Bitcoin Wizard 🧙‍♂️ Andrew Poelstra (andytoshi) of @blksresearch presents “rust-bitcoin: the road to 1.0” The chart represents “PRs per day” of activity on the library. He references other OGs around the repo since the early days, such as @stevenroose3

I'm glad to share that our book on zero-knowledge protocols now has a full chapter on post-quantum zero-knowledge proving systems with over 100 pages! It covers lattice-based Σ-protocols, LaBRADOR, and ZK-STARKs, with all the necessary prerequisites included. Link below 👇

Russel O'Connor, researcher at Blockstream Research (@blksresearch) during Bitcoin ++ Consensus Edition in Toronto. He talks to the Insider about SafeGDC, the new algorithm for modular inverse and how Bitcoin devs like Greg Maxwell, Pieter Wuille (@pwuille), and Peter Dettman implemented it in libsecp256k1 and how it was formally verified.

Adaptive attacks against FROST when number of signers and corruptions is large. BIP 445 (FROST) not affected because it requires fewer than 128 signers. This requirement in BIP 445 was added by @real_or_random exactly because there was uncertainty about the hardness of LDVR.

When he isn't busy proving the security of SHRINCS, Blockstream Research's @kudinov_mikhail reviews alternatives. Just 48 hours after publication, he identified 4 high/critical vulnerabilities in a hash-based signature candidate in Round 1 of China's next-gen standards program (ICCS).

gpg --verify SHA256SUMS.asc is easily bypassable for detached signatures. The correct command requires the data file: gpg --verify SHA256SUMS.asc SHA256SUMS This appears to be a common mistake. Without the second argument, gpg succeeds even if the .asc file contains an arbitrary embedded message rather than signing the actual SHA256SUMS file. It prints a warning, but it's easily missed in gpg's output. The gpg manpage explicitly discourages the single-argument form, keeping it only for backward compatibility. I actually keep a list of gpg pitfalls. This is number 8. Mehdi Kerimov reported this in nix-bitcoin's self-updater via @nixbitcoinorg's bounty program. We had originally followed verification instructions, which had the same issue and have since been fixed. That this sat unnoticed on @bitcoincoreorg since 2018 shows just how little-known this footgun is. It's unlikely bad signatures were ever published at scale, as anyone noticing the warning or using the two-argument command would have caught it immediately.

Glad to be part of our lattice-based cryptography team! :) If you've ever wanted to learn lattice-based signatures from scratch, make sure to read the paper. In addition to Dilithium, Falcon, and HAWK, we also described BLISS, the Gärtner scheme, and a recent attack on HAWK.

Happy to announce the first SimplicityHL smart contracts standard library release! The place for covenant patterns, math, crypto algorithms, data structures, and everything great that Simplicity can do.

If Bitcoin had to choose a lattice signature today, it would be Falcon-1024. @blksresearch has published a full report on Dilithium, Falcon and Hawk: what each costs on-chain, how hard each is to implement safely, and which assumptions you are trusting.

Lattice-based Signature Schemes for Bitcoin A self-contained review of three lattice-based signature schemes, with Bitcoin's post-quantum transition as the motivating application. Read the full paper at

Hash-based signatures on hardware wallets are feasible: @blksresearch benchmarks show that SHRINCS & SLH-DSA take less than 2 minutes. Future wallets could be optimized & faster. Code is open-source. Thanks to @BlockstreamJade @Ledger @satoshilabs @BitBoxSwiss for the help!

Standardized parameter sets for hash-based signatures weren’t chosen for Bitcoin. For a SHRINCS proposal, we can trade some of SLH-DSA's enormous signature budget for smaller signatures and cheaper verification. We searched 25,935 parameter sets and found a 5.7 kB candidate, 26% smaller. That trade-off reduces the signature budget from 2^64 to 2^40. In return, signing is 23% cheaper and verification 28% cheaper. Try the parameter explorer: Read the post: