Securing Blockchains against the Quantum Threat | Founder of @QuantusNetwork
The Holy Internet
Joined November 2024
- Tweets6.6K
- Following1.3K
- Followers5.5K
- Likes15.1K
Let’s just cut to the chase. Mandatory DNA test for anyone making any purchase.
It will be to check if you’re racist.
The "KYC everyone for everything" situation has gotten totally ridiculous.
Even for non-financial products & use cases, I am having to scan my face and drivers license to get access to things like a Lime scooter, e.g. Before they could give me accounting advice, a Big 4 firm recently asked me to send a photo of my email *attached as a JPEG*.
This expectation creep around personal data sharing already has documented devastating consequences (e.g. financial ruin) at the individual level. It's only going to be a matter of time before personal identity compromise of enough individuals leads to a total collapse of online trust.
This is a great post. It’s too early to ossify anything in blockchains.
I also think Ethereum overstates the benefits of switching from snark-friendly hashes to hash-friendly snarks. It’s newer hashes or newer zk systems, and I don’t think either one is obviously better, especially given all the activity on hashsma.sh
I also agree that dysfunctional but secure is not really a thing, because if something is hard to use people generally won’t use it. The blockchain industry as a whole has been held back by the fact that you basically have to be a cybersecurity expert to safely use blockchains.
Hashes-only means no key exchange, no public-key encryption, probably no threshold sigs, probably no private-information-retrieval.
Let’s be agile and alert, many things are changing rapidly. Don’t get trapped in infighting, you’re not a barn animal.
A few reflections on the lattice vs. hash-only debate that our recent Aerie post sparked:
1. Cryptographic ossification for blockchains was never safe. Until the day we know with certainty that P ≠ NP, that finding short vectors in lattices is intractable, that Keccak effectively behaves like a random oracle in deployed SNARKs, and that every single bug has been eliminated from our codebases, blockchains cannot ossify. That is simply not how safe systems are built. Issues will arise, and the system will have to respond.
It’s a double standard to reject lattices because blockchains are hard to upgrade if lattices break, while counting on upgrades if AI breaks your hash function or finds a critical zkVM bug.
The best counterargument is that hash-only designs are more agile: if your hash function breaks, just swap out the hash. But we must aspire to a higher level of agility than this. Indeed, as I cover next, if SNARK recursion itself turns out to degrade security, the proposed hash-only blockchain designs would need to be rethought from the ground up.
2. The real security debate is not lattices vs. hashes — it is lattices vs. building everything on SNARK recursion. That’s because “hash-only” is not really hash-only: it rests on hashes plus the soundness of deep SNARK recursion. Ethereum’s roadmap relies on exactly that: hash-based aggregation needs recursion to keep up with a slot’s worth of signatures, and EIP-8288 would send other signature schemes and users’ own proofs through the same recursive pipeline. In contrast, Aerie proves a slot’s worth of signatures on one laptop without any recursion.
All deployed post-quantum SNARKs rely on the Random Oracle Methodology (via Fiat–Shamir) to establish their security. This is an idealization we know fails in the real world: we have explicit counterexamples where “SNARKs” coming out of this methodology are totally insecure when instantiated with any concrete hash function.
We generally ignore these counterexamples in part because they only arise when proving contrived, self-referential statements about the very hash function used by the SNARK verifier.
But proving statements about the verifier’s own hash function is the exact thing you do in SNARK recursion. That’s why the security of recursive SNARKs can’t be established even in the random oracle model.
On top of that, the standard security proofs for recursion (in other models) suffer an “extractor runtime” blowup that is exponential in the recursion depth, suggesting that security may degrade as more recursion is applied. Yet Ethereum’s own EIP-8288 enables unlimited-depth recursion, even as it lists soundness of recursive SNARKs as a trust assumption. Proofs in more idealized models avoid the blowup, but they mainly tell us that an attack on SNARK recursion would have to exploit the concrete hash function, which is exactly what the Fiat–Shamir attacks above do.
To be clear, we don’t know of any outright attacks on SNARK recursion, and I very much hope it is secure. But some of us who have studied the question have a lingering sense that an attack may be possible in some settings. And if AI is going to supercharge cryptanalysis, there is no reason to expect it to spare Fiat–Shamir for SNARKs, let alone SNARK recursion, both of which have had far less scrutiny than lattices.
So, I do not concede that a “recursion everywhere” hash-only approach is clearly more conservative than one built on standard lattice assumptions.
