three areas: driving the SHRINCS protocol toward a draft BIP, exploring commit/reveal protocols, and advancing research and education around isogeny-based cryptography in Bitcoin.
Welcome conduition!
brink.dev/blog/2026/06/01/co…
. retweeted
Nested MuSig2 now has a Python reference implementation. @BeulahEvanjalin built it on secp256k1lab with tests, examples, and protocol notes—generally in a good state for review and discussion. This is the blueprint that will inform the secp256k1-based C work.
1/ We're funding a year-long grant for @BeulahEvanjalin to implement nested MuSig in libsecp256k1-zkp. @jesseposner of @voravault will provide weekly mentorship throughout the project.
. retweeted
I wish this interview had been longer, but I’m glad we agree on the key points, including that post-quantum signatures for Bitcoin are a nuanced topic, there are real tradeoffs, and there is no plug-in solution.
I didn’t hear an argument against SHRINCS itself. Rather, Dan prefers lattices because they support HD derivation and efficient threshold schemes.
But with today’s schemes, once you add those features, signatures are no longer small — e.g. 25+ kB with HD derivation. Lattice-based signatures still need more research before they are clearly the better choice for Bitcoin.
I disagree that hash-based signatures “stifle” anything. They are a pragmatic choice today, and they will always retain fundamental advantages: no new cryptographic assumptions and conceptual simplicity.
Lattice-based signatures are a promising candidate for the future, once their advantages are clear enough to justify the added complexity and assumptions.
BITCOIN RAILS #61: QUANTUM CRYPTOGRAPHY FOR BITCOIN | with Dan Boneh @danboneh
🔗 YOUTUBE: youtu.be/F-HG87VJj_k
🌿 SPOTIFY: open.spotify.com/episode/7ly…
One of the most prolific and influential cryptographers in the world, it’s difficult to fully quantify the impact that Dan Boneh has had on Bitcoin and digital assets more broadly.
Through both his own research and his mentorship of some of the space’s most important contributors — e.g. Andrew Poelstra, @benediktbuenz, and @robin_linus — few people have done more to shape the cryptographic foundations underlying modern blockchains and digital finance.
More recently, Dan co-authored @Google's widely discussed paper, “Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities,” which reduced prior estimates of the resources required to run Shor’s algorithm against the elliptic-curve cryptography used by Bitcoin.
The paper reignited debate around quantum computing timelines and the long-term security assumptions behind modern cryptocurrencies.
In this episode of Bitcoin Rails, Dan and I discuss the current state of quantum computing, its potential implications for Bitcoin, and how he believes the Bitcoin community should think about preparing for a post-quantum future over the coming decade and beyond.
And yes, Dan shares his take on the “when quantum” question in the interview, among other key perspectives.
This episode of Bitcoin Rails is brought to you by my NEW sponsors:
LayerTwo Labs @LayerTwoLabs — developing research, software, and technologies for scaling Bitcoin via the integration of Drivechains (BIP 300/301)
Hashi on @SuiNetwork — a primitive for executing Bitcoin Defi transactions, without having to trust a federated bridge or other centralized entity
BitBox @BitBoxSwiss — an open-source Bitcoin-only hardware wallet, with smooth UX and no compromises on security. Check out Bitbox [dot] swiss and use code BITCOINRAILS to get a discount
TIMESTAMPS:
00:00 — Intro and Dan’s history with cryptography and Bitcoin
11:44 — Shor's algorithm: how a 1994 paper became cryptography's most important threat
16:39 — Building a quantum computer: superconducting qubits vs neutral atoms
25:37 — When should we start worrying about quantum computers? The timeline debate
31:51 — Have we already reached quantum computing's “ahá” moment?
39:09 — Inside the Google paper: how Shor's algorithm was optimized
49:57 — The Bitcoin mempool attack and the 10-minute window
59:21 — Mitigation: what should Bitcoin do to prepare for quantum?
1:11:54 — Hash-based vs lattice-based signatures: Dan's case for lattice
1:23:15 — ZK proofs, BIP361, and what to do with Satoshi's coins
1:31:52 — Encrypted mempools and MEV
1:38:29 — Why Bitcoin will survive quantum and Dan's message to Bitcoin builders
. retweeted
For more detail, see my post on OP_CHECKSHRINCS and what makes a signature scheme attractive for post-quantum Bitcoin:
blog.blockstream.com/op_chec…
And for a gentle intro to lattice-based signatures:
blog.blockstream.com/schnorr…
. retweeted
A written version of my recent @OPNEXT2026 talk, with extra details and references. It covers SHRINCS/SHRIMPS, the design space of post-quantum signatures for Bitcoin (especially hash-based ones), and a toy proposal for OP_CHECKSPHINCS.
