Post-Quantum Transaction Signature Breakout #10

Transcript

Antonio Sanso: I got it.

Gottfried Herold: Antonio.

Antonio Sanso: Do you see my PDF, by any chance?

Gottfried Herold: Yes, I see your share screen. I also see your old tools and sort of the task, your old tools bar on the side.

Antonio Sanso: Okay. Okay.

Gottfried Herold: I see your screen, yeah. So we see your screen and not your window, yes. Perfect. Fine. Can you hear me now? You should not…

Antonio Sanso: We're good. Here we go.

Gottfried Herold: You can hear me? That's not what you're supposed to do.

Antonio Sanso: Awesome.

Gottfried Herold: I see, yeah, I see why, okay.

Antonio Sanso: Let's see, let's see if I can mute you. I didn't mute you. My superpower.

Gottfried Herold: Oh, no, yeah, okay, no, no, no, I was just… I was just to check which microphone I was using.

Antonio Sanso: Oh, okay.

I'm a dope. Personal.

Matteo Vicari: Hi, Antonio.

Alessandro Baiocchi: Bye. Everyone.

Antonio Sanso: It… Hi, Benedict. I'm a thil.

Matteo Vena: Hey, everyone. Hi, Antonio.

Antonio Sanso: icon or…

Conor Deegan: Hey, Antonio.

Antonio Sanso: As usual, wait a couple more minutes. Pay me help.

Miha Stopar: Hey guys.

Antonio Sanso: I'll just wait a few more minutes, because I… I don't see the presenter of today coming, unless it's… Bonk is… Is there any chance you that you will… are you for science lab?

Matteo Vena: No, he's not.

0xBonk: From our end.

Antonio Sanso: From where?

Matteo Vena: It's from Riva.

Antonio Sanso: Okay. Welcome.

0xBonk: Thank you so much. Can you hear me?

Antonio Sanso: Yeah.

0xBonk: Oh, okay.

Antonio Sanso: So there might be… okay, we started in one more minute, and if Silence Laboratories will not… they will not join, it means that they understood the wrong time, maybe they have still the old 5 o'clock time. C, T. So… yeah. Anyway. Each time I said, is… one more minute, so we'll start. And… We'll see. I pinged them on Telegram, let's see if they are responsive. Right? Let's start. And we'll see what the Silence Laboratories guys will do. Anyway… Welcome to the Post Quantum transactions breakout room number 10. Yeah, we already did 9 calls at the 10th one, this time just flies.

So, the topic of today is going to be MPC and Multisig. We will hopefully have two presentations, or two demos, I don't know exactly. before to see the agenda, I invite the people here, if they didn't, to see at least the last part of the all-core dev. Of last week. Where we had, light clients that introduced EIP7851 and EIP8151. are really, really related to the post-quantum plan, so it's about… Somehow, revoking the elliptical material. And, Yeah, it's pretty… it's pretty interesting for Post Quantum. So, it's just, like, the last part of the call, in case you want to see the recording. About the agenda today, and yeah, here we may have some issues, but we will have Silence Laboratories presenting

Quantum Safe MPC, so a diDilithium version. MPC of, of, sorry, MPC DiDilithium. version that was presented by ZKnox, but they did MPC. And then we'll have, Riva Labs presenting their post-quantum solution on save, so it's gonna be a multisig. I don't see Silence Laboratories here, Nicole, yet. So, yeah, until I figure out, do you mind develops starting with the… with your stuff, and in the meantime, figure out what to do with the silence labs. Is this okay?

Matteo Vena: Yeah, no problem.

Antonio Sanso: Thank you.

Matteo Vena: We are all very curious about the MPCs, so hopefully they'll show up.

Antonio Sanso: Yeah, if they don't shop, it's really about, like, They timed… the mismatch.

Matteo Vena: Okay, so can you see my screen?

Gottfried Herold: Yes.

Antonio Sanso: Mayor.

Matteo Vena: Great. So, it's going to be quick today. Many of you in this call are already probably familiar with what we do at Riva Labs and the Ephemeral Keys Protocol. But for those of you who aren't, or who might have lost some of the updates and changes that we have made and new developments, this is basically a recap in a picture. What you see over here is that basically what we are working on is mainly the protocol that sits on the left of the picture. And the protocol is available almost entirely over here on GitHub, so we invite everyone who is interested to go read the spec and leave comments, issues, whatever, so that we can improve.