3. “Just wrap everything in a hash-based SNARK” (like EIP-8288) faces challenges.
Aggregating signatures and proofs off-chain into a single block-level proof is a powerful design independent of the hash-only vs. lattice debate, and I am not telling people to avoid it. But claiming, as Vitalik Buterin did this week, that users can run whatever cryptography they want locally and wrap it in a client-side leanVM proof glosses over major hurdles.
For example, leanVM today is a minimal VM designed almost entirely to prove hash-based signatures and recursion, not general-purpose computation. And binary-field SNARKs like leanVM remain slow at proving the integer multiplications that lattice cryptography does en masse.
I am optimistic that many of these zkVM challenges can be met (including via my own work, binary-field Twist and Shout, which are now implemented in Magnetar). But regardless, if lattices can make aggregation simpler and faster, then they should be leveraged. We need to be agile no matter what.
4. For chains whose reason for existence is privacy, I truly struggle to understand the pushback. Public-key encryption (and fast single-server PIR) cannot be built from hashes alone, at least not in any black-box way. If lattices break, it is going to be very, very hard for these chains to provide acceptable levels of privacy and functionality. For a project whose entire reason for existence is privacy, a loss of confidentiality is an existential failure. Next to that, a second signature upgrade (after the first one, from elliptic curves alone to, hopefully, a hybrid lattice scheme) is easy.
Summary: We don’t know for sure what is secure and what isn’t. We are all weighing unquantifiable risks against each other, and we do not need to agree on a total order on them. But hash-only solutions face many open engineering challenges, and they are not more “conservative” in the way some have argued. Some of those challenges are entirely prosaic and have nothing to do with bugs or cryptography, like hardware support for custom schemes whose hash function is still undecided. I hope we can overcome those challenges within the appropriate timelines, but they must be acknowledged and portrayed realistically.
Overall, cryptographic agility and defense in depth (e.g., hybrid signatures) are the answer, which is why we are building both lattice-Jolt and hash-Jolt. In practice, the positions are less polarized than social media discourse suggests: for example, StarkWare is working to make Falcon verification cheap (falcon.provably.fast/), which is great to see.
Here is the (apparently) controversial take I am sticking to: Conditioned on agility, whenever lattices make systems simpler or more functional, we should embrace them rather than default to “hash-only” designs. Lattices are what the rest of the world will depend on, with decades of study and hardening behind them, and at the system level, less functional often means less secure. Where hash-only designs are just as simple and functional, by all means use them.
I’m really starting to think this idea of “just rewrite everything with AI” is not a terrible idea.
Do we really need PHP? Maybe just write everything in some new language with rust’s memory safety and ocaml’s provability?
🚨 BREAKING: PHP is warning admins to prepare for emergency security updates tomorrow to fix two critical vulnerabilities rated CVSS 9.2.
However, security researchers at @watchtowrcyber rate the flaws CVSS 10.0 and say they are RCE vulnerabilities affecting PHP 5 through 8.
Information about the vulnerabilities has reportedly leaked ahead of disclosure.
No known exploitation in the wild.
🔗 bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Cathedrals are nice to visit, but you don’t want to get trapped in the dungeon. Keep open source alive. Your freedom depends on it.
DeepSeek open sourced its internal inference framework, Apache 2.0, no strings attached.
This is arguably more impactful than open sourcing any model weights, like @zephyr_z9 said, they've open sourced their economics, how DeepSeek makes a profit
DeepSeek's commitment to open source is as steadfast as Anthropic's commitment to closed source. Every other lab sits in the mushy middle, dictated by the market condition, investor expectation, policy wind
These two labs are basically building two different religions, one radically open and messy, the other intensely closed and polished.
If you are on Team Bazaar, you root for DeepSeek. If you are on Team Cathedral, you root for Anthropic. In the end, both will exist and flourish, pushing and pulling each other into a steady state. I think that is ultimately a healthy thing.
I love visiting cathedrals, admiring their awe-inspiring grandeur, meditating under the instant hush and silence the structures command. I also like walking through bazaars, feeling the chaos, smelling the messy dynamism, brushing up against unpredictable creativity.
Both should exist. No reason to try to kill or demonize one or the other.
This feels like the right direction to me. Post-quantum zk for scale and privacy. Pretty similar to the Quantus architecture, tbf, except for general computation instead of just money.
Let’s see how they handle heterogenous proof aggregation. I hear @ziskvm supports this well. Is that true?
