- Buterin put the odds of public-key encryption disappearing entirely at below 10%.
- Buterin wants users to sign locally, prove it with a STARK and skip onchain data.
- Ben-Sasson told Ethereum to wait 3 to 5 years before trusting lattices with cash.
Ethereum co-founder Vitalik Buterin said on Monday that the network can support any signature scheme without ever adding another precompile, as a debate over lattice versus hash-based cryptography spread across X.
Starting Question
The thread began when Eli Ben-Sasson, a researcher at Starknet, asked what the world would look like if public-key encryption stopped working altogether. The scheme underpins online shopping, banking and most data people want kept private.
Buterin put the odds of that outcome below 10%. He said a more realistic risk is a “bigkey regime,” in which public-key systems survive but need objects as large as 2^30 to resist an attack of complexity 2^120. He added that P=NP would not necessarily end cryptography for the same reason.
Lattices or Hashes
The exchange then turned to which post-quantum approach Ethereum should adopt. Attorney and expert Gabriel Shapiro said commentary from a16z and Justin Drake had briefly made him doubt Ethereum’s roadmap.
After reviewing it as a non-mathematician, he concluded that hash-based cryptography lets Ethereum move quickly now. He said lattice-based accounts and wallets could follow later through a precompile, if they are shown to be secure against AI-assisted attacks. He also argued that rival networks such as LayerZero need a narrative edge and will push the lattice-versus-hash divide.
Ben-Sasson disagreed with the lattice option. He said lattices have rich mathematical structure that AI could attack, and that succinct versions based on module SIS date only from 2012. He recommended waiting three to five years before trusting serious money to them.
Buterin’s Answer
Buterin said a precompile is the wrong route. In his proposal, users create whichever signature they prefer locally, wrap it in a STARK proof, and submit it through the stark aggregator described in EIP-8288. No calldata goes onchain, and Ethereum would never need to add another precompile.
The argument was that precompiles and the EVM both act on data that must sit in a block as calldata. Space there is limited, with a practical ceiling of about 8 MB per second even with PeerDAS and blocks-in-blobs. This post described Ethereum as “a cryptographic world computer” and not just a blockchain.
Under that model, heavy self-contained computation is run and proven on the user’s device, which is getting faster even on phones, and sent through EIP-8288’s recursive aggregation. The chain sees only that the work was done and the result.
Related: Anthropic’s Claude Solves The NSA Elliptic Curve Mystery In 30 Minutes
Related: Vitalik Buterin Proposes Recursive STARKs for Ethereum’s I-Star Upgrade
Please note, this site provides content for entertainment purposes only and does not offer financial advice. Read more here