founder @commonwarexyz || previously @avalabs @coinbase @stanford || opinions are my own and will probably change
- Tweets 5,424
- Following 1,384
- Followers 23,483
- Likes 6,857
You were right @zooko ... when optimized/better integrated, blake3 is much faster than sha256 on AVX 👀
BTW, I'll bet a properly optimised BLAKE3 impl would take about 2/3 as much time as a properly optimised SHA256 impl for this use case, on AVX512. :-)
3
2
29
3,095
Source:
github.com/commonwarexyz/mon…
6
198
patrickogrady.xyz retweeted
Very interesting work by @guruvamsip @commonwarexyz to obtain Batch decryption using pairings + high school algebra:
1. Each client chooses a random k_i, encrypts their message under k_i^2 and the validator's pk in the target group. Each client also provides pk.k_i^2, and k_i in group 1 and group 2.
2. The validators decrypt the sum of all the encrypted k_i's (denote it as K) by sending a single decryption share.
3. Given the decryption of K^2 as pk.K^2 one can compute the individual pk.k_i^2 as follows:
(Ignore the pk for now)
K^2 =(k_1 + k_2 + k_3)^2 = k_1^2 + k_2^2 + k_3^2 + cross terms.
(This omits a lot of crucial details for simplicity)
Suppose you want to decrypt the message under k_i^2 using K^2:
1. The cross terms can be removed by combining k_i in g_1 and k_j in g_2 (and vice versa) using pairings for all j!=i. This allows to remove the cross terms.
2. Then the individual pk.k_j^2 can be removed by using the client-provided material.
The brilliance lies in figuring out the optimal amount of information to put into the ciphertext, which allows the cross-term removal (using pairings) while preventing an adversary from decrypting the client ciphertexts without the decryption of the sum K.
Kudos on the great work!
It turns out all you need to deploy an encrypted mempool (via Batched Threshold Encryption) is an off-the shelf DKG. No CRS required.
Ciphertext overhead is 2G1 + G2 + 2F and partial decryptions are a single G1 element. Decryption runs in O(B log^2 B) time.
2
9
31
2,096
patrickogrady.xyz retweeted
We dive into some of the lore behind SNARKs, sumcheck, and Jolt
Thanks @_patrickogrady for having us on!
How Things Work #7: Jolt and The Return of Sumcheck
Today, we trace the once infeasible idea of verifiable compute from 1980s theory to Jolt, @a16zcrypto's sumcheck-based zkVM, with @SuccinctJT and @moodlezoup.
TL;DW can going post-quantum actually make a zkVM faster?
1
4
14
825
patrickogrady.xyz retweeted
hahahaha i love that you open with "i met justin and he was like SUMCHECK"
1
1
4
327
If you only know zkVMs by buzzword, this new podcast with @SuccinctJT and @moodlezoup from @a16zcrypto is for you.
We cover how verifiable computing evolved from a tool to keep remote poker players honest (original proposal in the 1980s) to the blockchain scaling hero of 2026+.
How Things Work #7: Jolt and The Return of Sumcheck
Today, we trace the once infeasible idea of verifiable compute from 1980s theory to Jolt, @a16zcrypto's sumcheck-based zkVM, with @SuccinctJT and @moodlezoup.
TL;DW can going post-quantum actually make a zkVM faster?
3
5
44
2,730
patrickogrady.xyz retweeted
update: i was wrong. you can have it all
nitter.net/_patrickogrady/status/…
Existing batched threshold encryption constructions (powers encrypted mempools) force you to pick your poison: epoch restrictions, censorship issues, or a complicated setup.
With @guruvamsip's recent work, you can now pick a digestible dose of each:
commonware.xyz/blogs/pick-yo…
1
1
28
1,821
patrickogrady.xyz retweeted
I think we are up to 5 papers this week? how many more are coming?
It turns out all you need to deploy an encrypted mempool (via Batched Threshold Encryption) is an off-the shelf DKG. No CRS required.
Ciphertext overhead is 2G1 + G2 + 2F and partial decryptions are a single G1 element. Decryption runs in O(B log^2 B) time.
5
1
36
3,713
patrickogrady.xyz retweeted
@guruvamsip on a roll!
It turns out all you need to deploy an encrypted mempool (via Batched Threshold Encryption) is an off-the shelf DKG. No CRS required.
Ciphertext overhead is 2G1 + G2 + 2F and partial decryptions are a single G1 element. Decryption runs in O(B log^2 B) time.
4
1
10
672
patrickogrady.xyz retweeted
no more excuses. encrypt the mempool.
It turns out all you need to deploy an encrypted mempool (via Batched Threshold Encryption) is an off-the shelf DKG. No CRS required.
Ciphertext overhead is 2G1 + G2 + 2F and partial decryptions are a single G1 element. Decryption runs in O(B log^2 B) time.
6
4
57
3,774
It turns out all you need to deploy an encrypted mempool (via Batched Threshold Encryption) is an off-the shelf DKG. No CRS required.
Ciphertext overhead is 2G1 + G2 + 2F and partial decryptions are a single G1 element. Decryption runs in O(B log^2 B) time.
10
15
95
14,245
Read @guruvamsip's latest here (in the ePrint queue):
commonware.xyz/artifacts/dkg…
1
2
9
614
Have wanted this for years, super smooth UX. Awesome work from the @tempo team 👏
To make Mercator work, we FINALLY solved the onramp problem.
Mercator is powered by a state of the art onramp which lets you buy credits with Apple Pay with any card your heart wishes. We are EXTREMELY proud of this and we think it's a game changer for stablecoin experiences.
You also get $5 free if you're down to connect your Github or X.
Learn more about MACH: mercator.sh/docs#mach.
2
15
2,336
Simplex now spends ~35-85% less time verifying votes by optimistically assembling certificates (via @cronokirby):
github.com/commonwarexyz/mon…
4
26
2,069
Learn more about how @commonwarexyz minimizes consensus overhead with authenticated connections and buffered signatures:
commonware.xyz/blogs/buffere…
1
14
534
patrickogrady.xyz retweeted
fun story: ~3y ago when we first constructed STE, we thought we also had a weighted construction but it turned out to be broken
everyone would always ask: but what about weights? (cc @MaxResnick among many others)
i'd hoped to solve it and add it to my thesis but just never managed to dedicate the time. nor did I have a magical stroke of genius lol
but thanks to ai and all the other great researchers whose work helped me understand the problem much better, i finally managed to get (some?) closure
many more open questions, but this was a personal favorite
and of course, many thanks to @_patrickogrady and @commonwarexyz for their unwavering support and encouragement
Today, I'm excited to share @commonwarexyz's new SOTA result on weighted threshold encryption with silent setup.
For the first time, the CRS size and public key of each party is O(W) group elements (where W bounds the total committee weight).
7
46
3,021
Not to mention, committee members, weight assignments, and decryption thresholds can be chosen dynamically at the time of encryption. 👀
1
5
366
Read more on ePrint (courtesy of @guruvamsip):
eprint.iacr.org/2026/2148
5
238