Rumata888

Security Team Lead at @aztecnetwork. @CTFZone organizer.
Love cryptography, fuzzing, breaking systems. Views are my own.

[Aztec Labs @AztecLabs_]

Aztec Labs has acquired Obsidion, the team behind @ZKPassport.

The Obsidion team will continue to develop ZKPassport while also leading new consumer product developments.

The ZKPassport protocol will remain open source.

[Zero Knowledge Podcast @zeroknowledgefm]

@zksecurityXYZ @alloc_init_ @burnt_xion @TACEO_IO @o1_labs @reclaimprotocol @zkv_xyz @icme_app @aztecnetwork @0xMiden @ZcashFoundation @GiacomoFenzi @ronrothblum @SuccinctLabs @asanso @ethereumfndn @MariusMargulus @TachyonZcash @Zcash @EmanueleRagnoli @GetProvably @asn_d6 @diego_aligned @alignedlayer @rw0x0 @georgwiese @powdr_labs @mahdisedaghat @SoundnessLabs @KU_Leuven To wrap up the talks on the Mainstage at zk14, @rumata888 from @aztecnetwork presented Origin Tags, a runtime mechanism to detect Fiat-Shamir implementation bugs, a severe vulnerability, especially in recursive settings. https://t.co/OHXcIvfBSn

[jaosef.eth @jaosef]

Introducing @AztecLabs_ - a standalone product studio built by the network’s original builders.

We’re not a third-party team learning the stack. We built it, and now we’re going to show the world what products are possible.

[jaosef.eth @jaosef]

https://t.co/lkOaaClajc

[Alex Plaskett @alexjplaskett]

Demystifying Fuzzer Behaviour by Addison

https://t.co/ThB97groHW

[Suyash Bagad @BagadSuyash]

The secret weapon for lightning-fast authentication with Aztec is the ingeniously optimized ecdsa verification in barretenberg.

This isn't a theoretical optimization: we're talking <1s proving time & 30ms verification. Lets do a deep dive 🧵

(Source: https://t.co/W5KzSzReo6)

[POC_Crew @POC_Crew]

[POC2025] SPEAKER UPDATE

👤 Innokentii Sennovskii(@Rumata888) - "Zero Knowledge, Full Coverage: A Fuzzing Paradox"

#POC2025

[Rumata888 @rumata888]

@kobigurk @Google Have you tried creating barrustenberg?

[Ariel Gabizon @rel_zeta_tech]

token 2022 passed six audits, used one of the simpler and more conservative zk systems - bulletproofs for confidential transactions.
And still had a fatal money printing zk bug. Moreover, a "not including all inputs in Fiat Shamir" bug, you'd think people would know to look for.
Zk is hard. We need to think of soundness verifiability more than prover speed.
In particular, it should be totally doable to come up with ways for the compiler to warn (or just not compile!) code with missing Fiat-Shamir inputs.

[Rumata888 @rumata888]

@punk6052 Andre who?

[Rumata888 @rumata888]

@vwuestholz @NoirLang This is a pretty cool bug. Appreciate your work @vwuestholz

[Rumata888 @rumata888]

@levs57 Yes, the cost will be the same (I'm assuming you put the cost of writing module representations of A and B into O(1)). If using sumcheck + plonkish arithmetization + lookups you can easily disable unused relations so you are not paying for what you're calling "stack interactions"

[Rumata888 @rumata888]

@levs57 Yes, exactly

[Rumata888 @rumata888]

@levs57 you can do this with lookups by making the selectors that enable/disable memory interaction and substitute indices for the permutation argument , it will just be part of the table

[Rumata888 @rumata888]

@levs57 wdym by "obviate stack interactions"?

[Rumata888 @rumata888]

@levs57 Is this different from the known way of segment branching via lookups?

[Rumata888 @rumata888]

@cryptodavidw Yes, please

[Rumata888 @rumata888]

@weikengchen Yes, and there is a difference between a vulnerability discovered externally and sequential lapses in security

[Rumata888 @rumata888]

@weikengchen And investor job security should be directly related to their investments. They should be fired after one underperforming investment even if others are doing great.