Arthur Lazzaretti

cryptography @SpaceXAI @X. prev @Yale @GeorgiaTech

[Arthur Lazzaretti @rthurknl]

test

[Arthur Lazzaretti @rthurknl]

@FormallyJon the assumption is that companies building in public will have useful quantum computers and announce them before any state-funded secret service does

[Arthur Lazzaretti @rthurknl]

@jedisct1 feels a bit lopsided. AEGIS and ChaCha have been looked at much less than AES

[Arthur Lazzaretti @rthurknl]

wow 8 bytes take Schnorr from secure to completely broken

[Zilliqa @zilliqa]

Nonce-Generation Vulnerability in the Zilliqa Ledger App: A critical vulnerability has been identified in the Zilliqa Ledger application affecting the generation of Schnorr signatures for native (non-EVM) Zilliqa transactions. The vulnerability causes signatures to be generated with a predictably weakened ephemeral nonces, from which an attacker can recover the signer’s private key using only publicly available on-chain data.

Protective measures are already in place to prevent further loss, and a coordinated remediation plan is being finalised. Users who have signed native Zilliqa transactions with a Ledger device should await official guidance before taking any action.

Impact: The vulnerability affects private keys used to sign native Zilliqa transactions with a Ledger device. Any account that has broadcast approximately five or more native transactions signed through the Zilliqa Ledger app should be considered compromised. Its private key can be reconstructed from signatures already recorded on-chain, regardless of any subsequent software update.

The issue is confined to the Ledger app’s native signing path. EVM transactions are unaffected. Zilliqa software development kits, including zilliqa-js, gozilliqa-sdk and pyzil, generate nonces correctly and are not affected.

Root cause: Zilliqa native transactions are authenticated using EC-Schnorr signatures over secp256k1. Each signature requires a fresh, uniformly random 256-bit ephemeral nonce, (k). The secrecy and full-width randomness of (k) are essential, as any systematic bias can allow the private key to be recovered.

The signing routine generated 40 bytes of randomness and reduced them modulo the curve order, correctly producing a uniform 256-bit value. However, when copying this value into the nonce buffer, the code copied the wrong 32 bytes of the 40-byte output. This retained the eight zero-padding bytes introduced by the reduction and discarded eight bytes of entropy.

As a result, the most significant 64 bits of every generated nonce were fixed at zero, meaning (k < 2^{192}).

A nonce with 64 known bits leaks information about the private key with each signature. With five or more affected signatures, the private key can be recovered in seconds using commodity hardware by solving the resulting Hidden Number Problem through lattice reduction - a well-documented technique for attacking biased-nonce signatures.
Because the affected transactions are permanently recorded on-chain, this exposure cannot be reversed by updating the signing application. The affected keys must be retired.

Timeline
2019-2026: The defect was present in every released version of the Zilliqa Ledger app across all supported devices.

19 July 2026: On-chain activity consistent with active exploitation was observed.

21 July 2026: The root cause was isolated to the app’s nonce-handling code and confirmed by reproducing the issue against on-chain signatures.

Ongoing: A corrected version of the app is being prepared in coordination with Ledger. Release details will be announced separately.

Remediation: As soon as the issue was identified, native (non-EVM) transactions were suspended as a protective measure. This has halted further draining of affected accounts while a solution is prepared.

Affected accounts cannot be secured through an ordinary transfer. Because their private keys can be derived from data already recorded on-chain, an attacker with access to the same key could attempt to front-run a legitimate transfer as soon as transactions resume. Advising users simply to move their funds would therefore be ineffective and potentially unsafe.

A corrected build of the Ledger app has been prepared, restoring full-width nonce generation and preventing further weakened signatures from being produced. However, this does not protect keys that have already been used to sign affected transactions. Those keys must ultimately be retired.

A coordinated remediation plan to secure affected balances is being finalised and will be published separately. Until then, users who have signed native Zilliqa transactions with a Ledger device should take no independent action and should rely solely on official Zilliqa channels for instructions.

Users who hold or transact with ZIL exclusively through EVM-compatible tooling are not affected.

