Tessera

Nico

@nmohnblatt.me

picious until proven otherwise. Cryptography research and auditing at zkSecurity. Recurring co-host on the ZKPodcast. nmohnblatt.me

57 Posts305 Follower 167 Folgt

ePrint Updates @eprint.ing.bot · 3mo ago

Extending FRIDA Beyond Unique Decoding for Free (Nicolas Mohnblatt, Benedikt Wagner) ia.cr/2026/1055

Abstract. Hall-Andersen, Simkin and Wagner (CiC 1:4) show how to construct data availability sampling schemes from code commitments. Later, in FRIDA (CRYPTO’24), the same authors describe a compiler that takes an interactive oracle proof of proximity (IOPP) for a code and produces a secure code commitment. Chaining both results allows to construct efficient data availability sampling schemes from IOPPs.

In this short note, we give a novel security analysis that extends the results of FRIDA beyond the unique decoding radius of the code being used. This strict improvement leads to data availability sampling schemes with smaller commitments.

Towards our novel analysis, we define a variant of the opening-consistency property introduced in FRIDA, which we name opening-consistency with assign. Crucially, our new property does not depend on the unique decoding radius of the code. We then show that the FRIDA compiler can be applied to IOPPs that have opening-consistency with assign to produce secure code commitments. Finally, we show that under mutual correlated agreement, the batched FRI protocol (FOCS’20) satisfies opening-consistency with assign. This latter result is enabled by a recent analysis of FRI by Garreta, Mohnblatt and Wagner (ePrint 2025/1993).

Nico @nmohnblatt.me · 6mo ago

Help, lattice folks what does this mean?

ePrint Updates@eprint.ing.bot · 6mo ago

Solving SIS in any norm via Gaussian sampling (Amaury Pouly, Yixin Shen) ia.cr/2026/225

Abstract. The short integer solution (SIS) problem is an important problem in lattice-based cryptography. In this paper, we construct a natural and simple algorithm that allows us to solve the problem for any norm in the case where the norm bound ℓ is smaller than half the modulus q. The algorithm consists in using a discrete gaussian sampler on the SIS q-ary lattice to sample lattice vectors, and requires to estimate the probabily that the sampled vector is non-zero and falls into a ball of radius ℓ in the given norm. For the latter, we improve upon previous analysis of random q-ary lattice by obtaining tight bounds on the expected value and variance of the Gaussian mass of the entire lattice and of an ℓ_(p)-norm ball, for any p ∈ (0, ∞]. These bounds require new technical results on the discrete Gaussian, but also rely on a conjecture which we have extensively verified. Aside from the conjecture, the remaining part of the algorithm is provably correct. When instantiated with a Markov chain Monte Carlo (MCMC)-based discrete Gaussian sampler, the complexity of the algorithm can be estimated precisely. Although our algorithm does not break Dilithium, it is at least 50 bits faster than the recent algorithm of Ducas, Engelberts and Loyer in Crypto 2025 for all security levels.

ePrint Updates @eprint.ing.bot · 6mo ago

Analysis and Vulnerabilities in zkLogin (Sofia Celi, Hamed Haddadi, Kyle Den Hartog) ia.cr/2026/227

Abstract. Zero-Knowledge Authorization (ZKA) systems allow users to prove possession of externally issued credentials (e.g., JSON Web Tokens) without revealing the credentials in full via the usage of Zero-Knowledge Proofs (ZKP). They are increasingly promoted as privacy-preserving and decentralized alternatives for authorization, and are already deployed in practice, with proposals for higher-stakes settings such as government access-control frameworks. In this work, we show that the security and privacy of zkLogin—the most widely deployed ZKA system—cannot only be reduced to the underlying ZKP. Instead, zkLogin critically depends on non-cryptographic assumptions about JWT/JSON parsing, issuer trust policy, architectural binding, and execution-environment integrity: none of which are specified or enforced as protocol-level properties.

