Pinned Tweet
Welcome, @tempo
Today, we're thrilled to share that Tempo is building with the @commonwarexyz Library, supporting our growth as a new core contributor, and accelerating our research and engineering with a strategic investment.
commonware.xyz/blogs/welcome…
21
2
180
33,194
How Things Work #7: Jolt and The Return of Sumcheck
Today, we trace the once infeasible idea of verifiable compute from 1980s theory to Jolt, @a16zcrypto's sumcheck-based zkVM, with @SuccinctJT and @moodlezoup.
TL;DW can going post-quantum actually make a zkVM faster?
3
8
33
4,139
commonware retweeted
We dive into some of the lore behind SNARKs, sumcheck, and Jolt
Thanks @_patrickogrady for having us on!
How Things Work #7: Jolt and The Return of Sumcheck
Today, we trace the once infeasible idea of verifiable compute from 1980s theory to Jolt, @a16zcrypto's sumcheck-based zkVM, with @SuccinctJT and @moodlezoup.
TL;DW can going post-quantum actually make a zkVM faster?
1
4
13
551
commonware retweeted
Very interesting work by @guruvamsip @commonwarexyz to obtain Batch decryption using pairings + high school algebra:
1. Each client chooses a random k_i, encrypts their message under k_i^2 and the validator's pk in the target group. Each client also provides pk.k_i^2, and k_i in group 1 and group 2.
2. The validators decrypt the sum of all the encrypted k_i's (denote it as K) by sending a single decryption share.
3. Given the decryption of K^2 as pk.K^2 one can compute the individual pk.k_i^2 as follows:
(Ignore the pk for now)
K^2 =(k_1 + k_2 + k_3)^2 = k_1^2 + k_2^2 + k_3^2 + cross terms.
(This omits a lot of crucial details for simplicity)
Suppose you want to decrypt the message under k_i^2 using K^2:
1. The cross terms can be removed by combining k_i in g_1 and k_j in g_2 (and vice versa) using pairings for all j!=i. This allows to remove the cross terms.
2. Then the individual pk.k_j^2 can be removed by using the client-provided material.
The brilliance lies in figuring out the optimal amount of information to put into the ciphertext, which allows the cross-term removal (using pairings) while preventing an adversary from decrypting the client ciphertexts without the decryption of the sum K.
Kudos on the great work!
It turns out all you need to deploy an encrypted mempool (via Batched Threshold Encryption) is an off-the shelf DKG. No CRS required.
Ciphertext overhead is 2G1 + G2 + 2F and partial decryptions are a single G1 element. Decryption runs in O(B log^2 B) time.
2
7
26
1,535
commonware retweeted
If you only know zkVMs by buzzword, this new podcast with @SuccinctJT and @moodlezoup from @a16zcrypto is for you.
We cover how verifiable computing evolved from a tool to keep remote poker players honest (original proposal in the 1980s) to the blockchain scaling hero of 2026+.
How Things Work #7: Jolt and The Return of Sumcheck
Today, we trace the once infeasible idea of verifiable compute from 1980s theory to Jolt, @a16zcrypto's sumcheck-based zkVM, with @SuccinctJT and @moodlezoup.
TL;DW can going post-quantum actually make a zkVM faster?
2
4
37
2,336
commonware retweeted
no more excuses. encrypt the mempool.
It turns out all you need to deploy an encrypted mempool (via Batched Threshold Encryption) is an off-the shelf DKG. No CRS required.
Ciphertext overhead is 2G1 + G2 + 2F and partial decryptions are a single G1 element. Decryption runs in O(B log^2 B) time.
6
4
56
3,687
commonware retweeted
And stay tuned for our updates that:
[1] explore the removal of NIZK (when working in the AGM as well-formedness of ciphertexts can be checked using pairings)
[2] add context dependent decryption to enable faster release of partial decryption
2
14
609
commonware retweeted
Read @guruvamsip's latest here (in the ePrint queue):
commonware.xyz/artifacts/dkg…
1
2
9
588
commonware retweeted
Against all odds, this means you can just piggyback on the DKG you're already running (unmodified) for Simplex's threshold consensus to power an efficient encrypted mempool.
commonware.xyz/blogs/thresho…
1
1
13
683
commonware retweeted
Unlike prior BTE schemes with public parameters that grow with batch size and either rely on a CRS or require interactive multi-round setup, @commonwarexyz's new scheme provides threshold encryption with just an off-the-shelf DKG (the only public parameter is the threshold key).
1
2
14
789
commonware retweeted
It turns out all you need to deploy an encrypted mempool (via Batched Threshold Encryption) is an off-the shelf DKG. No CRS required.
Ciphertext overhead is 2G1 + G2 + 2F and partial decryptions are a single G1 element. Decryption runs in O(B log^2 B) time.
9
15
92
13,392
commonware retweeted
Learn more about how @commonwarexyz minimizes consensus overhead with authenticated connections and buffered signatures:
commonware.xyz/blogs/buffere…
1
14
528
commonware retweeted
fun story: ~3y ago when we first constructed STE, we thought we also had a weighted construction but it turned out to be broken
everyone would always ask: but what about weights? (cc @MaxResnick among many others)
i'd hoped to solve it and add it to my thesis but just never managed to dedicate the time. nor did I have a magical stroke of genius lol
but thanks to ai and all the other great researchers whose work helped me understand the problem much better, i finally managed to get (some?) closure
many more open questions, but this was a personal favorite
and of course, many thanks to @_patrickogrady and @commonwarexyz for their unwavering support and encouragement
Today, I'm excited to share @commonwarexyz's new SOTA result on weighted threshold encryption with silent setup.
For the first time, the CRS size and public key of each party is O(W) group elements (where W bounds the total committee weight).
7
46
3,016
Today, I'm excited to share @commonwarexyz's new SOTA result on weighted threshold encryption with silent setup.
For the first time, the CRS size and public key of each party is O(W) group elements (where W bounds the total committee weight).
6
890
