PQ Transaction Signatures #017
Transcript
- Wilson
hi
- Daniel Cason
Are you sharing the recording of this call later?
- Antonio Sanso
Reacted to "Are you sharing the recording of this call later?" with 👍
- Antonio Sanso
yes
- Dragos Rotaru
Reacted to "yes" with 👍
- Justin Drake
@Emile: Is sphincs.art using average- or worst-case permutations?
- Antonio Sanso
I think average
- Tom Wambsgans
it's constant: wirst case = average case
- Justin Drake
Reacted to "it's constant: wirst case = average case" with ❤️
- Tom Wambsgans
because it's WOTS+C (and not WOTS with checksum)
- Justin Drake
Reacted to "because it's WOTS+C (and not WOTS with checksum)" with ❤️
- Antonio Sanso
Reacted to "because it's WOTS+C (and not WOTS with checksum)" with ❤️
- Gottfried Herold
Is the https://conduition.io/cryptography/hypertree-pruning/ link (explanation of pruning) from sphincs.art working for you?
- Nico laptop
Replying to "Is the https://con..." It doesn't
- daveproxy80
Reacted to "Is the https://conduition.io/cryptography/hypertree-pruning/ link (explanation of pruning) from sphincs.art working for you?" with 👎
- daveproxy80
Reacted to "because it's WOTS+C (and not WOTS with checksum)" with ❤️
- Daniel Cason
In Circle, we have hot wallets that sign 30,000-70,000 per day.
- sim
Tom Wambsgans: the MPC construction has two variants for the PRF. Which one did you use?
- Daniel Cason
For how long can we use the same key?
- Kamil Salakhiev
Reacted to "In Circle, we have hot wallets that sign 30,000-70,000 per day." with 👀
- Nico laptop
These are scripts @Daniel Cason you can automate the rotation inside right ?
- Daniel Cason
Replying to "In Circle, we have h..." So, lets say 2^16, 2^17.
- ooooooo [No longer OKX]
Reacted to "In Circle, we have hot wallets that sign 30,000-70,000 per day." with 👆
- Tom Wambsgans
Replying to "Tom Wambsgans: the M..." Both are possible, it shouldnt change perf I think
- Nico laptop
Replying to "In Circle, we have..." these are hot signers right ? would adding a rotation at 2^19 be a problem ? probably half a sec every few days
- Daniel Cason
Yes, but are you considering at least one stateless option with unlimited signing?
- sim
Reacted to "In Circle, we have..." with 👀
- Antonio Sanso
Replying to "Yes, but are you con..." Real stateless doesn’t exist 🙂 (so far)
- Antonio Sanso
Replying to "Yes, but are you con..." SPHINCS is 2^64
- Matteo Vena
Replying to "For how long can we ..." At 30K, maybe 1.5 years or more
- ooooooo [No longer OKX]
Can confirm what Daniel says. Many institutions hit this amount
- sim
There are stateless solutions: lattice based signatures :-)
- Antonio Sanso
Was talking about hash based signature
- sim
Reacted to "Was talking about ..." with 👍
- ooooooo [No longer OKX]
Ideally key rotation should match NIST key recommendation periods
- Matteo Vena
The question imho is more like, is key rotation more or less important than using the standard verifier (meaning more privacy)?
- pbark
At those kinds of rates couldn't you bulk transactions together? (with frames)
- Daniel Cason
Precompiles or not?
- Matteo Vena
No precompiles in the design
- Antonio Sanso
Reacted to "Ideally key rotation should match NIST key recommendation periods" with 👍
- Daniel Cason
We would really like to have it as a precompile so it can be a pure function...
- Antonio Sanso
Replying to "We would really like..." What exactly ?
- Daniel Cason
Reacted to "Ideally key rotation should match NIST key recommendation periods" with 👍
- Daniel Cason
Replying to "Ideally key rotation..." This means, 1-3 years, right?
