On the X platform, discussions are currently underway regarding lattice-based cryptography and hash-based cryptography in blockchain design, featuring participants including Zcash co-founder Eli Ben Sasson, Ethereum co-founder Vitalik Buterin, and Delphi Labs’ Chief Legal Counsel Gabriel Shapiro.
This discussion began with a recent post by a16z crypto on X advocating for the adoption of lattice-based cryptography. In an explanatory article, a16z crypto outlined its reasoning, stating that Ethereum’s planned “hash-only” signature aggregation design relies on SNARK recursion, a method that introduces coordination overhead, a larger attack surface, and security properties that have not yet been sufficiently established.
In response to a16z crypto's post, Zcash co-founder Eli Ben Sasson explicitly objected, noting that lattice-based cryptography has "alluring mathematical structures" that make it highly vulnerable to AI attacks.
According to a16z crypto, relying solely on hash-based cryptography may seem more secure, but such designs could make the system more vulnerable. Gabriel Shapiro, General Counsel at Delphi Labs, who further participated in the discussion, also shared his perspective on X: “I believe that for Ethereum, Ethereum’s approach remains the best option here.” He disagrees with a16z crypto’s viewpoint.
Ethereum's Lean consensus roadmap includes: fully replacing BLS signatures with hash-based signatures (a variant of Winternitz) and using STARKs for aggregation. Shapiro suggested that if lattice-based cryptography is proven secure against AI, it could be incorporated via precompiles for accounts and wallets; he also added that hash-based cryptography would enable Ethereum to move at full speed.
Vitalik Buterin also joined the discussion and agreed with Shapiro’s view: “If lattice-based cryptography is proven secure against AI, we can still implement lattice-based schemes for accounts and wallets via precompilation.”
Buterin also added: “In my view, the ideal path to support the cryptography needed by everyone is through 8288. You can generate any signature you want locally, turn it into a STARK proof, and then include it via a STARK aggregator machine. No on-chain calldata is required. This way, Ethereum will never need to add new precompiles again.”
In response, Zcash co-founder Eli Ben Sasson said, "Agreed, this is the right path for Ethereum."
Ethereum is preparing for quantum resistance
Beyond Bitcoin, most major blockchains use proof-of-stake, enabling validators to vote on each block through signatures. The large number of validators is feasible due to signature aggregation. Ethereum uses BLS signatures, which have an algebraic structure that allows tens of thousands of validator signatures within each slot to be combined into a single group element.
However, although BLS is useful, it does not provide post-quantum security, as none of the currently known post-quantum signature schemes can be aggregated in this way.
Buterin explained earlier this year that, when outlining the quantum-resistant roadmap, the solution would involve recursive signature and proof aggregation at the protocol layer. He also discussed the introduction of native account abstraction via EIP-8141, a proposal that provides a framework abstraction for transaction validation, execution, and gas payment, enabling first-class accounts to use any signature algorithm.