Lattice-based Post-Quantum Stealth Address Protocol

Transcript

[music] [music] Thank you very much. Well, um honestly the quick announcement unfortunately Scas could not make it here. Uh he or she's could not get an Indian visa. So I'm volunteered here to uh to actually share some thoughts about it. Um just in a bit I will tell you why I started working on something which is not really protocol related but something more on the application layer but I ended up with some interesting I would say uh summaries. So let's go through things um that you can expect from this talk even though it's 10 minutes I'll try to be completely fast actually let me get a um get a timer running so I will not over

limit a bit. All right. So, um we'll start with going on through what's wrong with ST addresses today. What's like popular and not so popular options to do it? Uh probably the shallowest entry into formal verification. How can Alice and Bob can actually exchange post quantum keys? What are the overheads and u which protocol updates can make it even cooler and one more announcement that it's for education purpose only. Right. So, so starting with the first weeks, uh, deployment day, ETH day, uh, as you can see, um, and a little bit of my background. So, um, I got a recent bachelor in computer science and some nursing background. I was not part of the Ethereum research

and development discord. Uh, was casually reading EAP onces for some time. Never seen or smelled any of the link code. got some experience on the application and access layer and uh never contributed to the uh client ripples obviously and things like indistinguishability under um chosen cipher text attacks were complete gibberish to me which actually changed during this cohort. So um on the week one I briefly covered the paper that I was reading and taking some notes about postquantum stealth suggest protocol pretty cool but I'll probably look into something else which was my idea to start working on EAP A304 for trustless locks indexing because the growing state on Ethereum is bad in my opinion and it

needs to be fixed somehow by somebody. So I decided to uh join one of the fellows and we kind of figured that it probably does not make a lot of sense for both of us to work on this. So I was cool to friendly um friendly move to something else uh as in one of the office hours Tamagna mentioned something like well for testing this we probably would need some sort of um client application that would actually run on those things um so we can test it across the clients and then later when reading the E3 research posts u just casually I saw the cool cool research about native and replied about well actually this EIP nicely complements some of the missing um spec assumptions and I got a reply from the author of co-author of the

stealth addresses which was pretty cool. I also mentioned that well maybe some research on the postquantum implementation would be cool to have and um after some time I realized that maybe the inclusion proof for trustless locks indexing can actually be solved by the stateful uh stateful clients. Um just as a side note and um there is a thing called burn to theory is basically kind of this positive uh toxic interpretation of the world when the one may say that well if something bad happens to me it's probably I'm I've been trying to be redirected to something good in life. So I consider it like this and that's how I ended up working on the latisbased postquantum stress protocol and quite

far from the um from the protocol development itself. So um upgrade to the classic defy helman key exchange is actually not that major if you would look into that. Alice and Bob are still exchanging the public keys, but at this time Alice would need to generate the triplets of the keys and Bob would need to do some more of the magic. But essentially, it's pretty much the same stuff when both parties are inter interacting. Um, it also based on the existing research that came out 2025 uh in January and uh as far as I'm aware, there were no existing primitives for testing postquantum stuff on Ethereum just yet. and uh I saw the gap

as something that I can actually experiment and uh and play with. Uh because I was joining as a permissionless participant unfortunately did not get a full-time to be working on things. So I wanted to pick up something that will be pretty cool, maybe get some nice results and inspire somebody to also work on this. So the projects of my goals of my project were to actually get an ERC draft with the new schema ID proposal because around that time nobody was pretty much working on it. uh get some conformance vectors, maybe the reference library, uh do the security analysis in lean and vcvo which I learned along the way which is pretty cool. Um and also do some benchmarks on all those things. um as the mental model um I was following principle of existing

research that I basically needed to proof of concept and then I could experiment with a bunch of stuff on the account abstraction layer on some protocol improvements see how they go run it on different test nets uh and stuff like that um which I did uh pretty much almost successfully um I formally verified uh some of the parts um some of they still remain to be contributed and for the timeline as we all believe in the age of AI. Uh basically the code is super cheap. So I think even before drafting the project proposal I already got like 80% of the code done. So the rest of the cohort was actually making sure that it makes sense and it serves the purpose that it's supposed to be serving. And that's how basically uh split the work um for this cohort. It