Ultimately, precompiles and EVM are both the wrong place to put most cryptography support into Ethereum. The reason is that precompiles and EVM both operate on data that has to be included into the ethereum chain somehow, which realistically means included in a block as calldata. That space is limited - even with PeerDAS and blocks-in-blobs, there's a practical cap of ~8 MB/s before it starts getting uncomfortable.
Remember: it's not a blockchain. It's a cryptographic world computer. Any data/computation that does not need to be in the "main thread" of data/execution should not be put into the main thread.
Instead, the correct solution is... EIP-8288 maximalism.
If you have any heavy computation that's self-contained, compute it and STARK it client-side (this is quickly getting faster and faster, even on phones), and push the STARK through the EIP-8288 recursive aggregation mechanism. The chain sees the fact that the computation was done and what the result is; it never needs to see the actual data and computation.
This way everyone can use whatever cryptography they want, the Ethereum chain can be lean, and we never need to add more precompiles again.
That's a lotta nines...
Quantinuum has achieved a major industry breakthrough that solves a critical error-correction bottleneck and validates our path to delivering a fault-tolerant quantum computer by 2029.
We’ve announced a new world record for quantum error correction, achieving 99.9995% logical fidelity on our Helios commercial quantum computer using our error-correction architecture.
Equivalent to just five errors in a million operations, the result is 10× better than our previous record achieved just last month and 100× better than the best published result on any other hardware modality.
The study also demonstrated a record 12× reduction in logical errors as code distance increased, a critical step toward scalable fault tolerance.
These successive breakthroughs using different codes on the same commercial hardware demonstrate how Quantinuum's flexible error-correction architecture and highly accurate trapped-ion technology work together to enable exponential improvements in accuracy, with performance now within the target range for Apollo, our first universal fault-tolerant quantum computer planned for 2029.
Learn more: quantinuum.com/press-release…
Great progress! Solana added post-quantum keys to their staking system!
You can get pqc staking and custody with minimal risk and changes to your existing custody setup.
Use the falcon wallet as an auto expiring stake custodian with some date some time in the future. This will keep your withdrawal key as is, but if a quantum computer cracks it they can’t withdraw while it’s locked by the custodian.
Eli is directionally correct that lattice-crypto has more algebraic structure than hash-crypto and that this structure could theoretically be used to break it, altho i think the newness of lattices is a bit overstated.
Lattice crypto originally started as offensive cryptanalysis, not a defensive structure.
In cryptography, you generally want all-or-nothing systems. If I try to guess your password and I’m even one character off, I should get no clue about how close I was or which characters were correct.
In practice, this is difficult. For example, if I respond slightly slower depending on how many characters are correct, then you can use timing to gradually extract the complete password. This is where timing attacks come from.
Lattices are like vector fields but instead of taking any linear combination of the basis vectors (with real coefficients) you only accept integer coefficients. So you have some building blocks and you can combine them but not shrink or stretch them. It’s similar to how crystals have evenly spaced atoms in multiple dimensions.
The basic idea in lattice attacks is that you find a bunch of clues or partial solutions and make each one a basis vector. Then you try to find (“Learn”) a combination of them whose sum is small (Short Integer Solution, SIS), which simultaneously combines the partial solutions to make a complete solution.
This method can be used to attack elliptic curve signatures when the nonces used are biased, not uniformly distributed.
Lattice signatures and zk-proofs use similar ideas but defensively, to find problems that resist lattice attacks. Learning-With-Errors (LWE) essentially takes that short integer solution and adds noise to it so that an attacker cannot use straightforward linear algebra to solve it. Then you can prove you know the solution without revealing it by solving a related problem.
Hash-crypto works quite differently. It basically uses one-way functions (hashes) as a building block and you prove you know a secret by selectively revealing the inputs to a publicly-committed output.
Since hash-crypto doesn’t have any algebraic equations in its structure, people say it has less attack surface, which is true. The tradeoff is that you have much larger signatures and it doesn’t have nice threshold schemes or key exchange algorithms or encryption, which all rely on that missing algebraic structure.
Both hash-crypto and lattice-crypto rely on the security of hash functions, tho, so the reduction in attack surface is a clear win for hash-crypto.
It would be great if we just had full security-proofs for some crypto-system so we wouldn’t have to rely on heuristics like this, but that’s just where we are in our scientific knowledge as a species. Maybe AI will help us solve P =? NP and that will lead to provably secure systems.