But basically, at this point, it's clear that for us, the protocol relies on these main components, the rotation mechanism, the force. plus C signature scheme, Sphinx as a backup recovery in case of issues, and to do some very rare and specific things. Account abstraction, obviously, so on the… we have a dedicated repo on GitHub to cover frame transactions, and the standard one is with ERC4337, and then there is the entropy derived from BIP44. So these are the key components. Now, we have seen through many comments and chats that there are still some Questions around on how the rotation mechanism works. But basically, we think the three core pillars that we listed over here are that the next signer storage is on-chain.

The force recover function, as we call it, that's described in the spec, and it's obviously a key part of the protocol, and that transaction happens… rotation happens every transaction, which is the… it was also the topic of one of the most recent calls of this series. And on top of that, these are the features, down there on the left column that you can expect, so… Interestingly, the protocol now supports multi-chain. As you can see on this side of my screen, there is this, there is a browser extension of our reference implementation of the protocol that we call NiceTry. And now, I can basically keep a stable identity, a stable address, and move into any Layer 2 I want. So, for example, right now, I'm connected to Ethereum Sepolia. I can switch to, for example, Base, have my balance, transact, send, receive, even interact with DeFi on the Layer 2, and then just back.

Only Layer 1, there is no change, and the entire flow remains post-quantum. So again, in the eyes of a user. there's nothing different compared to using a standard wallet. Now, again, there are some still advanced features if you want to keep track of the rotation mechanism over here, but that's not for the standard user. And besides the multi-chain, the wallet can support, at a protocol level, the protocol actually can support a multi-device, so you might have the same wallet on your computer and your phone and whatever. There's a 7579 compatibility, and off-chain signatures are covered as well. And then what we did is basically the reference implementation of everything in the protocol that's called NiceTry right now.

the reference implementation has to be seen as basically all the components and moving parts of the protocol that doesn't necessarily need to use our own wallet extension. This can be implemented everywhere, and there's the verifier, the force verifier on chain, and we are working on the formal verification for it now. There's the smart contract wallet, which is a standard, basically, from from the Ethereum community, we have the signer, the implementation of the VP44 derivation path, and everything we do with entropy, the multi-chain support, as you can… as you saw here from my demo, and it supports Multisig, which is mainly the… Something we shared yesterday. Now, if you want to learn more, on our website, which is riva.xyz, there's basically an article describing how you can use StockSafe. When we say StockSafe, we just mean safe. The way it is today, go on the safe

front-end and use it the way it just works. What you see here is on Ethereum Sepolia. Basically, the article describes how we make use of, approved ashes. Which is one of the, basically, ways to interact with SAFE, and the main one when you are interacting through a smart contract wallet. And how that plays out with using our wallet as a… As a post-quantum wallet that signs a transaction, and how safe, again, the way it is today, no changes, no updates required, can orchestrate a multisig, scenario on Ethereum, using our wallet just to sign transactions. So, what you see here, we're not gonna do a live demo, because it… on Sepoli, it takes a very long time to use, to use safe and execute the multisig, but it's basically what you see here, where this account was created, we created… we basically set up a…

2 out of 3 multisig, and then the beauty of this is that you can also… you don't necessarily need to use only our… post-quantum or a post-quantum wallet built on our protocol to make it work. You can have the other signers be ECDSA, for example, so that you are not risking, that everything you do relies on a new infrastructure, and then add one signer, through our infrastructure that basically gives you that post-quantum layer, even on your existing multisig. So we believe it's a very convenient way to experiment with SAFE in a post-quantum way. And you can read, again, all the details in the article. You can even go and check the transaction logs that explain everything that happens inside. We included some code snippets so that any of you that wants to try and see how it works

can do. can do it. So yeah, we basically now have this support of SAFE at an infrared level, and then we are working to basically describe the UX that we are building, what are the issues, and how you can hide all the post-quantum UX issues and future recovery issues, whatever, in a standard user interface. And in terms of what's coming next, we are working on the Sphinx backup recovery and implementing everything you saw in the feature, so multi-device, especially now the focus is also shifting into the hardware signer support. Incidentally, we also are now moving some key parts of our infrastructure into testing a more institutional-oriented setup, and we are working on a… we have a half-a-version design, actually, of MPC done through hash-based signatures, and we have a working