Acknowledgments: @kucoincom played a key role in pinpointing the root cause in the Zilliqa Ledger app nonce generation, recovered affected private keys from publicly available on-chain signatures, and confirmed ongoing exploitation.

KuCoin’s timely reporting and responsible collaboration enabled rapid protective measures, helping safeguard users, ecosystem participants, and the broader Zilliqa ecosystem while the remediation plan was being developed.

We sincerely appreciate the KuCoin team’s professionalism, technical expertise, and cooperation throughout this process.

[Arthur Lazzaretti @rthurknl]

@ZachWarunek Typo for engagement

[Arthur Lazzaretti @rthurknl]

@ZachWarunek Longest streak of 0.4 miles?

[Arthur Lazzaretti @rthurknl]

It really took 20 years to get this tech on planes

[Arthur Lazzaretti @rthurknl]

@xmaximus242x even if it were possible, they would probably just hard fork the protocol and delete your bitcoins, and even then you might still be charged with a crime. not worth it

[Arthur Lazzaretti @rthurknl]

I have been promoted to customer support

[Arthur Lazzaretti @rthurknl]

@ZachWarunek A lot better.

[Arthur Lazzaretti @rthurknl]

@cerebras @CipherSonicAI What is this magical FHE scheme with 2x overhead?

[Arthur Lazzaretti @rthurknl]

@ZachWarunek Was it a one line fix

[Arthur Lazzaretti @rthurknl]

That being said when I tried to factor the number 6 on on IBM’s 15-qubit quantum computer in 2020 it only got it right like half the time. Really have to trust exponential improvement.

[Arthur Lazzaretti @rthurknl]

Huge development.

TLDR: Quantum computers need less than 1k qubits to break classical cryptography.

Best quantum computers have what? 50 - 100 logical qubits? Which means about 6 years for quantum computers to break classic cryptography if something like Moore’s law applies.

[Arthur Lazzaretti @rthurknl]

Huge development.

TLDR: Quantum computers need less than 1k qubits to break classical cryptography.

Best quantum computers have what? 50 - 100 logical qubits? Which means about 6 years for quantum computers to break classic cryptography if something like Moore’s law applies.

[Justin Drake @drakefjustin]

Today is a monumentous day for quantum computing and cryptography. Two breakthrough papers just landed (links in next tweet). Both papers improve Shor's algorithm, infamous for cracking RSA and elliptic curve cryptography. The two results compound, optimising separate layers of the quantum stack. The results are shocking. I expect a narrative shift and a further R&D boost toward post-quantum cryptography.

The first paper is by Google Quantum AI. They tackle the (logical) Shor algorithm, tailoring it to crack Bitcoin and Ethereum signatures. The algorithm runs on ~1K logical qubits for the 256-bit elliptic curve secp256k1. Due to the low circuit depth, a fast superconducting computer would recover private keys in minutes. I'm grateful to have joined as a late paper co-author, in large part for the chance to interact with experts and the alpha gleaned from internal discussions.

The second paper is by a stealthy startup called Oratomic, with ex-Google and prominent Caltech faculty. Their starting point is Google's improvements to the logical quantum circuit. They then apply improvements at the physical layer, with tricks specific to neutral atom quantum computers. The result estimates that 26,000 atomic qubits are sufficient to break 256-bit elliptic curve signatures. This would be roughly a 40x improvement in physical qubit count over previous state-of-the-art. On the flip side, a single Shor run would take ~10 days due to the relatively slow speed of neutral atoms.

Below are my key takeaways. As a disclaimer, I am not a quantum expert. Time is needed for the results to be properly vetted. Based on my interactions with the team, I have faith the Google Quantum AI results are conservative. The Oratomic paper is much harder for me to assess, especially because of the use of more exotic qLDPC codes. I will take it with a grain of salt until the dust settles.