Via an analysis of the public documentation, source code and surveys on wallets and public endpoints, we identify three broad classes of vulnerabilities in zkLogin: (i) permissive, non-canonical claim extraction that admits malformed JWTs; (ii) transformation of short-lived authentication artifacts into durable authorization credentials without enforcing their issuance context (issuer, audience, subject and temporal validity binding), which enables cross-application impersonation and misuse—particularly in browser-based deployments that expose system’s material; and (iii) systemic centralization and privacy risks arising from reliance on a small set of issuers and outsourced proving infrastructure, including disclosure of user identity attributes to third-party services without consent. We note that none of the vulnerabilities identified are cryptographic in nature. Overall, our findings demonstrate that zkLogin inherits, and in some cases amplifies, fragilities of web-based authentication ecosystems, and that the security of the system cannot be reduced only to the ZKPs

Nico @nmohnblatt.me · 6mo ago

On using LLMs for research (beyond basic prompts). Section 3.2 is specifically about catching a bug in a recent SNARG paper arxiv.org/abs/2602.03837

Accelerating Scientific Research with Gemini: Case Studies and Common Techniques

Recent advances in large language models (LLMs) have opened new avenues for accelerating scientific research. While models are increasingly capable of assisting with routine tasks, their ability to co...

arxiv.org

Nico @nmohnblatt.me · 7mo ago

Amazing work from Yoichi giving a Lean proof of my recent FRI security paper (w/ Albert Garreta and Benedikt Wagner) Super interesting workflow as well, combining TeX-to-Lean models with regular coding agents. I think we'll see a lot more of this moving forward!

Yoichi Hirai@pirapira.bsky.social · 7mo ago

I'm helping formal verification of arithmetic circuits (clean) and formalization of cryptography (round-by-round soundness of FRI). I want to connect these with implementations. round-by-round soundness of FRI: blog.zksecurity.xyz/posts/simple... clean: blog.zksecurity.xyz/posts/clean/

Nico @nmohnblatt.me · 8mo ago

Great short article from Moxie. Right in time for family dinners and questions about AI and privacy confer.to/blog/2025/12...

Confessions to a data lake

I’ve been building Confer: end-to-end encryption for AI chats. With Confer, your conversations are encrypted so that nobody else can see them. Confer can’t read them, train on them, or hand them over ...

confer.to

ePrint Updates @eprint.ing.bot · 8mo ago

Laminate: Succinct SIMD-Friendly Verifiable FHE (Kabir Peshawaria, Zeyu Liu, Ben Fisch, Eran Tromer) ia.cr/2025/2285

Abstract. In outsourcing computation to untrusted servers, one can cryptographically ensure privacy using Fully Homomorphic Encryption (FHE) or ensure integrity using Verifiable Computation (VC) such as SNARK proofs. While each is practical for some applications in isolation, efficiently composing FHE and VC into Verifiable Computing on Encrypted Data (VCoED) remains an open problem.

We introduce Laminate, the first practical method for adding integrity to BGV-style FHE, thereby achieving VCoED. Our approach combines the blind interactive proof framework with a tailored variant of the GKR proof system that avoids committing to intermediate computation states. We further introduce variants employing transcript packing and folding techniques. The resulting encrypted proofs are concretely succinct: 270kB, compared to 1TB in prior work, to evaluate a batch of B = 2¹⁴ instances of size n = 2²⁰ and depth d = 32. Asymptotically, the proof size and verifier work is O(dlog (Bn)), compared to Ω(BNlog n) in prior work (for ring dimension N).

Unlike prior schemes, Laminate utilizes the full SIMD capabilities of FHE for both the payload circuit evaluation and proof generation; adds only constant multiplicative depth on top of payload evaluation while performing Õ(n) FHE operations; eliminates the need for witness reduction; and is field-agnostic. The resulting cost of adding integrity to FHE, compared to assuming honest evaluation, is ∼ 12× to ∼ 36× overhead (for deep multiplication-heavy circuits of size 2²⁰), which is > 500× faster than the state-of-the-art.

Nico @nmohnblatt.me · 10mo ago

Also wrote a blog post that explains the proof in a shorter format and with less formality blog.zksecurity.xyz/posts/fri-se...

Why does FRI work?