design for a post-quantum bundler that, again, you can find on, On our website, it's described into the smallest details, that is basically not meant to Avoid theft of user funds, or protect user funds directly, but to avoid certain denial, type of attacks that could happen at the bundler level in a post-quantum world. So that is also available on our website, you can read all the details. But yeah, this is all that we have been working with. Again, the demo of the multisig would be too long to do on a call, but we invite you to read the article and share any feedback and comment or question, if you have them, and also Again, the ephemeral Keys Protocol and the nice try repos are what we have on GitHub, the main two, besides the one of frame transactions, and they are open, so you can go there, see everything, and we are eager to receive even more comment and feedback to improve the protocol.

So, yeah, that's it. Obviously, you can DM us or message us in case you have any questions, and even if you have any questions now, we will be happy to answer.

Antonio Sanso: Great stuff. I have several questions, actually. At least 3, if you have, like… Anyway, just saying, Jay is coming, so we'll have the second demo, but in the meantime, I have, like, generally two, three questions. So, the first thing is, like, I see this nice protocol that you guys did, and… I didn't read it yet in the details, but it makes a lot of sense. Now, the question is, how will it fit in the current design of Ethereum space? Like, does it… will this fit in EIP? Will it fit in ERC? Is yet another… pink… Because we want… I mean, it's nice, so we want to have it something official, right?

Matteo Vena: Yeah. The way we are thinking it, it's that probably it should be an ERC. Because when you think 4337, for instance, it tells you, yeah, this is how we do account abstraction. And then. almost everything that you can find around account abstraction related is basically based on 4337. And since there are so many small details within the protocol that are not only related to the post-quantum signatures, but even just, like, how everything interacts within the protocol, I think it would be wise to have sort of a standard reference, and that could be an ERC. Also, in the ERC format, if I'm not mistaken, it's… it should be the best format to receive comments from the community, from wallet developers, and others.

So, yeah, definitely open to explore turning all of the work that is now more mature into a ERC.

Antonio Sanso: Okay, so is it in your plan to do that, or just, like…

Matteo Vena: Yeah, I think we need some guidance on the best way forward, the best way to bring it to life, but definitely what we want to do next for the protocol itself.

Matteo Vicari: And also, I expect Antonio to be our co-author of the ARC.

Matteo Vena: Yeah, we literally want to invite anyone to participate into this effort of making… turning the… the protocol into an ERC. So I think the next step is going to be drafting the ERC itself, sharing it in the group here of the… of this call series, and then anyone who has comment and feedback is very welcome to join.

Antonio Sanso: Makes all sense. To be fair, like, I have to admit my ignorance now. I've been… I'm an author of an EIP myself, so I know pretty well how it works with EIP. The… how is an EIP selected? But with ERC, I have to inform myself. Is anyone in the crowd knows how is the ERC procedure? Probably not, let's see if there is… No. Right, so I'll take care of it, and try to understand what we need to do to have a future literacy, because in my opinion, it's what It would make a lot of sense to have this standard. And, it's nice that you did all the heavy lift already, but then, like, having some official documentation in the standard will be… in Ethereum standard, of course, like, will be much better. Second question is this, like, I see that you are planning to do this MPC hash-based?

Yeah, I mean… Now, historically, Hash and NPC didn't play along together.

Matteo Vena: Yeah, I agree. Well, you've seen the, basically, evolution of what we did and our work over time. I think the… at the moment, we are very much focused on this… on the hash-based schemes, just because we believe they are going to be more… usable on Ethereum, on-chain in general, and more battle-tested, so easier to adopt and reference. And so we started experimenting. Obviously, MPC is a very specific design realm. There are rules for, you know, how something classifies us as MPC or doesn't. But what we have in mind is, can we replicate every benefit, and do something that is actually something you can call MPC, but still use force, still use hash-based signature schemes. And we spent a lot of time on this in the design space, because again, it's very early. But we believe it's possible. We are working on a demo, on a test.

And… Eventually, probably, hopefully, within… one month or so, we'll have a working demo that we can share. And obviously, this is meant for institutional custody. I mean, using the protocol as is should be more than enough for a standard user, especially the moment we have hardware signer support, and you can do it on a ledger. Using the… Multisig version of the protocol should be, again, enough, even for certain very… important use cases, like upgrading an admin key on a Layer 2 or whatever, but then if you really want MPC, for instance, so that on-chain is not visible. What kind of signature there is doesn't reveal anything for privacy, or for the benefit of setting up one single seat and then being able to do many things with it.

