qqil

void entity

[vitalik.eth @VitalikButerin]

Now, the quantum resistance roadmap.

Today, four things in Ethereum are quantum-vulnerable:

* consensus-layer BLS signatures
* data availability (KZG commitments+proofs)
* EOA signatures (ECDSA)
* Application-layer ZK proofs (KZG or groth16)

We can tackle these step by step:

## Consensus-layer signatures

Lean consensus includes fully replacing BLS signatures with hash-based signatures (some variant of Winternitz), and using STARKs to do aggregation.

Before lean finality, we stand a good chance of getting the Lean available chain. This also involves hash-based signatures, but there are much fewer signatures (eg. 256-1024 per slot), so we do not need STARKs for aggregation.

One important thing upstream of this is choosing the hash function. This may be "Ethereum's last hash function", so it's important to choose wisely. Conventional hashes are too slow, and the most aggressive forms of Poseidon have taken hits on their security analysis recently. Likely options are:

* Poseidon2 plus extra rounds, potentially non-arithmetic layers (eg. Monolith) mixed in
* Poseidon1 (the older version of Poseidon, not vulnerable to any of the recent attacks on Poseidon2, but 2x slower)
* BLAKE3 or similar (take the most efficient conventional hash we know)

## Data availability

Today, we rely pretty heavily on KZG for erasure coding. We could move to STARKs, but this has two problems:

1. If we want to do 2D DAS, then our current setup for this relies on the "linearity" property of KZG commitments; with STARKs we don't have that. However, our current thinking is that it should be sufficient given our scale targets to just max out 1D DAS (ie. PeerDAS). Ethereum is taking a more conservative posture, it's not trying to be a high-scale data layer for the world.
2. We need proofs that erasure coded blobs are correctly constructed. KZG does this "for free". STARKs can substitute, but a STARK is ... bigger than a blob. So you need recursive starks (though there's also alternative techniques, that have their own tradeoffs). This is okay, but the logistics of this get harder if you want to support distributed blob selection.

Summary: it's manageable, but there's a lot of engineering work to do.

## EOA signatures

Here, the answer is clear: we add native AA (see https://t.co/YD9nIpsxcC ), so that we get first-class accounts that can use any signature algorithm.

However, to make this work, we also need quantum-resistant signature algorithms to actually be viable. ECDSA signature verification costs 3000 gas. Quantum-resistant signatures are ... much much larger and heavier to verify.

We know of quantum-resistant hash-based signatures that are in the ~200k gas range to verify.

We also know of lattice-based quantum-resistant signatures. Today, these are extremely inefficient to verify. However, there is work on vectorized math precompiles, that let you perform operations (+, *, %, dot product, also NTT / butterfly permutations) that are at the core of lattice math, and also STARKs. This could greatly reduce the gas cost of lattice-based signatures to a similar range, and potentially go even lower.

The long-term fix is protocol-layer recursive signature and proof aggregation, which could reduce these gas overheads to near-zero.

## Proofs

Today, a ZK-SNARK costs ~300-500k gas. A quantum-resistant STARK is more like 10m gas. The latter is unacceptable for privacy protocols, L2s, and other users of proofs.

The solution again is protocol-layer recursive signature and proof aggregation. So let's talk about what this is.

In EIP-8141, transactions have the ability to include a "validation frame", during which signature verifications and similar operations are supposed to happen. Validation frames cannot access the outside world, they can only look at their calldata and return a value, and nothing else can look at their calldata. This is designed so that it's possible to replace any validation frame (and its calldata) with a STARK that verifies it (potentially a single STARK for all the validation frames in a block).

This way, a block could "contain" a thousand validation frames, each of which contains either a 3 kB signature or even a 256 kB proof, but that 3-256 MB (and the computation needed to verify it) would never come onchain. Instead, it would all get replaced by a proof verifying that the computation is correct.

Potentially, this proving does not even need to be done by the block builder. Instead, I envision that it happens at mempool layer: every 500ms, each node could pass along the new valid transactions that it has seen, along with a proof verifying that they are all valid (including having validation frames that match their stated effects). The overhead is static: only one proof per 500ms. Here's a post where I talk about this:

https://t.co/rAUSJjW7WL
https://t.co/EtXpkaDll5

[Nick Allen @NickAllen]

Bitcoin down to $2.70 a pop. So glad i didn't buy in on that mess.

[House of ZK @HouseofZK]

The ZK Infrastructure Map V3 - Mapping the ZK pioneers of the past, present and future 🔲🔳

This map showcases 60 projects that have captured our attention for their novel approaches and promising contributions to the field.

Featured projects:
@ProjectZKM, @RiscZero, @SuccinctLabs, @a16zcrypto, @NexusLabsHQ, @Lita_xyz, @Eigen_Network, @MinaProtocol, @AleoHQ, @Aleph__Zero, @horizenglobal, @Citrea_xyz, @goatnetwork, @aztecnetwork, @taikoxyz, @Scroll_zkp, @Starknet, @0xPolygon, @nil_foundation, @zksync, @union_build, @zkLink_official, @zcash, @AlpenLabs, @KakarotZkEvm, @MantaNetwork, @LineaBuild, @lagrangedev, @zan_team, @MarlinProtocol, @SindriLabs, @PolyhedraZK, @hyle_org, @spaceandtime, @zircuit, @HelloTelos, @babylonlabs_io, @fermah_xyz, @brevis_zk, @build_on_bob, @fiamma_labs, @TaprootWizards, @thezkcloud, @Ingo_zk, @reddio_com, @Snarkify_ZKP, @layeredge, @alt_layer, @alignedlayer, @nebrazkp, Herodotus, Kroma, zkVerify, Pi Squared, Nubit, Irreducible, OpenVM, Delphinus Labs, Reddio, ZeroSync.

If you feel we've missed a deserving project, please comment below, reach out at [email protected], or fire us a DM 🤝

[qqil @__qqil]

@UmarQadmiri @3orovik If quantum computer can unlock it means we can mine block also every second. Network will be broken at all.

[vitalik.eth @VitalikButerin]

I admire your willingness to stand up and fight for freer movement of people, it's an important freedom that all too easily gets thrown under the bus.

That said I think it's valuable to turn down the temperature here, on both tone of discourse and the social media banhammer.

Respecting free speech is easy when we agree with the speech, and hard when we think it's awful. But the arguments for respecting free speech anyway are the same as ever: the banhammer is controlled by one group today, it will be controlled by another group tomorrow, and every use of it legitimizes further use, and by the end public discourse collapses into either balkanization, monoculture (where the winner will be the guy with the biggest hammer, not the guy with the best arguments) or constant war of all against all.

And it's worth reflecting on just how much tone of discourse has fallen here over the past couple of years. I feel like a lot of people have been okay with rising aggressiveness because the target of the aggressiveness was one faction that they disliked, but once that beast is summoned, its nature is to look for new targets, and even if you approve of the first target you may not approve of the second or the third or the fourth - as many people have been finding out this week. Literally "first they came for the communists, and I did not speak out because I was not a communist". This isn't the kind of memetic beast we want running the show when we're entering an era of dangerous global political competition and rapidly improving AI.

The role of leaders in setting the tone is really important, and can be used to great good or great evil. It's not "wartime mode" that will get humanity to Mars in one piece, it's something brighter - and we should get into that mode today.

[naiive @naiivememe]

Me buying one more dip

[Grinding Poet @GrindingPoet]

XRP holders coming out of their caves to sell at breakeven after 2 cycles

[vitalik.eth @VitalikButerin]

All L2s should be working on (trustless, merkle-proof-based) CCIP resolvers, so that we can have ENS subdomains registerable, updateable and readable directly on L2s.

ENS is super-important, it needs to be affordable!

https://t.co/Ice1lTttFE

[qqil @__qqil]

@GoingParabolic Paper hands

[vitalik.eth @VitalikButerin]

The Three Transitions:

https://t.co/rtewRnm2wK

[CZ 🔶 BNB @cz_binance]

If you have to pick a fight with everyone, maybe you are the one at fault. 🤷‍♂️

[Emperor👑 @EmperorBTC]

This is what will happen this Year.

1. People will expect Recession to come and it will be a lot softer than expected.

2. You will keep waiting for Pullback to 18K and it won't occur.

4. Eth touches 3K. BTC touches 42K.

5. 28900 good place to add BTC Spot.

[Emperor👑 @EmperorBTC]

5 Year ago, I had zero money.
Used to sit 8 hours in front of the screen everyday, feeling miserable, depressed, life had zero meaning.

Then I Joined Crypto and I still feel the same, But now I watch the screen 24*7.

The Pic is from my Best friend's vacation who works 9-5.

[The Wolf Of All Streets @scottmelker]

Friendly reminder.

When you deposit money in a bank, it is no longer yours.

You are giving the bank a low interest loan.

Enjoy.

[Hypersea DEX @HyperseaDex]

After months of work, we are very happy to tell you about our BETA testing Trading Competition Game launch on March 13th!🔥

In order to participate, join out TG chat: https://t.co/kRj9zoi94S

#trading #Competition #Arbitrum

[Hypersea DEX @HyperseaDex]

We know we have gone AWOL for some time…but we are back with some treats for you!🔥

Hypersea is launching #Giveaway! 10 lucky winners will be randomly chosen to share 300 USDT, don’t miss out!

Follow this link to enter: https://t.co/M65lWQScph

#Airdrop #DEX #crypto

[Emperor👑 @EmperorBTC]

Binance buys FTX to give us one last exit Pump. Remember this.

[qqil @__qqil]

@parsiq_net 🏄‍♂️🌊

[Joma Tech @jomatech]

if Wolf of Wallstreet were about crypto...

[qqil @__qqil]

@BinanceUS $METIS