- Daniel Cason
Replying to "We would really like..." For SPHINCS signatures
- ooooooo
Reacted to "This means, 1-3 years, right?" with 👍
- Nico
Big number = pruning
- Daniel Cason
Sure, next meeting we are attending with more info, thanks 🙂
- Wolfgang Vitale
btw 2^40 on SHRINCS stateless path is that high because they are considering also offchain protocols e.g. high volume Lightning nodes
- Antonio Sanso
Reacted to "btw 2^40 on SHRINCS stateless path is that high because they are considering also offchain protocols e.g. high volume Lightning nodes" with 👍
- Antonio Sanso
Reacted to "Sure, next meeting we are attending with more info, thanks 🙂" with 🙏
- ooooooo
Reacted to "btw 2^40 on SHRINCS stateless path is that high because they are considering also offchain protocols e.g. high volume Lightning nodes" with 👍
- Nick (Safe)
THanks bye!
Call summary
Targets
- •Updated lean SPHINCS parameters deployed to testnet — within two weeks - 01:13:41
Decisions
- •Adopt sphincs.art parameter set (broadly equivalent to Project 11 proposal) for next testnet upgrade; lifetime left open pending offline discussion — starting conservatively high (2^30–2^32) until field data clarifies rotation needs - 01:05:03
Highlights
- Testnet Update:
- ·Testnet v03 launched on Daisugi (with Nethermind): single tx with STARK proof of 20 SPHINCS signatures under EIP-8288 - 00:17:58
- ·Post-DevCon testnet planned with EthPandaOps spam tooling for better benchmarks - 00:18:28
- Sphincs Parameter Proposals:
- ·sphincs.art tool presented: explores SPHINCS parameter trade-offs (lifetime, shape, hash, FTS type) for lean SPHINCS - 00:19:05
- ·Default lifetime on sphincs.art is 2^30 (~1B signatures); reducing to 2^24 cuts size but raises key-rotation frequency - 00:20:19
- ·Pruning improves keygen speed but leaks privacy after ~75 signatures; partial fix requires semi-trusted state, yields ~2,000 private sigs on Ledger - 00:23:44
- ·Forest-of-WOTS (Vitale FTS from Sea Golf/Blockstream) gives >30% signing speedup but is novel, less MPC-friendly, and needs standard-model security proof - 00:25:43
- ·Project 11 proposes two parameter sets: both use WOTS/WOTS+C, CAIC hash, lifetime 2^24; optimized for hardware wallets and MPC (SPHINCS G variant) - 00:40:52
- Lifetime And Key Rotation Debate:
- ·Bitcoin SPHINCS (Shrinks) currently at 2^40; Mikhail Kridinov open to lower values; Justin Drake advocates cross-chain alignment - 00:49:10
- ·Circle hot wallets sign 30K–70K tx/day (~2^16–2^17); at 2^24 lifetime that is ~1.5 years before rotation - 00:57:25
- ·Nico: surveyed 5 major exchanges — all said key rotation is trivially automatable; anything above 2^22–2^23 is sufficient - 01:02:09
- ·Justin Drake argues for higher lifetime (2^30): easier UX communication, alignment with Bitcoin/Zcash, and room to reduce later - 01:12:31
- ·Chat note: Bitcoin 2^40 accounts for off-chain protocols (e.g., high-volume Lightning nodes), not just on-chain use - 01:15:38
- Mpc And Hardware Wallet Constraints:
- ·WOTS forest is structurally worse for MPC (nearly 100% secret hashes vs ~50% for FORS); not just a compute-power problem - 00:55:13
- ·Project 11: 2^24→2^32 lifetime difference is make-or-break for SPHINCS G on Ledger; MPC is unaffected up to ~2^28 - 01:06:40
- ·Justin Drake: proof-of-grinding via SNARK (host offloads grinding to laptop, proves correctness) expected to improve ~10x in ~12 months - 01:15:50
Action Items
- •Daniel Cason / Circle - Circle (Daniel) to report internally on key-rotation feasibility and return with findings next call - 00:53:29
- •Tom Wambsgans (Emil) - Emil to add 2^24 lifetime toggle to sphincs.art so parameter sets can be compared directly - 01:05:33
Key decisions
Adopt sphincs.art parameter set (broadly equivalent to Project 11 proposal) for next testnet upgrade; lifetime left open pending offline discussion — starting conservatively high (2^30–2^32) until field data clarifies rotation needs
The group decided to use the sphincs.art parameters for the next testnet, choosing a higher initial lifetime for signatures to align with Bitcoin/Zcash and simplify UX until more data on key rotation is available.
AI Disclaimer: Some content or metadata on EIPsInsight may be AI-inferred or automatically compiled. If you find any discrepancy, please contact us at dev@avarch.org.