ZK STARKs are the best way to deal with the issues created with making Bitcoin quantum-safe \u2014 and to reach mass adoption at the same time \u2014 says StarkWare co-founder Eli Ben-Sasson.<\/p>\n
What\u2019s more, he claims Blockstream founder Adam Back agrees.<\/p>\n
Ben-Sasson has been in the news this week for his controversial suggestion on X to increase Bitcoin inflation to 4% annually. Grok\u2019s analysis of the replies found \u201czero clear support for the proposal.\u201d<\/p>\n
But as the co-inventor of STARKs \u2014 quantum-secure, hash-based zero-knowledge proofs \u2014 he\u2019s on much firmer ground, with some leading Bitcoin researchers supporting the concept.<\/p>\n
Ben-Sasson\u2019s own project Starknet last week announced<\/a> its own three phase project to become quantum secure.<\/p>\n Adding zero-knowledge proofs to Bitcoin does not make the blockchain quantum secure by itself. ZK proofs are a way to deal with the problems caused by adding much larger post-quantum (PQ) signature schemes to Bitcoin.\u00a0<\/p>\n The current crop of PQ signatures approved by the National Institute of Standards and Technology (NIST) is 10 to 100 times larger than Bitcoin\u2019s existing ECDSA and Schnorr signature schemes.<\/p>\n Some argue this could slow the blockchain to fewer than 1 transaction per second. But all of the large transaction signatures for a block could be compressed into a tiny ZK STARK proof. Because the proof would be much smaller than even including the existing signatures, the blockchain may end up running faster.\u00a0<\/p>\n \u201cIf they don’t allow for ZK STARK aggregation, then definitely it will be a very unfortunate move because it won’t really solve the problem … where the problem is \u2018can everyone actually use Bitcoin?\u2019\u201d Ben-Sasson said.<\/p>\n \u201cSo for that you need massive scale. And for that, you need things like signature aggregation and just increasing the block size isn’t enough.\u201d<\/p>\n Related: StarkWare CEO suggests 4% annual Bitcoin inflation to replace 21M cap<\/strong><\/em><\/span><\/a><\/p>\n Eli on OP_CAT<\/em><\/p>\n Source: Eli Ben-Sasson<\/strong><\/em><\/span><\/a><\/p>\n Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, told Cointelegraph that Bitcoin\u2019s SegWit scheme reduced the impact of large signatures by up to 75%. But his modeling of NIST\u2019s ML-DSA-44 scheme, which has 2,420 bytes per signature, \u201cputs block capacity at roughly 500 to 700 transactions, down from 2,500 to 3,000 today. That is where the block-size debate comes in.\u201d<\/p>\n Increasing Bitcoin\u2019s block size is a genuine alternative, but the community split over a proposal to double the block size back in 2017. Many of the arguments against remain relevant, as it\u2019s a blunt fix that requires every node to carry, store and verify much more data. That\u2019s more expensive and requires more equipment, which critics argue pushes the network toward centralization.<\/p>\n Blockstream Research has been experimenting in recent months with compressing the size of hash-based post-quantum signature schemes for use with Bitcoin. It has come up with the promising SHRINCS and SHRIMPS schemes, which have everyday signatures around five times larger than Bitcoin\u2019s current ones, but up to 40 times larger if you lose your wallet and need to resurrect it.<\/p>\n While SHRINCS has been used to sign real transactions on the Liquid sidechain, its development is at an early stage and there are drawbacks in terms of complexity and usability. The much larger signatures would also slow the blockchain down, unless the block size was increased.<\/p>\n \u201cRaising capacity natively is the simple engineering answer and the hardest governance answer,\u201d said Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, about a block size increase. \u201cWe just don\u2019t have time for those debates.\u201d<\/p>\n Blockstream SHRINCS<\/em><\/p>\n ncrease, but it would arguably be much better at preserving decentralization while also making Bitcoin more efficient. <\/p>\n At their simplest, ZK proofs are a way to mathematically prove that something exists without needing to include all the details. For example, a ZK proof could demonstrate that you know the combination to a safe, without telling the other person what the combination is.