There is an ongoing debate on X about lattice versus hash-based cryptography in blockchain design, with Zcash cofounder Eli Ben Sasson, Ethereum cofounder Vitalik Buterin, and Delphi Labs GC Gabriel Shapiro joining the discussion.
The conversation began with a16z crypto making the case for embracing lattices in a recent X post. In a write-up, a16z crypto explained its rationale; it claims Ethereum's planned hash-only signature aggregation design relies on SNARK recursion, with the coordination overhead, bug surface, and unestablished security that come with this approach.
Engaging with a16z crypto's post, Zcash cofounder Eli Ben Sasson strongly disagreed, noting that lattices have a juicy mathematical structure that is ripe for AI to attack.
According to a16z crypto, relying solely on hash-based cryptography may appear safer, but in such designs, it can result in more brittle systems. Expanding the conversation further, Delphi Labs GC Gabriel Shapiro shared his take on X: “I think the Ethereum approach remains the best option here for Ethereum,” disagreeing with a16z crypto's take.
Ethereum's Lean consensus roadmap includes fully replacing BLS signatures with hash-based signatures (some variant of Winternitz) and using STARKs to do aggregation. Shapiro suggested utilizing lattice cryptography for accounts and wallets through a precompile if it is proved to be AI-secure, adding that hash-based cryptography allows Ethereum to go full speed.
Vitalik Buterin weighed in on the discussion, agreeing with Shapiro: “we could still ultimately do lattice stuff for accounts and wallets through a precompile if it is proved to be AI-secure.”
“The ideal route to support everyone's cryptography is imo through 8288. You make whatever signature you want locally, then STARK it, and then it gets included through the stark aggregator machine. Don't need any calldata onchain. Ethereum can then never add a new precompile again,” Buterin added.
To this, Zcash cofounder Eli Ben Sasson responded, saying, “Agree, this is the right way for Ethereum.”
Ethereum prepares quantum resistance
Aside from Bitcoin, most large blockchains use proof of stake, which allows validators to vote on each block by signing it. Large validator sets are practical because of signature aggregation. Ethereum utilizes BLS signatures, which have an algebraic structure that allows them to combine tens of thousands of validator signatures per slot into a single group element.
However, as beneficial as BLS is, it is not post-quantum because no known post-quantum signature schemes aggregate in this manner.
Explaining the quantum resistance roadmap earlier this year, Buterin mentioned the solution to be protocol-layer recursive signatures and proof aggregation. He spoke about adding native account abstraction through EIP-8141, which provides a framework abstraction for transaction validation, execution, and gas payment so that first-class accounts could use any signature algorithm.