This blog post explains the security intuition behind the FRI protocol, which proves that a function is close to a valid Reed-Solomon codeword. It introduces the “prover message graph,” a layered stru...

blog.zksecurity.xyz

ePrint Updates@eprint.ing.bot · 10mo ago

A Simplified Round-by-round Soundness Proof of FRI (Albert Garreta, Nicolas Mohnblatt, Benedikt Wagner) ia.cr/2025/1993

Abstract. The FRI protocol (ICALP ’18) is one of the most influential and widely deployed building blocks at the core of modern SNARK systems. While its concrete security is well understood, existing security proofs are intricate and technically complex.

In this work, we present a significantly simpler security analysis of FRI, in particular its round-by-round soundness. Our approach is more accessible to a broader audience, lowering the barrier to understanding this fundamental protocol. Furthermore, the simplicity of our analysis may pave the way for future formal verification efforts of modern SNARK constructions.

Nico @nmohnblatt.me · 10mo ago

Trying to reduce some headaches!

ePrint Updates@eprint.ing.bot · 10mo ago

A Simplified Round-by-round Soundness Proof of FRI (Albert Garreta, Nicolas Mohnblatt, Benedikt Wagner) ia.cr/2025/1993

ZK Hack @zkhack.dev · 12mo ago

It’s time to reveal the ZK Whiteboard S3 Module 1... because it's LIVE! 🥁🥁🥁🥁 How to Build Hash Functions, with Jean-Philippe (JP) Aumasson @aumasson.jp & @nicomnbl.bsky.social Watch the full module here: zkhack.dev/whiteboard/s...

NiixARTs @niixarts.bsky.social · last yr.

Time has changed

ZK Hack @zkhack.dev · last yr.

The ZK Podcast released an episode on local-first software this week! @arro.bsky.social and @nicomnbl.bsky.social chat w @grjte.sh & @goblinoats.com about the foundations of local-first architecture, CRDTs and how ZK can be incorporated into these models. zeroknowledge.fm/podcast/367/

Local-First with grjte and Goblin Oats - ZK PODCAST

In this episode, Anna Rose and Nico Mohnblatt speak with Goblin Oats from Tonk and grjte from Bain Capital Crypto […]

zeroknowledge.fm

weijie @kohweijie.com · last yr.

2/ As such, I wrote a research note to help cryptography engineers fully understand both techniques: baincapitalcrypto.com/a-deep-dive-...

A Deep Dive into Logjumps: a Faster Modular Reduction Algorithm

Logjumps is a recently discovered technique for modular reduction over large prime fields.

baincapitalcrypto.com

Christian Knabenhans @cknabs.bsky.social · last yr.

I'm happy to finally open-source lattirust, a library for lattice-based zero-knowledge/succinct arguments! Lattirust is somewhat like arkworks, but for lattices; and like lattigo, but for arguments. ➔ github.com/lattirust

lattirust

Lattice zero-knowledge/succinct arguments, and more - lattirust

github.com

Nico @nmohnblatt.me · last yr.

I wrote a thing on my colleagues Andrija and Guille's latest work

ZK Hack@zkhack.dev · last yr.

In this article, @nicomnbl.bsky.social compares Ligerito and WHIR, explaining their similarities, the main differences, and what we can learn from them. nmohnblatt.github.io/ligerito-and...

Nico @nmohnblatt.me · last yr.

Story of the ZK whiteboard series S2! The grant that supported it, how we came up with the topics, participation of our esteemed speakers, some crazy editing and how the bonus modules came to be

ZK Hack@zkhack.dev · last yr.

🎬 ZKWS S2: The Full Journey 🎬 How did the second season of ZK Whiteboard Sessions come to life – a thread. TLDR: Check out the 8-module series on YouTube (link in bio), and the "FRI edition" Study Group starting on Tuesday March 4 on ZK Hack Discord (link in bio)! 🧵👇

Nico @nmohnblatt.me · last yr.

from the archive: Or Sattath came on the ZKPodcast to discuss quantum computing and its impact on cryptography. These two are some of my 𝐟𝐚𝐯𝐨𝐮𝐫𝐢𝐭𝐞 episodes of the show. Part 1 covers the computation model, why it breaks some cryptography and effects on mining zeroknowledge.fm/podcast/288/ 1/2

Nico @nmohnblatt.me · last yr.