\u00a0\u00a0<\/p>\n Generating a ZK proof for a single block technically only needs to be done once (although it\u2019s safer to generate additional backups for redundancy), and the equipment required to do so looks like it would be much less expensive than a commercial mining setup.\u00a0<\/p>\n Lean Ethereum\u2019s specs are for proving equipment that costs under $100,000 (and can be run from an ordinary home). Verifying a ZK proof, meanwhile, can be done on almost any equipment, including a Raspberry Pi.<\/p>\n Ben-Sasson said that early Bitcoin devs like Greg Maxwell and Mike Hearn were \u201cvery bullish about ZK STARKs, which are post-quantum secure and have no trusted setup,\u201d and that he believes Bitcoin Core developer Luke Dashjr and Blockstream founder Adam Back are coming around to the idea.<\/p>\n \u201cI heard this myself from them. They are bullish on things related to and using ZK STARKs. I think each of them has spoken well, definitely privately but also publicly, in favor. Adam Back and Luke Dashjr don’t exactly see everything eye to eye, but on this I think they actually agree that it’s a great technology that, under the right terms, could find its way to Bitcoin.\u201d<\/p>\n Cointelegraph contacted Back for comment, but did not receive a response.<\/p>\n Ethereum researcher Justin Drake has spoken publicly about his desire for Bitcoin to adopt Lean Ethereum\u2019s ZK proof aggregation technology so that it becomes standard across the industry. This may be unfeasible for political reasons.<\/p>\n Ethereum’s strawmap<\/em><\/p>\n Ethereum aims to be post quantum by 2029. Source: Ethereum Foundation<\/em><\/p>\n Given Bitcoin\u2019s conservative culture, the most politically pragmatic way to add ZK to Bitcoin would likely be to re-enable OP_CAT, which is nine lines of code written by Satoshi.<\/p>\n \u201c[He] even introduced and then he removed it,\u201d said Ben-Sasson said. \u201cAnd if you add that, you can get things like STARK proofs and then aggregation and post-quantum security.\u201d<\/p>\n \u201cI think it’s the best and safest solution that will really, really just jump-start again this journey that Satoshi really started and wanted.\u201d<\/p>\n But despite a flurry of interest in OP_CAT <\/span><\/a>about 12 to 24 months ago, it seems to have lost momentum more recently (although Bitcoin governance moves in mysterious ways).<\/p>\n There are also more speculative proposals, including OP_STARK_VERIFY<\/span><\/a>, that would add opcodes specifically designed to more efficiently verify STARKs on Bitcoin. And BIP-360 co-author Ethan Heilman proposed aggregating Bitcoin\u2019s signatures and public keys into a single STARK proof under the name BitZip<\/span><\/a>. <\/p>\n Heilman told Cointelegraph earlier this year there are two main ways to achieve the desired result:<\/p>\n \u201cEither add a bunch of general purpose opcodes to Bitcoin and then build something like a ZKRollup in Bitcoin or support STARKs at the consensus layer of Bitcoin. Alternatively, other less powerful aggregation schemes, such as CISA [Cross Input Signature Aggregation] might help here as well.\u201d\u00a0 Quantum<\/em><\/p>\n Ivezic says Bitcoin governance, rather than technological capability, is the sticking point.\u00a0<\/p>\n \u201cEli’s cryptography is rock solid: pure hash assumptions, no trusted setup, thousands of signatures compressed into one small proof. The problem is everything around the cryptography,\u201d he says.\u00a0<\/p>\n \u201cBitcoin Script cannot verify a STARK today, and a production verifier is a massive consensus surface compared with a narrow hash-signature opcode. Given that a tiny opcode like OP_CAT has spent years in debate, a base-layer STARK verifier is realistically a 2030s conversation.\u201d<\/p>\n Meanwhile, Ethereum is targeting 2029 for its transition to post-quantum, and Solana has also been experimenting with adding post-quantum signatures. StarkNet\u2019s three-phase transition will benefit from account abstraction, which enables the underlying cryptography to be upgraded without making every user manually transfer to new accounts.<\/p>\n As a result, Ben-Sasson said that Solana and Ethereum\u2019s post-quantum roadmap will be \u201cextremely hard.\u201d\u00a0 <\/p>\n \u201cOn Starknet, we have this big advantage that we have already native account abstraction and smart wallets, which means that nothing is enshrined so its very easy to upgrade the wallets and the infrastructure to be post quantum.