I mean, it's a separate design space, but yeah, we are trying.

Antonio Sanso: Yeah, no, I mean, I suggested to don't reinvent the wheel. There's been some work lately that focuses on HubSpace MPC. Said that, and I see Benedict in the crowd here. But as I said that I think that with Ash-based MPC, you are always kind of revealing That you are actually an MPC user. So the… the beauty of…

Matteo Vicari: There is some… the idea is, also you reuse the forts we already use in our system. So, there is some way to just use our standard wallet, the smart contract part wallet, and then try to make a fourth sign split in more different users. Because the… the idea is, like, but we are working on it, so it's not something useful.

Matteo Vena: Yeah, it's kinda early stage for it.

Matteo Vicari: Yeah, yeah.

Matteo Vena: But, yeah.

Matteo Vicari: But the idea is not try to have a sign like Sphinx, and try to create an NPC about this, but… another way to… to use another kind of hash base, like we do in our existing wallet. This is, one of the idea.

Antonio Sanso: Call me curious, again, like, I'm skeptic, because, like, basically, like, in, in a… in hash, you don't have structure with hash, there is not algebra, any algebraic structure. But I see… Benedict, you go ahead, I see your hand.

Benedikt Wagner: Yeah, I mean, you can, of course, always do generic MPC to evaluate any function, right? So you can, in principle, you can compute a signature that looks exactly like a… single signer signature in MPC. The question is, is this efficient or not? But if you think about… I mean, let's ignore things like SPHINCS, but let's do the most simple case. You want to compute the Winternitz, or like a chain-based signature, then what you can do is you can secret share, essentially, all the intermediate values on all chains, and then computing the signature essentially boils down to just reconstructing one secret sharing. So the challenging part here is the… Essentially setting up this structure, this, like, secret shared version of the hash chains.

But once you have done that, signing is very, very efficient. But setting up the structure and generating the public key is, of course, is a pain with generic FPC, and… but there could be, like. ways to go around this, but I think I recall also some impossibility results on, for example, thresholdizing hash-based signatures, so I think there's a…

Matteo Vena: Yeah, I think what you said…

Benedikt Wagner: doable, but not me.

Matteo Vena: It makes a lot of sense, and it's basically a long… I think it goes more or less in the direction that we are exploring right now. However, it's at an experiment level, and the point is that MPC is not something standard within Ethereum. At the moment, as a market, at least, for institutional players, it's more like some large-scale companies have some large-scale implementations, and these implementations became sort of a de facto standard. And so, when other designs are checked, it's more like, is that the same, or is that, you know, superior, inferior? But in reality, the way we are thinking is, like, what is the goal that you are trying to achieve with the MPC, and what's the best way to try and make that post-quantum?

And then see if you can stay within the realm of hash-based signature schemes, which is what we are trying to do. Could fail, obviously. Again, it's at alpha stage yet, but still, I think it's a very interesting thing to try.

Matteo Vicari: We have two weeks for the next call, so we can do a lot of stuff. No, no, but we try to experiment with other stuff, we try to… have other ideas, and we try to tackle the problem for a different, design system, like, already we do on our FP Meraki design for the wallet. So, it's like to use another angle to achieve this.

Antonio Sanso: Right, two things to add. I think the impossibility result that you talk about is, I think, has been done by the team of Jay that is going to present next, so we might spend two words about that. And I see Oya in the chat, and talk about garbage circuits. And then, yeah, it's what Bendic says. Thanks a lot for the comment. That's a generic way, and I agree with your question, and with what Bendic says. It's just like a… generic method, but again, there's no… there is no structure there, so you… is… with… of course, with the… with Lattice, things are way smoother, and I think what is… what Jay is presenting now… So, Matteo, are you done with your presentation, right? Yeah. Okay.

Matteo Vena: Absolutely.

Antonio Sanso: Perfect, thanks a lot, this was really, really nice, and let's be in touch to see if we can move towards ERC.

Matteo Vena: Yeah, definitely. Thanks, Antonio. Thanks, everyone.