→ q-day: My confidence in q-day by 2032 has shot up significantly. IMO there's at least a 10% chance that by 2032 a quantum computer recovers a secp256k1 ECDSA private key from an exposed public key. While a cryptographically-relevant quantum computer (CRQC) before 2030 still feels unlikely, now is undoubtedly the time to start preparing.
→ censorship: The Google paper uses a zero-knowledge (ZK) proof to demonstrate the algorithm's existence without leaking actual optimisations. From now on, assume state-of-the-art algorithms will be censored. There may be self-censorship for moral or commercial reasons, or because of government pressure. A blackout in academic publications would be a tell-tale sign.
→ cracking time: A superconducting quantum computer, the type Google is building, could crack keys in minutes. This is because the optimised quantum circuit is just 100M Toffoli gates, which is surprisingly shallow. (Toffoli gates are hard because they require production of so-called "magic states".) Toffoli gates would consume ~10 microseconds on a superconducting platform, totalling ~1,000 sec of Shor runtime.
→ latency optimisations: Two latency optimisations bring key cracking time to single-digit minutes. The first parallelises computation across quantum devices. The second involves feeding the pubkey to the quantum computer mid-flight, after a generic setup phase.
→ fast- and slow-clock: At first approximation there are two families of quantum computers. The fast-clock flavour, which includes superconducting and photonic architectures, runs at roughly 100 kHz. The slow-clock flavour, which includes trapped ion and neutral atom architectures, runs roughly 1,000x slower (~100 Hz, or ~1 week to crack a single key).
→ qubit count: The size-optimised variant of the algorithm runs on 1,200 logical qubits. On a superconducting computer with surface code error correction that's roughly 500K physical qubits, a 400:1 physical-to-logical ratio. The surface code is conservative, assuming only four-way nearest-neighbour grid connectivity. It was demonstrated last year by Google on a real quantum computer.
→ future gains: Low-hanging fruit is still being picked, with at least one of the Google optimisations resulting from a surprisingly simple observation. Interestingly, AI was not (yet!) tasked to find optimisations. This was also the first time authors such as Craig Gidney attacked elliptic curves (as opposed to RSA). Shor logical qubit count could plausibly go under 1K soonish.
→ error correction: The physical-to-logical ratio for superconducting computers could go under 100:1. For superconducting computers that would be mean ~100K physical qubits for a CRQC, two orders of magnitude away from state of the art. Neutral atoms quantum computers are amenable to error correcting codes other than the surface code. While much slower to run, they can bring down the physical to logical qubit ratio closer to 10:1.
→ Bitcoin PoW: Commercially-viable Bitcoin PoW via Grover's algorithm is not happening any time soon. We're talking decades, possibly centuries away. This observation should help focus the discussion on ECDSA and Schnorr. (Side note: as unofficial Bitcoin security researcher, I still believe Bitcoin PoW is cooked due to the dwindling security budget.)
→ team quality: The folks at Google Quantum AI are the real deal. Craig Gidney (@CraigGidney) is arguably the world's top quantum circuit optimisooor. Just last year he squeezed 10x out of Shor for RSA, bringing the physical qubit count down from 10M to 1M. Special thanks to the Google team for patiently answering all my newb questions with detailed, fact-based answers. I was expecting some hype, but found none.

[Arthur Lazzaretti @rthurknl]

Test

[Arthur Lazzaretti @rthurknl]

Was sufficiently excited just to see @VitalikButerin post about PIR, but finding TreePIR in there was a cool surprise.

[Arthur Lazzaretti @rthurknl]

whoa! wait a minute, I've heard of this TreePIR you're talking about..

[vitalik.eth @VitalikButerin]

Plinko PIR tutorial:

https://t.co/i7W9a5MCHi

[Giorgos Tsimos @giorgos_tsimos]

1/n) I am thrilled that our recent work with my awesome labmate Fatima Elsheimy @0x_FAE
 and our advisor, @chbpap will appear in SODA'24! We looked into the adaptive communication complexity of deterministic binary Byzantine Agreement.

[Binyi Chen @Charles_Chen533]

BaseFold (https://t.co/cXPkB9C67w) is finally out! With @idocryptography and @benafisch , we build a transparent and post-quantum-secure commitment scheme for multilinear polynomials that achieves better tradeoff between prover time and proof size/verifier cost.

[a16z crypto @a16zcrypto]

@TechnionLive @FBaldimtsi Oblivious RAM: From Theory to Large-Scale Real-World Deployment with @ElaineRShi

https://t.co/ZQxs3khoMh