A step towards fixing the recent attack on a Fiat-Shamir'd variant of GKR. Tl;dr: do proof-of-work before deriving the FS challenge, this will make the hash prohibitively expensive to compute in-circuit. Caveat: they only prove the security of their transform for 1-round protocols

ePrint Updates@eprint.ing.bot · last yr.

Towards a White-Box Secure Fiat-Shamir Transformation (Gal Arnon, Eylon Yogev) ia.cr/2025/329

Abstract. The Fiat–Shamir transformation is a fundamental cryptographic technique widely used to convert public-coin interactive protocols into non-interactive ones. This transformation is crucial in both theoretical and practical applications, particularly in the construction of succinct non-interactive arguments (SNARKs). While its security is well-established in the random oracle model, practical implementations replace the random oracle with a concrete hash function, where security is merely assumed to carry over.

A growing body of work has given theoretical examples of protocols that remain secure under the Fiat–Shamir transformation in the random oracle model but become insecure when instantiated with any white-box implementation of the hash function. Recent research has shown how these attacks can be applied to natural cryptographic schemes, including real-world systems. These attacks rely on a general diagonalization technique, where the protocol exploits its access to the white-box implementation of the hash function. These attacks cast serious doubt on the security of cryptographic systems deployed in practice today, leaving their soundness uncertain.

We propose a new Fiat–Shamir transformation (XFS) that aims to defend against broad family of attacks, including the white-box attacks mentioned above. Our approach is designed to be practical, with minimal impact on the efficiency of the prover and verifier and on the proof length. At a high level, our transformation combines the standard Fiat–Shamir technique with a new type of proof-of-work that we construct.

We provide strong evidence for the security of our transformation by proving its security in a relativized random oracle model. Specifically, we show that diagonalization attacks on the standard Fiat–Shamir transformation can be mapped to analogous attacks within this model, meaning they do not rely on a concrete instantiation of the random oracle. In contrast, we prove unconditionally that our XFS variant of the Fiat–Shamir transformation remains secure within this model. Consequently, any successful attack on XFS must deviate from known techniques and exploit aspects not captured by our model.

We hope that our transformation will help preserve the security of systems relying on the Fiat–Shamir transformation.

Nico @nmohnblatt.me · last yr.

sigh

Nico @nmohnblatt.me · last yr.

Terrible news

Matthew Green@matthewdgreen.bsky.social · last yr.

New public statement from Apple: “As of Friday, February 21, Apple can no longer offer Advanced Data Protection as a feature to new users in the UK.”

Nico @nmohnblatt.me · last yr.

Sublinear prover?!?! Incredible result!

ePrint Updates@eprint.ing.bot · last yr.

On the Power of Polynomial Preprocessing: Proving Computations in Sublinear Time, and More (Matteo Campanelli, Mario Carrillo, Ignacio Cascudo, Dario Fiore, Danilo Francati, Rosario Gennaro) ia.cr/2025/238

Abstract. Cryptographic proof systems enable a verifier to be convinced of of a computation’s correctness without re-executing it; common efficiency requirements include both succinct proofs and fast verification. In this work we put forth the general study of cryptographic proof systems with sublinear proving time (after a preprocessing). Prior work has achieved sublinear proving only for limited computational settings (e.g., vector commitments and lookup arguments), relying on specific assumptions or through non-black-box use of cryptographic primitives. In this work we lift many of these limitations through the systematic study of a specific object: polynomial commitments (PC) with sublinear proving time, a choice motivated by the crucial role that PC play in the design of efficient cryptographic schemes.
Our main result is a simple construction of a PC with sublinear prover based on any vector commitment scheme (VC) and any preprocessing technique for fast polynomial evaluation. We prove that this PC satisfies evaluation binding, which is the standard security notion for PC, and show how to expand our construction to achieve the stronger notion of knowledge soundness (extractability). The first application of our result is a construction of “index-efficient” SNARKs meaning that the prover is sublinear, after preprocessing, in the size of the index (i.e., the NP-relation describing the proven statement). Our main technical contribution is a method to transform a class of standard Polynomial Interactive Oracle Proofs (PIOPs) into index-efficient PIOPs. Our construction of index-efficient SNARKs makes black-box use of such index-efficient PIOPs and a PC with sublinear prover. As a corollary, this yields the first lookup argument for unstructured tables in which the prover is sublinear in the size of the table, while making only black-box use of a VC and thus allowing instantiations from generic assumptions such as collision-resistant hash functions. Prior lookup arguments with sublinear provers were only known with non-black-box use of cryptographic primitives, or from pairings. Finally, our last application is a transformation that builds UC-secure SNARKs from simulation-extractable ones, with an approximately linear overhead in proving time (as opposed to quadratic in prior work).