Antonio Sanso: So, Jay, stage is yours. Sorry for the… misunderstanding with the time J, but, yeah, it's…

Jay || Silence Laboratoriesoratories: Hello, everyone. Yeah, I'll be just going… giving a quick demo of, threshold signing with MLDSA? integrated, With, Both, pre-compiled and as well as smart contract-based account. Thanks to, ZKnox team, yeah, we have been using, their smart contracts, too, so it's actually Crystal signing. For MLDSA. Yeah, on the region of impossibility, yeah, I think the paper is on e-print, I will share the link. It talks about hardness, and for hash-based signatures. In practical time domain, it's possible, but yeah, it will take, like, huge amount of time compared to milliseconds and what we see right now. That's the context. Let me pull up the demo, it will be pretty quick. Do you see my screen?

Conor Deegan: Yep.

Jay || Silence Laboratoriesoratories: Well, fair. Yeah, this is a demo we just saw is creation of a queue, distributed T-shirt, wallet… Where we have two modes. One is you do all cloud-hosted t-share. With 2,3 setting, but it's gonna scale to arbitrary number. But we have seen it exploding, To a huge number for signing time, once we go beyond 7 and 8. And another mode is that you can split the key share between cloud and phone, and create a two-factor-like authentication setup. So it depends upon the risk model, User intervention or human in the loop has to be involved or not, and either of the design can be chosen, which is pretty standard. Nothing, native to quantum here. So yeah, just use PassKey.

To authorize, create all your wallet. And you can choose, yeah, let's choose. Pick your water. I'm just showing BitGo because, yeah, we did integration for the demo, which we did in the event a couple of, days back. Let's try to create one based on ZKnox, which is use… which is actually a hybrid signature in this case, both ECDSA as well as MLDSA. Yup, so it will create a wallet here, which takes… Again, the odd signal. Wrong key. And yeah, now you have a wallet, which is trying to now sell fun from a faucet. We've got some money here. And yeah, this wallet is based on hybrid signatures, as you can see.

Just to simulate the injection, yeah, let's try to create something. And yeah, once you've created the payload, you need to authenticate. Which, again, will ask for… No. Jeez, the signature is happening, and 2.3 setup on cloud. Yep, submitted is done, and submitted pretty fast. At least for two-party setting, because the signature was 2 out of 3, so 2 nodes are required. Out of 3 nodes, which were all cloud-hosted, running in, I think currently in same data center, so it was pretty fast. Otherwise, it takes around a few hundreds of milliseconds, roughly around 150 milliseconds. For, this configuration, you can see this on a 3Scan. And… yeah. Just to verify…

Yep, so it did use the Dilithium ZKnox-based smart contract to verify, which anybody can go and verify these calls, which I will just paste here. This one, the theoretical upper limit… Will be 10 or so parties. After that, it just blows up. It will take, seconds. But we are working on a version which will scale to more than 10 parties, but at least for the institutions and target other than cross-chain bridges, there is no real use case of larger thetle signing or larger MPC than 3 or 4.

Antonio Sanso: There's as well a question for, from, renault. And it says, will the MLDSA algorithm used under the hood, be published soon?

Jay || Silence Laboratoriesoratories: Yeah, yeah. It's going to be presented. It's a… it's a kind of, a bit of a deviation from Dilithium-based protocol. And the deviation happened because we… I've added a couple of new nuanced features. like, in standard MPC, you don't expose who is signing, which is a good feature of MPC, but a couple of people who are habituated of Multisig, and they want to expose who were the signing parties, so we had to add a feature called Signer Reveal. So you can actually pinpoint who out of three two parties participated. So yeah, that is exposed. Import and export, which was very hard, yeah, those things were added, so which created a completely new protocol. And yeah, this will be presented.

Antonio Sanso: But it's gonna be… it's gonna be an academic paper, or…

Jay || Silence Laboratoriesoratories: Yeah, yeah, it's an academic paper, correct. And even the code is being audited, and then it will… the code will be open source as well. Yep.

Antonio Sanso: Just to go in order.

Jay || Silence Laboratoriesoratories: MPC, expose the signers, if you want. Not by design. It's a feature. It's against malicious adversaries setting.

Antonio Sanso: So…

Jay || Silence Laboratoriesoratories: many rounds? Yeah. Sorry.

Antonio Sanso: So, no, no, I'm really questioning with you. So, there's this question as well of Renault. It says, how many rounds of chain communication is required? Sorry?