was actually my first time ever interacting with lean and vivio. So um quick interpretation of me what formalification can be used and what it should not be used for. Uh definitely it's not u like the silver bullet that will say well your code is super secure. It's just pretty much about the saying that the logic is correct separately. Well actually no that uh it will not say that the logic is correct. The human should say that the logic is correct. Um the formalification may say that the code is actually following the specification. Um and there is also one interesting thing is that um for modification also relies on the kernel quite a lot and um there was a situation three or four

months ago when it was possible to prove that um one equals zero basically or any statement equal false. So it's also interesting part to keep in mind about the formalification just in general. Um well some a little bit of experimenting that I did with the steels justice protocol. Um I actually felt uh quite there was a cool feeling when there was contributor out of nowhere. He just came to my repo and proposed a hybrid scheme for the postquantum cells address protocol. Ivan, if you look in this one, this is kudos to you. Um so yeah, somebody just contributed something that was not expected to my repo and I obviously accepted it. Uh here is some cool stuff I experimented with. Um I tried to run

this with the frame transaction on EtherX test net when it was still around till like I think like yeah some mid October or something. I tried the sphinx minus uh signature schemes uh some other optimized ones. Uh I discovered the X-wing uh hybrid schema for having kind of this def exchange next to the um model learning with errors. um key bones as a validifier mostly related to frames and different parameters of the postquantum secure schemas. But yes, where is gas? Um yeah, where are the benchmarks? How much does it actually cost? So um the way to actually overcome this for um the announcements that are published

on chain which may not be seen as a good idea right now is just basically going with the larger keys. So for classic dela dress announcement it will be around 30k gas and for mlcam it's around 1 kilobyte which is still relatively cheap but there are other concerns that may say that it's not actually a good idea to have it like that. Um the other things that I benchmarked were uh obviously the MLDDSA signatures um served as an account abstraction for uh figuring out um yeah actually seeing if it makes sense. You can see that under cheap gas it actually pretty usable. We can use it right now but if network congests it's actually like pretty

pretty expensive and uh with some optimizations we can push this cost um even lower. There were some things that I actually tried. They do not work really well but they may have some interesting ideas for um ZK commitments and using the ZK proof instead of the signature itself. um we can push for much lower gas but it heavily depends on the proving back end underneath it. So it's not guaranteed that it will be um it will be usable in the future. And out of the blue out of nowhere month ago somebody proposed a new ERC for doing um uh postquantum stress protocol with a very similar mechanism to mine. So I started thinking well how can I

contribute with all my knowledge? I reviewed the PRs. I replied on the ETH research. I proposed help with the formal verification. I found some papers proving that module learning with errors key encapsulation mechanism is actually um secure enough um using the Fuji Fuji Saka Wakamoto transform. Um and I also um got in touch with the team working behind this. Um so as I thought well could be another burnt theory. Um who knows? Um so for the things that I consider for the future uh those will be the most interesting things from the protocol level um I do and I would want to highlight that uh aggregation of the starks will be the biggest unlocker for

postquantum signatures. Um local first approach for exchanging data is pretty interesting as well as uh frame transactions because they open a huge variety of um of design space that can be used. Uh here are some sources. Everything that I was doing is also um I was posting some blog with like some poetry about it. I don't know. Uh here you can also go to pqap.gay. limo and uh see the whole history of like the stuff that I was doing. Uh I think it currently runs on cipoleia. Uh all the ripples obviously open source.

There were some other things that I contribute to contributed to uh and also opened a couple of PRs in VCO pretty minor ones. Um that's pretty much all. Thank you all for attention. >> You and do we have any questions? Any thoughts? This is some crazy advance. Yeah. Uh go for it, Ethan, please. And it's not just about like um being

able to take a spec and implement it, right? Because like especially like we we we also saw some for ones, right? And that was a question before like did this feedback from the implementation flow back to the spec and here it's about something more far in the future so it's still a bit more mutable. Um but yeah just want to say thank you for that. Um it's a rare skill uh to actually not say not think that like the others know it better than yourself like sometimes they are wrong or you have a better design. Thanks.

>> Thank you very much. Yes, totally agree. I also got full understanding of the protocol development. So now if I want to get into developing something actually cool, I know all the ropes. I know how it works. So yes, thank you for this comment and the question. >> Awesome. Thank you very much. Um that was [music]