Mahdi Sedaghat

Postdoctoral Researcher at @COSICBe (KU Leuven) | PhD in Cryptography | Prev Co-Founder & Director at Soundness

[Mahdi Sedaghat @Mahdi_seda]

@kostascrypto This is huge! Congrats to @kostascrypto and @Mysten_Labs team. 🌊🔥

[Mahdi Sedaghat @Mahdi_seda]

https://t.co/1zywNNxkuS
CC: @SoundnessLabs, @CosicBe, @Mysten_Labs

[Mahdi Sedaghat @Mahdi_seda]

It was great sharing our recent results on ZK applications for PQ protection of ed-chains at zkSummit[14].
Besides our recent work with @FBaldimtsi, @kostascrypto & Arnab Roy, I also talked about ways other account types could get PQ protection today.
Link to the slides 👇

[Zero Knowledge Podcast @zeroknowledgefm]

@zksecurityXYZ @alloc_init_ @burnt_xion @TACEO_IO @o1_labs @reclaimprotocol @zkv_xyz @icme_app @aztecnetwork @0xMiden @ZcashFoundation @GiacomoFenzi @ronrothblum @SuccinctLabs @asanso @ethereumfndn @MariusMargulus @TachyonZcash @Zcash @EmanueleRagnoli @GetProvably @asn_d6 @diego_aligned @alignedlayer @rw0x0 @georgwiese @powdr_labs The 4th and final lightning talk on the main was with @MahdiSedaghat (@SoundnessLabs / @KU_Leuven ) sharing with the zkSummit audience "Proof of Seed", a scheme enabling post-quantum wallet migration without address changes or asset movement.

https://t.co/tgAlgauWVg

[Soundness @SoundnessLabs]

https://t.co/1p4q56d5T8

[Mahdi Sedaghat @Mahdi_seda]

@prasincs @pratiks_crypto @alinush @Anchorage The main constrainst for Bitcoin is proof verification as OP-Codes are limited. We have been on this topic at @SoundnessLabs for a while now, happy to walk you through our core findings. We have a deployed client-side proving already.

[Mahdi Sedaghat @Mahdi_seda]

By signature, Alin probably means the zk proof running times, at it is essentially a signature of knowledge.
We already have sub-second proving for Ed-chains using WHIR PCS, with proof sizes around 50 KB. We’ve also open-sourced an early version on the @ligero_inc zkVM here: https://t.co/Bw8PHHDhbE
Happy to extend this to this case, @prasincs

[Mahdi Sedaghat @Mahdi_seda]

@kostascrypto Maybe a new Manhattan project is quietly being cooked. In any case, TradFi still needs a compliant solution for their onchain assets by that time.

[Soundness @SoundnessLabs]

🔴Today is a big day for quantum threats against blockchains and crypto!

What @GoogleQuantumAI is showing is pretty concrete:
– ~20x improvement in Shor’s algorithm efficiency
– breaking ECDSA keys potentially in minutes, not months
– ~500K physical qubits to reach that level
– and a 2029 timeline that now looks realistic, not conservative
The gap between “theoretical risk” and “practical attack” is closing fast.

The takeaway is simple:
post-quantum is no longer something you prepare for later.
Systems need to be built so they can transition without breaking; because when this hits, there won’t be time to redesign everything from scratch.
That’s the direction we’re building at @SoundnessLabs.

[Soundness @SoundnessLabs]

https://t.co/iNgeyn7OSv

[Soundness @SoundnessLabs]

https://t.co/eMN8TiRPXj

[Soundness @SoundnessLabs]

https://t.co/ldAHfevD8H

[Mahdi Sedaghat @Mahdi_seda]

I like his definition: "quantum-readiness does not necessarily require using PQ signatures today." and this is true on our case too but we need a PQ NIZK in any case.

In slide 9 the msg can be either “tnx details” or a “pqpk”.
If the msg is “tnx details”, then you don’t need a PQ signature today, but you would need to redo the protection for every tnx.

If the msg is “pqpk” (we have a PQ signature), then you will use "pqsk" for future tnx, and the whole process becomes a one-time setup.

So in our case the difference is mostly about where you pay the cost.