Jay || Silence Laboratoriesoratories: Who knows?

Antonio Sanso: 3 rounds, okay, 3 rounds. Oh, okay, great. One thing's like, do you have any comment on the… before Benedict was saying that there's an impossibility result about hash-based MPC. Is… is… if I remember correctly, was one of your team doing that, right?

Jay || Silence Laboratoriesoratories: Yeah, correct, yeah. We… we did submit that, and that's fully presented as well. In a conference.

Antonio Sanso: But it's already out the paper? Was it some Eurocrypt paper, or what was it?

Jay || Silence Laboratoriesoratories: No, the paper is not out. It is supposed to be out on April, I will check with the team. Yep. I will share the different link.

Antonio Sanso: So you will have two, you will have two papers out, one for MLDSA, one for impossibility results.

Jay || Silence Laboratoriesoratories: Correct, yeah, correct.

Antonio Sanso: Okay, let's do this.

Jay || Silence Laboratoriesoratories: And this, this code will.

Antonio Sanso: Sometimes you're gonna see the model.

Jay || Silence Laboratoriesoratories: You know?

Antonio Sanso: Okay. there is this, this is your team as well. Sometimes you can distribute random oracle-based proof.

Jay || Silence Laboratoriesoratories: What is the size of the signature on-chain? I mean, the size is not MPC-dependent. Standard MLDSA size will be the size of the signature. Because it's indistinguishable whether it is MPC or not.

Antonio Sanso: There's as well this call from… this… a question from Benedict, they say, security with abort or with guaranteed output delivery. Under which corruption thresholds.

Jay || Silence Laboratoriesoratories: Give it a boat, or with guaranteed or good delivery. I'm a record. the soul. Come on. I will check with that. I definitely… There is a guaranteed output delivery.

Benedikt Wagner: So you need honest majority for that?

Jay || Silence Laboratoriesoratories: For guaranteed output delivery.

Benedikt Wagner: I think you need it if you don't have security with bot.

Jay || Silence Laboratoriesoratories: Most likely. So, when you say aboard, do you want to identify a party who leads to nature? Not…

Benedikt Wagner: No, that would be identifiable. I'm just asking, like, what is your corruption threshold? Because if you go beyond, honest majority, you cannot have… fairness, like, is a classical impossibility result. You cannot have guaranteed output delivery.

Jay || Silence Laboratoriesoratories: I will check, I will check with the team on that, yep.

Matteo Vicari: So, sorry, another question, but, I see also you have, the MPC is Control Standard EOA. Or it's for now, and there is also a transaction when you set the key, it takes around 5 medium gas. Why? Too much? It's not the… it's a sign, also, this…

Jay || Silence Laboratoriesoratories: Yeah, so that's not… that's… yeah, correct, you are totally correct. That's not… Because of the MPC, that because it's happening on a smart contract.

Matteo Vicari: But the wallet is not as my contract for the scan, what I see, but maybe I'm missing something.

Jay || Silence Laboratoriesoratories: I think it is. The team can, is Rena on the call? Ren on the call? It is a smart contract, yeah, right? Yeah, you can verify the code. That's, that's why you began.

Reno - ZKNOX: Yeah, it's… it's a 4337 or 7702 account, so on-chain, you make no difference, it's just a verification… So you replace, UCDSA by MLDSA in your, in your base account, right? And, all that, Jay is describing is off-chain. So off-chain, there is MPC protocol that is run out, off-chain. to craft, to craft the signature, but for someone looking on-chain, there is no difference here between a single signer and a MPC signer. This is MPC, or MPC work. So it's a standard Dilithium signature that you see on-chain.

Matteo Vicari: yeah, okay, but, I… the wallet that sent the transaction, the wallet that's old phones, is the one that… and the A1CA, if I am correct. this one. I can't pass, it's better. Sorry. Okay. Right, there weren't.

Reno - ZKNOX: Those are the details, right? But it's like in a 7702, you make a delegation to a verification function, this verification function is MLDSA, and that's it.

Matteo Vicari: Okay. Okay. Okay.

Jay || Silence Laboratoriesoratories: It's just to be independent of what's happening often.

Matteo Vicari: It's not for, for… okay, okay. Yeah.

