Our latest research reduces the offchain data required for garbled Groth16 verification on Bitcoin by more than 99.99%.

48 GB → under 2 MB.

eprint.iacr.org/2026/2100

We implemented 1024-bit RSA signature forgery in nearly SNFS time!

Temporary access to an HSM allows an attacker to forge arbitrary signatures (without factoring).

Join work with Laura (1st author!), Adam, Nadia, and Emmanuel

github.com/ucsd-hacc/NSNF…

Formal verification is like cooking with a robot chef. You will get what the recipe (known as a spec/ proposition) intended, but nothing says its good.
To be clear, AI driven formal verification is amazing, but some folks are over promising, especially in cryptocurrency

Wow! eccc.weizmann.ac.il/report/2026/16…

@grandchildrice @adust09 @banr1_ @fab_projection We have implemented Gloas, Fulu and Heze already here: github.com/etheorem/etheo… and little by little adding formal verification. Many contributors: github.com/etheorem/etheo… open to coolab :-)

Sitting on the shoulders of giants, I am glad to announce the following paper with Eli Ben-Sasson, Dan Carmon, Swastik Kopparty, and Shubhangi Saraf:

eccc.weizmann.ac.il/report/2025/16…

On the one hand, we improve the existing decoder analysis from Ben-Sasson, Carmon, Ishai, Kopparty and Saraf (BCIKS 2020), reducing it to an O(n) soundness error for correlated agreement up to the Johnson radius.
In practice, it shows that degree 4 extensions of a 31 bit prime field (like M31, Babybear or Koalabear) are sufficient for FRI up to that radius, in many applications, considering that you are willing to grind.

On the other hand, we provide additional counter examples that question the proximity gaps conjecture as written. Notably, over binary fields one cannot expect an O(n) error already *at* Johnson radius, rather a quadratic one.
In general, proximity gaps stop at the distance where we have more than field size many proximates, meaning that we have to respect small gap to capacity. (See also the recent work of Crites and Stewart, as well as Diamond and Gruen.)

@Arvolear correction: it's 3% larger 𝘢𝘵 𝘣𝘦𝘴𝘵, not at worst. it could be up to 2x larger.

I recently went through the exercise of applying logup* (Soukhanov) to implement Twist and Shout (Setty & Thaler). As a result, we can have memory checking arguments with very cheap commitment costs using hash-based commitment schemes! ↓

An exciting update from myself and @benediamond (eprint.iacr.org/2025/2010). We show that the 𝘶𝘱-𝘵𝘰-𝘤𝘢𝘱𝘢𝘤𝘪𝘵𝘺 proximity gaps conjecture is 𝗳𝗮𝗹𝘀𝗲. More precisely, given any pair c, d we construct codes whose error grows faster than nᶜ / (q ⋅ (ρ η)ᵈ).

People talk about the need for standards in snarks.
My (biased as an author) opinion is the thing to standardzie is plonk as in the paper.
It has been through more scrutiny than any other construction, with several papers, from three separate research groups, proving the security of the exact construction in the paper. Latest one being:
eprint.iacr.org/2025/1759

🔥 Ethereum on Tour is landing at Shanghai Jiao Tong University & East China Normal University! 🇨🇳

Don't miss this chance to explore the future of cryptography and blockchain with top academic minds! 🧠

🎙️ Featuring:

· EF Co-Executive Director Tomasz @tkstanczak with exclatest Ethereum research.

· Leading scholars from SJTU & ECNU covering NIST PQ Crypto, ZK, zkTLS, FHE, and more!

🗓️ Date: Oct 24th
📍 Venue: SJTU
🔗 RSVP NOW: luma.com/iqf3t4hn

Organized by @ethereumfndn Academic Secretariat, @sjtu1896, @ECNUER. Supported by @SNZholding & @ETHTAO.

Big thanks for our partners: @OpenBuildxyz, @GCCofCommons, @PANewsCN, @ForesightNewsEN, @OdailyChina.

📢【Ethereum on Tour：以太坊基金会高校行】将走进上海交大和华东师大！

🔥不要错过与顶尖学者们一起探索密码学和区块链未来的机会！

🎙️活动亮点：

· 以太坊基金会联合执行董事 Tomasz @tkstanczak独家分享以太坊最前沿研究。

· 来自上海交大和华东师大的教授学者们，将分享 等研究成果。

🗓️ 时间：10月24日
📍 地点：上海交通大学
🔗 立即报名：luma.com/iqf3t4hn

这次活动由上海交通大学John Hopcroft计算机科学中心、华东师范大学密码学院、以太坊基金会 @ethereumfndn 和以太坊基金会学术秘书处主办，SNZ Capital @snzholding 、ETHTAO @Ethtao_Ethtao 组织协办。

非常感谢我们合作伙伴的支持：@OpenBuildxyz, @GCCofCommons, @PANewsCN, @ForesightNewsEN, @OdailyChina.

Excited to share eprint.iacr.org/2025/1905.pdf, which rethinks the usage of folding in succinct proof systems.
We provide a new framework to build folding-based SNARKs, by eliminating the need to prove Fiat-Shamir inside circuits and by introducing a high-arity lattice folding scheme

Excited to share our new paper: eprint.iacr.org/2025/1897! We made Groth16 dynamic - proofs can now be efficiently updated when the witness changes slightly. Amazing that after 10 years, we still have new insights of Groth16 and Pinocchio. Joint work with two brilliant new students

There's an elegantly simple way to embed base-field inner products into an degree d extension field with no memory overhead and only O(d) computation overhead.

I finally did a proper write-up. Very keen to try this for M31 in WHIR. Link in reply.

Lattice and FHE broken?

In 2024, Yilei Chen claimed that lattice-based cryptography was broken.
eprint.iacr.org/2024/555
However, there was a bug in the attack, and the claim did not hold.

This new paper by Yifan Zhang claims to fix that error. arxiv.org/pdf/2509.12341
Let's see what the quantum experts say.

If this holds, then it can have detrimental effects on the lattice-based post-quantum security efforts.

Github link: github.com/yifanzhang-pro…

Actually never took notice of Lev Soukhanov's logup* construction. Such a beautiful idea, to keep looked-up columns entirely virtual, and prove their value at the random point by duality, translating the lookup consistency to the Lagrange function (the eq).
eprint.iacr.org/2025/946

Long time ago, I played with same duality to prove the shift on the hypercube. But I did not realise how useful it is for lookups!

In a new blog post at decentralizedthoughts.github.io/2025-02-14-ver…, we present a method for verifying multi-exponentiations and multi-scalar multiplications (MSMs) to facilitate outsourcing these computations. This allows the prover to perform the computation typically done by the verifier.

I've enjoyed this excellent exposition of the recent progress in the combinatorial list-size bounds of Folded Reed Solomon codes and multiplicity codes by Garg, @prahladh , Kumar, Saptharishi, and Shankar. A fascinating read.

arxiv.org/pdf/2502.14358…

Delighted to share my new paper with Eylon Yogev presenting a new Fiat-Shamir (FS) transformation that aims to be secure against recent white-box attacks: ia.cr/2025/329

The FS transformation is used to convert public-coin interactive protocols to non-interactive ones.