jaosef.eth

Tweeting about, zero-knowledge, privacy, network design and MEV. President, Co-founder @aztecnetwork CEO @AztecLabs_

Views are my own.

[jaosef.eth @jaosef]

Ship a network that is built to last.

Decentralised from day 1 — controlled by the community.

Aztec's community launched the Ignition chain of Aztec on Ethereum main-net at 1am last night.

The future is here and it is private.

[Aztec @aztecnetwork]

BREAKING: Aztec just shipped the Ignition Chain, the first fully decentralized L2 on Ethereum.

This launches the decentralized consensus layer that powers the Aztec Network.

https://t.co/nYyD7cykz2

🧵

[Andre Omietanski @punk6052]

On 22 May 2026, @AztecLabs_ submitted a response to the UK government's consultation on children's online safety.

I'll be direct about where we stand. We are sceptical of mandatory age verification. The evidence that it works is mixed, and the surveillance infrastructure built in the name of child safety rarely stays narrowly scoped. We said so plainly in the submission.

But the consultation is happening, and if the government proceeds, the detail that matters most is how these systems are actually built.

Every method deployed today related to online age verification either gets bypassed easily or forces users to hand a document scan to a third-party server, which creates centralised databases of sensitive personal data. Those databases get breached often and easily, creating personal and national security risks. This is the predictable result of collecting far more than the question requires.

So our submission, among other things, asks the government for three things:

1. make privacy by design a hard requirement rather than an aspiration;

2. recognise device-level proofs within the existing trust framework; and

3. do not restrict VPNs, which serve real privacy and security purposes.

The UK can set the global standard for how this is done, or it can attach a breachable identity database to every platform its citizens use. I think the choice is clear.

[jaosef.eth @jaosef]

Aztec Labs responded to the UK Age Verification Consultation.

Building age verification doesn't have to mean building a honeypot of everyone's data.

The UK needs to avoid that dystopian future.

[Aztec Labs @AztecLabs_]

Governments are moving to mandate online age verification

We think this is the wrong decision, and we said so in our response to the United Kingdom's consultation

But if these mandates proceed, the way these systems are built will have consequences far beyond child safety

👇

[alejo · privacy arc 🥷🏽 @alejoamiras]

Oh right. Forgot to tell you:

✅ Schnorr signature over Grumpkin curve on @Ledger
👁️ Viewing key derive from Ledger's account, shared with app (it's per app viewing key)
✅ Signature key never leaves device

You now can just build things, anon.

[jaosef.eth @jaosef]

Zcash has been through this before and will be just fine.

https://t.co/BCH8MQycY3

Hats off to the entire team here for formally verifying the next upgrade.

Read some of my comments here.

[jaosef.eth @jaosef]

@CPerezz19 What happened to state expiry. That would work better than increasing costs for new state at the tip of the chain that is actually useful.

[jaosef.eth @jaosef]

This ruins the UX of stealth addresses, fluid key, privacy preserving sweeps to L2s and most interesting L1 create2 use cases. Increasing these costs places a tax on privacy.

So much for CROp̶S.

[ً @lightclients]

EIP-8037 is scheduled for Glamsterdam and will increase the gas cost of creating new accounts and writing to new storage slots by 5-8x.

What protocols have hard-coded expectations about state gas costs? What is at risk of breaking?

[jaosef.eth @jaosef]

@B0R444 @lightclients @Butta_eth This is crazy for a chain trying to support privacy.

[jaosef.eth @jaosef]

@zkmattwyatt Send us a dm @ZKPassport

[L2BEAT 💗 @l2beat]

Why even decentralise the sequencer?

We just shipped some additions to the Sequencing sections of the projects that have decentralised sequencer setups to answer the question: if part of the sequencer set is censoring you, how long until your tx actually gets in?

Live for @gnosischain, @aztecnetwork & @0xPolygon. 🧵

[jaosef.eth @jaosef]

The best use case for something like ZKPassport is a sanctions check. There are a set of use cases that don’t require KYC, but currently take require full passport info to do a sanctions check. The sanctions list is effectively a public revoke lookup so easy to put in a merkle tree and prove non inclusion.

If you need full KYC, I agree it’s a mismatch of laws and not possible today. Here’s hoping we can reform existing laws.

[jaosef.eth @jaosef]

@parisrouz @aave Congrats!

[Macauley 🟪 Editooor @yeluacaM]

The "just shifting where the honeypots live" argument didn't sound quite right to me, but I wouldn't consider myself an expert, so I checked with someone who is — Joe Andrews (@jaosef), CEO of @AztecLabs_ — who said:

"The key point is that with zero-knowledge-based identity primitives, you do the verification one time, against government-issued credentials, and after that, you should never have to hand that data off to anyone again.

The State Department already issued the credential. It's sitting on an NFC chip in your passport, cryptographically signed. ZKPassport reads that chip locally, on your device, generates a proof of whatever attribute is required, and nothing else leaves the phone. There is no issuer in the middle retaining data.

The data honeypots don't exist in this model because the underlying data is never aggregated in the first place.

The idea that verifiable credentials create new data brokers is valid for verifiable credentials systems specifically, where an issuer has to mint and manage credentials, but solutions like ZKPassport sidestep that need entirely because the government already did the issuance years ago when they printed your passport.

The compliance objection to this model keeps getting raised and keeps getting answered the same way: a cryptographic proof of sanctions status or age or nationality is more tamper-resistant than a KYC database.

It satisfies the underlying regulatory requirement. The question now is whether regulators acknowledge that, and we're seeing early signs they're moving in that direction."

[jaosef.eth @jaosef]

@hypnogaba @MalbecLabs_xyz @doublezero @malbeclabs_cto @mateoward This is awesome.

[jaosef.eth @jaosef]

@PryvitKyle @yeluacaM @AztecLabs_ The simplist way to stop somone using a lost passport who is not the holder is to use "Private FaceMatch". This proves that the person holding the phone, is the person on the passport. The revocation list could still be useful though.

[jaosef.eth @jaosef]

From a quick google, looks like revoked passports are not stored in masterlists. For the use-cases where this matters you would need to prove against INTERPOL's SLTD (Stolen and Lost Travel Documents) list that countries update.

The registry does a similar thing for sanctioned passports, so it would be easy to add this as a non-inclusion check.

Could be a neat product feature.

[jaosef.eth @jaosef]

@PryvitKyle @yeluacaM @AztecLabs_ Great question, I don't know if that would be picked up in the current registry of masterlist certificates. @madztheo do you know?

You can check the certificate registry here: https://t.co/I90FSJcU6I

[jaosef.eth @jaosef]

Perhaps, I don't think the credential is any more derived though than the e-gate example.

The zk circuit is checking the exact attestation signed by the issuer. In both the e-gate context and the zk circuit, both will return true if the attestion is valid.

The zero-knowledge proof in the zk example is similar (although) harder to produce, than the "proof" the e-gate computer must create to convince itself the attestation is valid. Both proofs, would be "derived" in your definition.

[jaosef.eth @jaosef]

@PryvitKyle @yeluacaM @AztecLabs_ ZKPassport does not derive new credentials. The same signature that lets you into a country via an e-gate is read via your phone's NFC chip and then verified inside a zero-knowledge circuit against the issuing countries master list published so people can travel.

[jaosef.eth @jaosef]

@0xdavid We ain't going anywhere.