Jay || Silence Laboratoriesoratories: There's a pre-compile version as well, but it depends upon what technical support we have. There's a pre-compile version in the same demo, where the cost is much less sure.

Reno - ZKNOX: So, mainly, the problem is that there are different versions. Here, Jay wanted to be compliant with NIST version, so it used SHAKE. Check is not part of EVM opcode, so it's really expensive. There are versions where we replace Check by Keccak with its cryptographically… Equivalent, and it drops, the, the gas costs, to 3 million, if I remember well. And this is mainly why we… we proposed, last year, EIP852 to… to reduce, to reduce this, because, yeah, basically you have a… everything is emulated, emulated in, in the EVM, because For a SPHINCS-like algorithm, the main cost is hashing, so you just have a sequence of hash where you have a very efficient upgrade. But if you… if you compare the number of CPU cycles of MLDSA compared to

to Hashbase is very similar, so it's… this is why, If a precompi were to be adopted with a similar… unlikely, now, because Basically, consensus layer is pushing what will happen on the execution layer right now, which is reusing the existing stack. But, lattice verification is very efficient. As a precompile, it should be 6, 6,000 GAS, plus, the data, data mod, data cost, which is, which is high, but this is the case for every, Signature scheme.

Antonio Sanso: Reynold, there is a question as well from Matteo that asks if this… if this is 7702, and if yes, can it be attacked by reverting authority to ECDSA?

Reno - ZKNOX: This is exactly why, at the beginning of the call, Antonio talked about 7851, once, there is, consolation… deactivation of the original, EOA, this will not be possible. So right now, yeah, 7702 has a flow for present-to-ness, which will be solved by, EIP7851.

Antonio Sanso: Yeah, today it's like this material, yeah. It's like you claim. I have a question for you, Jay, and maybe I don't know… I know already the answer, potentially, but would it be nice if we formally verified this solid contract verification, at least the little one. Dude, that's…

Reno - ZKNOX: Oh, it depends what, because formally, verifying can mean a lot of things. So, meaning that it's strictly equivalent to NIST specification, or doing, formally, formal proof that even NIST implementation is already, right, because it's totally different, and.

Antonio Sanso: The first, the first.

Reno - ZKNOX: Excuse me.

Antonio Sanso: I mean, the first one, the first one. The…

Reno - ZKNOX: Or equivalent to this? Yeah, yeah, yeah, this is, this is doable. We have, we have, contact with, LFG Labs, as a, who is developing Verity. So, yeah, that would be, really interesting, to have, to have this proof.

Antonio Sanso: Okay, and I see as well your long comment above, and I know your opinion on this laptop versus hash, and I see you have a point, but does the fact that, Does your opinion change after seeing the demo of J? Namely, at least for the execution layer, we're not only stuck with the hash-based, but we, as you see, you can have, like, a variety… I mean… I tell you, I mean, you did that contract, so, I mean, you see that we are not only focused on hash-based. Does it transfer, at least, for the transaction, your question, or your comment?

Reno - ZKNOX: Yeah, I mean, right now, because EIPs have been proposed more than one year ago, I guess, so… So, I think there is some kind of, slowing down, because actually we could have something operational for execution layer for a long time. We have, but it's, really gas inefficient, because of the difficulty to push the precompile.

Antonio Sanso: Yeah, I think precompile is… at the moment, I see them to be out of the game somehow, but, like, let's say for scenarios like the one we've shown today, you probably missed my presentation two weeks ago, but… the view is, like, maybe stuff like this, with diDilithium and MPC, is for, let's say, more rare and institutional… transaction, and someone can actually afford, like, a $5 transaction for this rare… scenarios, right? I mean, of course, you're not gonna spend $5 every single time you do a swap, but for, like, rare and important transaction, you can afford, like, some dollars. Do you agree?

