ZK STARKs are the best way to deal with the issues created with making Bitcoin quantum-safe — and to reach mass adoption at the same time — says StarkWare co-founder Eli Ben-Sasson.
What’s more, he claims Blockstream founder Adam Back agrees.
Ben-Sasson has been in the news this week for his controversial suggestion on X to increase Bitcoin inflation to 4% annually. Grok’s analysis of the replies found “zero clear support for the proposal.”
But as the co-inventor of STARKs — quantum-secure, hash-based zero-knowledge proofs — he’s on much firmer ground, with some leading Bitcoin researchers supporting the concept.
Ben-Sasson’s own project Starknet last week announced its own three phase project to become quantum secure.
The problem of large PQ signatures on Bitcoin
Adding zero-knowledge proofs to Bitcoin does not make the blockchain quantum secure by itself. ZK proofs are a way to deal with the problems caused by adding much larger post-quantum (PQ) signature schemes to Bitcoin.
The current crop of PQ signatures approved by the National Institute of Standards and Technology (NIST) is 10 to 100 times larger than Bitcoin’s existing ECDSA and Schnorr signature schemes.
Some argue this could slow the blockchain to fewer than 1 transaction per second. But all of the large transaction signatures for a block could be compressed into a tiny ZK STARK proof. Because the proof would be much smaller than even including the existing signatures, the blockchain may end up running faster.
“If they don’t allow for ZK STARK aggregation, then definitely it will be a very unfortunate move because it won’t really solve the problem … where the problem is ‘can everyone actually use Bitcoin?’” Ben-Sasson said.
“So for that you need massive scale. And for that, you need things like signature aggregation and just increasing the block size isn’t enough.”
Related: StarkWare CEO suggests 4% annual Bitcoin inflation to replace 21M cap
Source: Eli Ben-Sasson
The quantum alternative: Increase Bitcoin’s block size
Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, told Cointelegraph that Bitcoin’s SegWit scheme reduced the impact of large signatures by up to 75%. But his modeling of NIST’s ML-DSA-44 scheme, which has 2,420 bytes per signature, “puts block capacity at roughly 500 to 700 transactions, down from 2,500 to 3,000 today. That is where the block-size debate comes in.”
Increasing Bitcoin’s block size is a genuine alternative, but the community split over a proposal to double the block size back in 2017. Many of the arguments against remain relevant, as it’s a blunt fix that requires every node to carry, store and verify much more data. That’s more expensive and requires more equipment, which critics argue pushes the network toward centralization.
Blockstream Research has been experimenting in recent months with compressing the size of hash-based post-quantum signature schemes for use with Bitcoin. It has come up with the promising SHRINCS and SHRIMPS schemes, which have everyday signatures around five times larger than Bitcoin’s current ones, but up to 40 times larger if you lose your wallet and need to resurrect it.
While SHRINCS has been used to sign real transactions on the Liquid sidechain, its development is at an early stage and there are drawbacks in terms of complexity and usability. The much larger signatures would also slow the blockchain down, unless the block size was increased.
“Raising capacity natively is the simple engineering answer and the hardest governance answer,” said Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, about a block size increase. “We just don’t have time for those debates.”
ZK proof aggregation has advantages
ncrease, but it would arguably be much better at preserving decentralization while also making Bitcoin more efficient.
At their simplest, ZK proofs are a way to mathematically prove that something exists without needing to include all the details. For example, a ZK proof could demonstrate that you know the combination to a safe, without telling the other person what the combination is.
Generating a ZK proof for a single block technically only needs to be done once (although it’s safer to generate additional backups for redundancy), and the equipment required to do so looks like it would be much less expensive than a commercial mining setup.
Lean Ethereum’s specs are for proving equipment that costs under $100,000 (and can be run from an ordinary home). Verifying a ZK proof, meanwhile, can be done on almost any equipment, including a Raspberry Pi.
Ben-Sasson said that early Bitcoin devs like Greg Maxwell and Mike Hearn were “very bullish about ZK STARKs, which are post-quantum secure and have no trusted setup,” and that he believes Bitcoin Core developer Luke Dashjr and Blockstream founder Adam Back are coming around to the idea.
“I heard this myself from…
cointelegraph.com