There is no concrete post-quantum signature scheme for Bitcoin today.
But over the last year @blksresearch has been working on exactly this. Director Jonas Nick (@n1ckler) lays out the proposal: OP_CHECKSHRINCS, a hash-based signature opcode for post-quantum Bitcoin.
. retweeted
Today we announce: AADP WE Open Challenges.
Recently we proposed a new witness encryption scheme based on Arithmetic Affine Determinant Programs which we intend to use in Bitcoin PIPEs v2, unlocking a wide range of applications and eliminating the need for trusted parties.
Now we invite anyone to break small instances of our new scheme or to discover structural properties that were unknown before.
Details here:
allocinit.notion.site/challe…
Special thanks to @zeroknowledgefm @zkproof @IACReurocrypt for organizing the conference week in Rome that we're announcing these at in person.
. retweeted
BITCOIN RAILS #59: Post-Quantum Bitcoin Signatures (+ their tradeoffs) | with BIP 360 co-author @Ethan_Heilman and @Blockstream Head of Research @n1ckler
🔗 YOUTUBE: youtu.be/o3RNpsprTyE
🌿 SPOTIFY: open.spotify.com/episode/5vk…
According to BIP 360 co-author Ethan Heilman, Bitcoin needs a minimum of two soft forks to become quantum resistant: P2MR (or an output type that can safely execute PQ signatures) + a post-quantum checksig (signature scheme).
Ethan and the BIP 360 team (including myself and @cryptoquick) introduced the P2MR part via a BIP 360 update late last year—but the question remains, what’s the most appropriate PQ signature scheme for Bitcoin?
They all have substantive tradeoffs, but hash-based signatures seem to be leading technical discourse—likely due to recent optimizations by @n1ckler and the broader @Blockstream research team.
It was an honor to sit down with both of these men - arguably the two most influential and productive cryptographers in Bitcoin quantum mitigation right now - for an in-depth review of the leading PQ signature schemes and a temperature check on Bitcoin’s post-quantum planning process.
TBH, if you want to skip the noise and jump straight to the signal on quantum, this is the interview to watch.
In this episode, we discuss:
- What needs to happen at the soft fork, infra, and mitigation levels to fully quantum-harden Bitcoin
- Recent updates to BIP 360 + breakdown of the leading hash-based signatures schemes for Bitcoin (SHRINCS + SHRIMPS)
- Why we may actually get consensus around a stateful scheme for Bitcoin
- Comparisons of hash-based signatures vs Lattice and Isogeny-based schemes
- Assessing the risks of both waiting too long and acting too fast (and why quantum is a better threat to be facing than a potential classical attack)
This episode of Bitcoin Rails is brought to you by my NEW sponsors:
- LayerTwo Labs @LayerTwoLabs — developing research, software, and technologies for scaling Bitcoin via the integration of Drivechains (BIP 300/301)
- Hashi on @SuiNetwork — a primitive for executing Bitcoin Defi transactions, without having to trust a federated bridge or other centralized entity
- BitBox @BitBoxSwiss — an open-source Bitcoin-only hardware wallet, with smooth UX and no compromises on security. Check out Bitbox [dot] swiss and use code BITCOINRAILS to get a discount
TIMESTAMPS:
00:00 Intro
02:18 Ethan’s Quantum Wakeup
05:18 How Blockstream Enters Post Quantum
09:25 BIP 360 Explained
12:11 How Bitcoin Transitions to PQ
17:35 Choosing Post Quantum Signatures
23:20 How Blockstream Created SHRINCS
27:22 Signature Budgets Importance Explained
41:13 What are SHRIMPS?
44:51 SHRIMPS vs SHRINCS
47:48 Why SLH-DSA Alone Won’t Cut It
49:24 Is a SHRIMPS + SHRINCS BIP Coming?
51:51 Blockstream’s Big Plans for Liquid
59:04 Quantum Readiness Roadmap
01:02:22 Importance of a PQ Recovery Plan
01:05:35 How Long Would a PQ Migration Take
01:11:17 Quantum Watchlist Recommendations