Reno - ZKNOX: I think… I think the thing is, my main concern is that we are totally diverging from what every other industry is doing, right? No MLDSA will be the standard, it's already included, in TLS. So that's gonna be the winner, right? So, basically, this means that all the infrastructures that we would like to reuse, HSMs. any hardware security material, will have to, lead very expensive developments, to, to have those. So it's like we have a problem, which is a difficulty of aggregation. And actually, if you look at Some other consensus, some other consensus are not as, I would say… totalitarian about the number of signatures verified. So, we have this beautiful property, with BLS, and actually,

We are solving this with, with ZK, ZK proof, there are other solutions, maybe, if you look at Tendermint, BFT, Commit, etc, that could have, maybe a smoothest, smoothest transition. But because we, we decided, that, okay, we will keep everything, with the same API for consensus. we will break all APIs for other use cases, because actually, if you… if you look, for instance, for consensus Lido, they have some SSV where it's an MPC under the hood, that is used for, the management and the node, so this will be broken. There are a lot of MPC companies, private V, institutional, that's what they use. So, yeah. I… I would… I would try to… yeah, just challenge the fact that we are,

We're setting everything, because of the consensus constraints.

Antonio Sanso: I, I, I don't get your, your…

Reno - ZKNOX: We will have no compliance material with, Web2NT. Looking at what happened with Passkeys, where we… it took 4 years to, to switch ends. To, to, to, to have it. I think we will have the PSCII… pesky problem again with, with being compliant with the rest of the world. Pascal was a big narrative, like, two years ago. And, yeah, it will happen again, and while we could have, like, an MLDSA from the start. And also, right now, there are several, cryptographic, algorithms. There is K1, there is BLS, there is, R1, and… there is something that would be really straightforward to push MLDSA to be sure that we could have some compliance with the rest of the industry, and this is not the way we are taking because of the consensus.

Antonio Sanso: Right. Renault, I, I, I… I… let's say I agree at a certain extent. I mean, let me allow to call it your rant. I see the point. I said that… I think for… for execution, we are… we're leaving the space to potentially still including the Dilithium, as… as a… as a precompile. I mean, it's not totally ruled out. At the end, the demo of today of Jay will be identical. with the precompiled old shipper. Do you agree?

Reno - ZKNOX: Yeah, it would be far cheaper, right?

Antonio Sanso: But, I mean, there is…

Reno - ZKNOX: I mean, 8 billion gases, huh?

Antonio Sanso: Yeah, the rest, I mean, is going to be identical. That's what I'm saying, is having a dilating precompile is not ruled out at the moment from our future. So we're not closing the door to that. Do you agree?

Reno - ZKNOX: I don't know, I don't know if it's.

Antonio Sanso: From my perspective, it's not… it's not closing the door, by far. I mean, you know, we are leveraging some really generic infrastructure, the second abstraction, and all the goodies out of it. And I'm not 100% excluding that we will have a precompiler that is the Dilithium. And, you know, if we see the demo of J of today, it's really like one precompiler way to be identical to what you wish. The rest is gonna stay the same. So, I get your point about consensus, but for execution layer, I think that we're still in… Not… not ruling out that. I see another question from Oleg. the stakeholder placing check by K-check to solve gadget utilization issue open. I mean…

Oh, like, what do you mean, replacing check, back at check? You mean shake? Yes, I agree.

Oleg Lodygensky: I heard someone say that to solve the gas consumption issues, we could replace the check by Keccak, and it's just a question, but I think this opened new vulnerability, because as far as I understand, Keccak is based on ECDSA, so I'm just a questioner.

Antonio Sanso: No, no, I mean, it's a mix of bits of things, but actually, there is already a version that uses Keccak. So.

Oleg Lodygensky: Oh, okay, sorry, okay.

Antonio Sanso: It's cheaper, but it's not… as Reno was saying before, it's not… it's not gonna be complying with NIST, but yeah, it exists already.

Oleg Lodygensky: Okay, okay, thank you.

Antonio Sanso: Right? Cool, all right, I think if there are no more questions, we can wrap up for today. Thanks to the presenters. Okay, feels like in between Blantis and the other one. Okay, yeah. So, thanks a lot to the presenter, Jay Mattel. And, yeah, they were really both, really nice demo. From my perspective, it showed the power of cryptographic agility, and so we've seen today both the power of, Lattice and Hash, and, Where they bring the pros and cons of both. So, as we know, for post-quantum, there's no silver ballots. So, yeah, that's not cool, but… Let's see in two weeks what we'll have. Thanks a lot, and see you in two weeks.

Jay || Silence Laboratoriesoratories: Nope.

Matteo Vena: Thank you all.

Matteo Vicari: Thank you all.

Alessandro Baiocchi: Thank you, bye.

Benedikt Wagner: Thank you!

Transcript adapted from ethereum/pm, CC BY-SA 3.0.