Matthew Green @matthewdgreen.bsky.social · 2y ago

Look folks. I want BlueSky to succeed, because we need an alternative to X. I also know this is an insane time. But if we want to create a usable alternative, people are going to have to start posting occasionally about something else.

Nico @nmohnblatt.me · 2y ago

These two lectures by @danboneh.bsky.social for @zkhack.bsky.social are the best explanation of IOPPs, FRI and its variants by a country mile. Cannot recommend them enough zkhack.dev/whiteboard/s... zkhack.dev/whiteboard/s...

Nico @nmohnblatt.me · 2y ago

programmable* cryptography * programming difficulty may vary, developer discretion is advised.

weijie @kohweijie.com · 2y ago

Want to send crypto to Bluesky users? It's possible! Their keypairs are for the secp256k1 curve, which Ethereum also uses. That means you can derive an ETH address from their publicly accessible signing keys.

Nico @nmohnblatt.me · 2y ago

oh hello @zkhack.bsky.social 👀👀

Nico @nmohnblatt.me · 2y ago

Straight to the reading list!

ePrint Updates@eprint.ing.bot · 2y ago

How to use your brain for cryptography without trustworthy machines (Wakaha Ogata, Toi Tomita, Kenta Takahashi, Masakatsu Nishigaki) ia.cr/2025/026

Abstract. In this work, we study cryptosystems that can be executed securely without fully trusting all machines, but only trusting the user’s brain. This paper focuses on signature scheme. We first introduce a new concept called “server-aided in-brain signature,’’ which is a cryptographic protocol between a human brain and multiple servers to sign a message securely even if the user’s device and servers are not completely trusted. Second, we propose a concrete scheme that is secure against mobile hackers in servers and malware infecting user’s devices.

ePrint Updates @eprint.ing.bot · 2y ago

ZODA: Zero-Overhead Data Availability (Alex Evans, Nicolas Mohnblatt, Guillermo Angeris) ia.cr/2025/034

Abstract. We introduce ZODA, short for ‘zero-overhead data availability,’ which is a protocol for proving that symbols received from an encoding (for tensor codes) were correctly constructed. ZODA has optimal overhead for both the encoder and the samplers. Concretely, the ZODA scheme incurs essentially no incremental costs (in either computation or size) beyond those of the tensor encoding itself. In particular, we show that a slight modification to the encoding scheme for tensor codes allows sampled rows and columns of this modified encoding to become proofs of their own correctness. When used as part of a data availability sampling protocol, both encoders (who encode some data using a tensor code with some slight modifications) and samplers (who sample symbols from the purported encoding and verify that these samples are correctly encoded) incur no incremental communication costs and only small additional computational costs over having done the original tensor encoding. ZODA additionally requires no trusted setup and is plausibly post-quantum secure.

Nico @nmohnblatt.me · 2y ago

mobile proving ftw

PPratyush Mishra@pratyush.zip · 2y ago

Excited to share our new work, Scribe! Scribe is a new low-memory SNARK that is able to prove arbitrarily-large circuits while using minimal memory. Joint work with my excellent student coauthors Anubhav, Tushar, Karan, and Steve. (1/4) Link: eprint.iacr.org/2024/1970

Title of the paper: Scribe: Low-memory SNARKs via Read-Write Streaming

Nico @nmohnblatt.me · 2y ago

if someone tells you “succinct proofs are too short to leak information about the witness”, please send them this. The ZK property is not just a cool acronym. baincapitalcrypto.com/chosen-insta... This was also the theme of the "Zeitgeist" puzzle at ZK Hack 5!