ZK STARK is the best way to address the challenges of ensuring Bitcoin’s quantum security – and at the same time achieve mass adoption, says StarkWare co-founder Eli Ben-Sasson.
What’s more, he says Blockstream founder Adam Back agrees.
This week, Ben-Sasson was in the news for his controversial suggestion for X to augment Bitcoin inflation to 4% per year. Grok’s analysis of the responses found “zero clear support for the proposal.”
But as a co-creator of STARK – quantum-secure, hash-based zero-knowledge proofs – he’s on much firmer ground, with some leading Bitcoin researchers supporting the concept.
Last week, Ben-Sasson’s own project, Starknet, announced its own three-phase project aimed at ensuring quantum security.
The problem of enormous PQ signatures on Bitcoin
Adding zero-knowledge proofs to Bitcoin will not in itself make the blockchain secure. ZK proofs are a way to deal with the problems caused by adding much larger post-quantum (PQ) signature schemes to Bitcoin.
The current set of National Institute of Standards and Technology (NIST)-approved PQ signatures is 10 to 100 times larger than Bitcoin’s existing ECDSA and Schnorr signature schemes.
Some say this could sluggish the blockchain to less than 1 transaction per second. But all enormous transaction signatures for a block can be compressed into a miniature ZK STARK proof. Since the proof would be much smaller than even considering existing signatures, the blockchain can run faster.
“If they don’t allow ZK STARK aggregation, that’s certainly going to be a very unfortunate move because it doesn’t really solve the problem… where the issue is can anyone actually use Bitcoin?” – said Ben-Sasson.
“So for this you need a huge scale. For this you need things like signature aggregation and just increasing the block size is not enough.”
Related: StarkWare CEO Suggests 4% Annual Bitcoin Inflation to Replace 21M Cap
Quantum alternative: augment Bitcoin block size
Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, told Cointelegraph that Bitcoin’s SegWit scheme reduced the impact of enormous signatures by up to 75%. But his modeling of NIST’s ML-DSA-44 scheme, which has 2,420 bytes per signature, “puts block capacity at around 500 to 700 transactions, up from the current 2,500 to 3,000. This is where the block size debate comes in.”
Increasing Bitcoin’s block size is a real alternative, but the community has split over the 2017 proposal to double the block size. Many of the arguments against it remain because it is an obtuse solution that requires each node to move, store and verify much more data. It’s more pricey and requires more hardware, which critics say pushes the network toward centralization.
In recent months, Blockstream Research has been experimenting with size compression of hash-based post-quantum signature schemes for employ with Bitcoin. Promising SHRINCS and SHRIMPS programs have been developed that have daily signatures about five times larger than current Bitcoins, but up to 40 times larger if you lose your wallet and need to resurrect it.
While SHRINCS has been used to sign actual transactions on the Liquid sidechain, its development is in its early stages and there are drawbacks in terms of complexity and usability. Much larger signatures would also sluggish down the blockchain unless the block size was increased.
“Native performance enhancement is the simple engineering answer and the hardest management answer,” said Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, about increasing the block size. “We simply don’t have time for these debates.”
Aggregating ZK evidence has advantages
growth, but would likely be much better at maintaining decentralization while increasing Bitcoin’s performance.
In its simplest form, ZK proofs are a way of mathematically proving that something exists, without having to provide all the details. For example, ZK evidence may show that you know the combination to a safe and sound without telling the other person what it is.
Technically, generating a ZK proof for a single block only needs to be done once (although it’s safer to generate additional backups for redundancy), and the hardware required to do this looks to be much cheaper than a commercial mining setup.
Ethereum’s Lean specifications are designed to validate hardware that costs under $100,000 (and can be run from a regular home). Meanwhile, ZK verification can be performed on almost any hardware, including Raspberry Pi.
Ben-Sasson said that early Bitcoin creators such as Greg Maxwell and Mike Hearn were “very bullish on ZK STARK, which is post-quantum secure and has no trusted configuration” and that he believes Bitcoin Core developer Luke Dashjr and Blockstream founder Adam Back will take up the idea.
“I’ve heard this from them myself. They are optimistic about issues related to ZK STARK and its use. I think each of them spoke well, definitely privately, but also publicly, in favor. Adam Back and Luke Dashjr don’t quite see everything eye to eye, but I think on this point they actually agree that it is a great technology that, under the right conditions, could be used in Bitcoin.”
Cointelegraph reached out to Back for comment but has not received a response.
Ethereum researcher Justin Drake has spoken publicly about his desire for Bitcoin to adopt Lean Ethereum’s ZK proof aggregation technology so that it becomes an industry-wide standard. This may not be feasible for political reasons.
By 2029, Ethereum is expected to become post-quantum. Source: Ethereum Foundation
Bitcoin-specific ZK proposals
Given Bitcoin’s conservative culture, the most politically pragmatic way to add ZK to Bitcoin would probably be to re-enable OP_CAT, which is the nine lines of code written by Satoshi.
“[He] he even introduced it and then removed it,” Ben-Sasson said. “And if you add that up, you can get things like STARK evidence and then aggregation and post-quantum security.”
“I think this is the best and safest solution and it will really, really just start over again this journey that Satoshi really started and wanted.”
However, despite the huge interest OP_CAT approximately 12 to 24 months ago, it seems to have lost momentum recently (although Bitcoin governance is changing in mysterious ways).
There are also more speculative proposals, including: OP_STARK_VERIFYwhich would add opcodes specifically designed for more effective STARK verification on Bitcoin. BIP-360 co-author Ethan Heilman proposed aggregating Bitcoin signatures and public keys into a single STARK proof under the name BitZip.
Earlier this year, Heilman told Cointelegraph that there are two main ways to achieve the desired result:
“Either add a few general-purpose instructions to Bitcoin and then build something like ZKRollup in Bitcoin, or support STARK in the Bitcoin consensus layer. Alternatively, you can employ other, less capable aggregation schemes such as CISA [Cross Input Signature Aggregation] may facilitate here too.
But what are the chances?
Ivezic says the most significant point of contention is Bitcoin’s governance, not its technological capabilities.
“Elie’s cryptography is solid: assumptions based solely on hashes, no trusted settings, thousands of signatures compressed into one small proof. The problem lies in everything about cryptography,” he says.
“A Bitcoin script cannot verify STARK today, and a production verifier is a huge consensus surface compared to a narrow hash signature opcode. Given that a small opcode like OP_CAT has been discussed for years, a base layer STARK verifier is realistically a conversation from the 2030s.”
Meanwhile, Ethereum is targeting 2029 for a post-quantum transition, and Solana is also experimenting with adding post-quantum signatures. StarkNet’s three-phase transition will benefit from account abstraction, which allows the underlying cryptography to be updated without having to manually move each user to up-to-date accounts.
As a result, Ben-Sasson said that Solana and Ethereum’s post-quantum roadmap will be “extremely difficult.”
“At Starknet we have the great advantage that we already have native account abstraction and smart wallets, which means nothing is written down, so it’s very easy to update wallets and infrastructure to be post-quant.”
Features: The biggest improvements to the blockchain will not appear until 2026