[Mahdi Sedaghat @Mahdi_seda]

@binance Ignoring the issue is not a solution. Most sectors already have a clear upgrade path or did a great job, but chains like Bitcoin will naturally be slower to integrate a full PQ solution.
Intern; we should rely on science and facts rather than speculation. https://t.co/v632AGRFfi

[Mahdi Sedaghat @Mahdi_seda]

@nic_carter @Faytuks And what do u mean by united Azerbaijan? Referring to the history, Azerbaijan must be renamed to “north Azerbaijan” given “north Macedonia” case.

[Kostas Kryptos @kostascrypto]

Probably one of the most impactful & practical quantum-safe innovation of 2025 & 2026. The key question: how do we migrate wallets into the new quantum era?

Most believed it was mathematically impossible without changing your address. But with ZK magic, somehow Sui researchers did design the 1st system that math-magically achieves that!

This year, only 3 quantum-safety papers were accepted at FC (Financial Cryptography), we led & gave renewed hope to the cryptography community.

“We can withstand quantum computers,
we’ve shut the door on them🚪”

[Mahdi Sedaghat @Mahdi_seda]

Very clean roadmap. But one critical part is missing: How to do the migration?
Even if we have cheap PQ Sigs, how do we move all legacy ECDSA accounts to pq-ones? This needs strong coordination.
At @SoundnessLabs we’ve built a zk solution for mnemonic-based ECDSA (BIP32/BIP39) with sub-second proving time that lets seamless key migration --> Proof of seed via PQ-NIZKs.
But the question is still remaining for other accounts specially the MPC/HSM.

[Mahdi Sedaghat @Mahdi_seda]

Plus ZKP lets you to prove you are the real account owner —> migration w/o address change!
ZKP(RFC8032) & ZKP(BIP32/BIP39)
This is what we have built at @SoundnessLabs.

https://t.co/ZWJUlZ4pTz

[Computer Science @CompSciFact]

PQC and ZKP work well together for blockchains.

Post quantum digital signatures are one of two orders of magnitude larger.

But ZK can replace a list of signatures with a proof that takes up less room.

[Kostas Kryptos @kostascrypto]

Interesting findings, appreciate your sharing these with our team ahead of the publication of this paper, and we are in agreement that web-based authentication ecosystems require security practices beyond what ZKPs alone can offer. 

As the creators of zkLogin, and as our team shared during that conversation, we fundamentally disagree with a few points: 

1. You argue that zkLogin’s security relies on several environmental assumptions that are not enforced at the protocol level. On Sui, there is an explicit allowlist of providers, rendering this scenario impossible. You can see for yourself on the Mysten Labs github: https://t.co/GVNsVqrhON. The issuer checks are not prover-local as you seem to have assumed.

2. You suggest that impersonating real users is possible. A malicious AWS Cognito issuer cannot produce JWTs with a different issuer string than the one they have been assigned. Therefore, impersonating real users on Sui is impossible even with an attacker-controlled issuer, and zkLogin remains secure.

3. You argue for enforcing strong, specification-compliant JWT parsing and that validation be enforced at the RP side. Presumably, your idea is to protect against a malicious OP (issuer). Since OPs are trusted in our setting, it is not clear what this protection is for.

We did find these areas of the paper helpful and wanted to share how we’re using your findings:

1. You note that zkLogin does “ad-hoc selective parsing,” a finding echoed by the original zkLogin paper itself as you note. Thank you for highlighting more such patterns. However, this class of attacks remain out of scope since zkLogin assumes a trusted standard-compliant issuer.

2. You suggest that proving and salt services adopt strict verification rules such as canonical JSON enforcement. Thank you for suggesting that, we plan to adopt it into our service. However, as noted before, our system was designed assuming a standard-compliant issuer.

Working in zk, a constantly evolving design space, necessitates close collaboration across researchers in the community, and even if we disagree on findings, I welcome further discussion and will continue to follow the work of this paper’s authors.

[Mahdi Sedaghat @Mahdi_seda]

@AkashMVerma1 @0x4Mica Cool idea and fantastic demo. Akash and the @4mica crew are on fire. Keep building guys.