\u201c<\/p>\n Features: The biggest blockchain upgrades still to come in 2026<\/strong><\/em><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":" ZK STARKs are the best way to deal with the issues created with making Bitcoin quantum-safe \u2014 and to reach mass adoption at the same time \u2014 says StarkWare co-founder Eli Ben-Sasson. What\u2019s more, he claims Blockstream founder Adam Back agrees. Ben-Sasson has been in the news this week for his controversial suggestion on X […]<\/p>\n","protected":false},"author":1,"featured_media":34676,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg","fifu_image_alt":"","footnotes":""},"categories":[11990],"tags":[661,13401,861,8611,24685,15369,5073],"class_list":["post-34675","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-crypto-plug","tag-bigger","tag-bitcoins","tag-blocks","tag-dilemma","tag-proofs","tag-quantum","tag-stark"],"rttpg_featured_image_url":{"full":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",0,0,false],"landscape":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",0,0,false],"portraits":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",0,0,false],"thumbnail":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",150,150,false],"medium":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",300,300,false],"large":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",1024,1024,false],"1536x1536":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",1536,1536,false],"2048x2048":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",2048,2048,false],"post-thumbnail":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",370,265,false],"kava-thumb-s":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",150,85,false],"kava-thumb-s-2":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",230,230,false],"kava-thumb-m":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",400,400,false],"kava-thumb-m-vertical":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",370,500,false],"kava-thumb-m-2":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",570,450,false],"kava-thumb-l":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",1170,650,false],"kava-thumb-xl":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",1920,1080,false],"kava-thumb-masonry":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",600,999,false],"kava-thumb-justify":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",640,640,false],"kava-thumb-justify-2":["https:\/\/s3-images.ctmedia.io\/media\/article-covers\/zk-starks.jpg",1280,640,false]},"rttpg_author":{"display_name":"#RiseCelestialStudios","author_link":"https:\/\/design-providers.com\/rise\/author\/ralph-c\/"},"rttpg_comment":0,"rttpg_category":"CRYPTO PLUG<\/a>","rttpg_excerpt":"ZK STARKs are the best way to deal with the issues created with making Bitcoin quantum-safe \u2014 and to reach mass adoption at the same time \u2014 says StarkWare co-founder Eli Ben-Sasson. What\u2019s more, he claims Blockstream founder Adam Back agrees. Ben-Sasson has been in the news this week for his controversial suggestion on X…","_links":{"self":[{"href":"https:\/\/design-providers.com\/rise\/wp-json\/wp\/v2\/posts\/34675","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/design-providers.com\/rise\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/design-providers.com\/rise\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/design-providers.com\/rise\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/design-providers.com\/rise\/wp-json\/wp\/v2\/comments?post=34675"}],"version-history":[{"count":1,"href":"https:\/\/design-providers.com\/rise\/wp-json\/wp\/v2\/posts\/34675\/revisions"}],"predecessor-version":[{"id":34677,"href":"https:\/\/design-providers.com\/rise\/wp-json\/wp\/v2\/posts\/34675\/revisions\/34677"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/design-providers.com\/rise\/wp-json\/wp\/v2\/media\/34676"}],"wp:attachment":[{"href":"https:\/\/design-providers.com\/rise\/wp-json\/wp\/v2\/media?parent=34675"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/design-providers.com\/rise\/wp-json\/wp\/v2\/categories?post=34675"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/design-providers.com\/rise\/wp-json\/wp\/v2\/tags?post=34675"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The problem of large PQ signatures on Bitcoin<\/strong><\/h2>\n
The quantum alternative: Increase Bitcoin’s block size<\/strong><\/h2>\n
ZK proof aggregation has advantages<\/strong><\/h2>\n
Bitcoin specific ZK proposals<\/strong><\/h2>\n
What are the chances though?<\/strong><\/h2>\n