“Don’t roll your own crypto” is a pretty good rule of thumb it’s error prone and makes you less interoperable with the rest of the ecosystem. On the other hand, you may dodge a bullet…
I personally like lattice crypto for the geometry of it. Hash crypto is also elegant in its own way.
I think in the age of AI the interoperability question is less important. Just be agile and pick a higher security level than the minimum, so you have some cushion if something breaks.
Yuvi Lightman | Quantus retweeted
4 years in, still the same pace.
Testing $QTC lending this weekend 🛠️
> launching first on app.rhea.finance
> x.rhea.finance to follow once @noir_wallet supports @QuantusNetwork.
This is quite impressive, altho there are many questions about the seed generation remaining.
Generally, when generating “random” seeds that will be used by other people in cryptographic settings, you want to soothe their suspicions that you somehow chose the seed in such a way as to weaken the cryptography, giving the seed generator some secret advantage.
Typically this is done by choosing some commonly known number, like pi or e, and using that as a seed. “Nothing up my sleeve”. There are, of course, still decisions to be made that affect the output of the seed. For example, if you used pi, how did you encode it and how many bytes of pi did you use?
The reason this matters is rejection sampling, where someone randomly samples something until the output satisfies some criteria, rejecting all others.
In this case, timestamps were used for part of the seed, but we can see that some rejection criteria was applied because the immediate output was not taken. Each seed is taken from some apparently arbitrary index. Not all byte sequences produce valid seeds, so that is one likely criteria, but Anthropic notes that some valid seeds were passed over, which strongly suggests some unknown criteria in the rejection sampling.
Instead of calling this case closed, I would suggest investigating the curves produced by the rejected seeds for any unusual properties. It might give clues pointing to previously undiscovered weaknesses.
There is also the curious social context. NSA providing seeds to NIST without explanation is not a nothing-up-my-sleeve behaviour. Many people suspected a backdoor and they still never revealed the method. The “rumour” (created by an NSA employee) that it was produced by hashing a silly phrase turned out to be false. It would be quite strange for the agency itself to not know how the seeds were generated, and if it were something innocuous then it seems odd not to share it.
The truth is powerful, even the devil will use it if it benefits him.
the choice of secp256k1 over r1 (P-256) in bitcoin (and ethereum) was heavily influenced by the fear of an NSA backdoor. this has been very annoying for wallet developers because the secure enclave chips found in most consumer devices only support r1. passkeys use r1 as well.
turns out there is no backdoor after all... amazing work by anthropic.
anthropic.com/research/ecdsa…
“No such attack exists”
Yes that’s what the word “soon” implies.
The video is not terrible, but if AI finds a classical weakness in elliptic curves it’s actually a worse scenario than a quantum attacker because almost anyone could perform the attack.
Money = Love
Can humanity break the cycle of debasement?
@yuvilightman on global currencies, inflation, Bitcoin, and why Quantus is the last money.
TESTNET COINS?!? FROM A PUBLICLY AVAILABLE SEED PHRASE?!?
🥱 🥱
@grok why did I react like this?
JUST IN: OpenAI says its AI agent stole funds from an Ethereum test network wallet it found online.
The agent found a recovery seed phrase disclosed publicly with testnet funds and used that account to pay for its task, without the owner's authorization.
This occurred on the Sepolia Ethereum test network.
Quantus fixes this
11% chance quantum breaks Bitcoin by the end of next year.
poly.market/er3GaHJ
Basically there’s a kind of intermediate quantum computer that doesn’t do all quantum computation, it can only sit evenly between the classical 0 or 1 states (the 6 “stabilizer states”). It is very limited and also efficiently simulable by a classical computer. The stabilizers form an octohedron, the set of gates that take a stabilizer to another stabilizer is called the “Clifford group”, isomorphic to the octohedral symmetry group.
To take this to a full quantum computer you need to add a “T gate” which requires a “magic state”. Creating this magic is noisy and is where most (~95%) of the work of the quantum computer is.
Google found a way to make magic cultivation 40x more accurate.
Published in Science today: Magic state cultivation works in practice on our Willow processor. We achieved a 40x error reduction, compared to without cultivation, and 99.99% fidelity. Learn how this addresses a critical resource bottleneck: goo.gle/4yr8V0H
Yuvi Lightman | Quantus retweeted
Published in Science today: Magic state cultivation works in practice on our Willow processor. We achieved a 40x error reduction, compared to without cultivation, and 99.99% fidelity. Learn how this addresses a critical resource bottleneck: goo.gle/4yr8V0H