Pushing the Limits of Proof Systems with Benedikt Bünz

Benedikt Bünz has served as chief scientist at Espresso Systems and professor of computer science at NYU since fall 2023. His PhD work on bulletproofs was deployed by Monero and reduced transaction fees by roughly 90 percent. Espresso began as a fast finality layer for rollups, confirming transaction finality before posting to Ethereum, and its consensus system processes 20 to 30 megabytes per second with low latency on cheap machines. Espresso is now engaging large financial institutions on applications including money market funds, and DTCC has publicly stated a goal of processing around one million transactions per second for clearing stock trades, which motivates Bünz's research into the limits of proof systems.

Espresso's consensus nodes agree only on transaction ordering and treat transaction data as opaque, requiring a separate proof system for execution. ZK proofs are described as the gold standard among options that also include optimistic proofs and trusted execution environments, and Bünz notes ZK proofs are getting faster. Espresso previously offered a privacy product called Cape allowing private transactions with selective disclosure, but it faced regulatory hurdles and was considered slightly too early. Institutional clients strongly prefer privacy because current public blockchains expose all transactions and balances from a single address, which Bünz argues is worse than traditional finance. Privacy may return as an application running on top of Espresso rather than as a core product.

Folding and recursive proof techniques enable near-perfect parallelism, allowing a proof system fast on one machine to scale across many machines with minimal inter-machine communication. Bünz proposes measuring prover cost in dollars rather than raw hardware speed as a more useful metric, and notes that folding schemes allow computation to be broken into small chunks enabling opportunistic use of cheap cloud capacity without requiring one monolithic computation. He does not expect major breakthroughs in folding research going forward, though real-world orchestration of many parties in parallel proving remains an open systems engineering challenge. Original folding schemes exploit additive homomorphism in elliptic curves, but hash functions are not homomorphic, so hash-based folding requires a testing trick where the prover claims the correct random linear combination. Bünz's work called ARC and work called WARP pursue this hash-based folding direction. Lattices have just enough homomorphism to be useful for folding but not enough to be broken by quantum computers, placing them in a useful middle ground.

Flock is a high-speed batch proof system for standard hash functions including SHA-256, Blake3, and Keccak, developed with Ron Rothblum and William Wang. On a single CPU core it achieves a proving overhead of approximately 250 times compared to native computation, and demonstrates roughly 500 to 600 hashes per second on an M4 laptop using Blake3. This exceeds the target Vitalik identified in a 2024 blog post requiring approximately 200,000 hashes per second for Ethereum's post-quantum transition. Poseidon had already met that target, but Poseidon's algebraic structure makes it more vulnerable to cryptanalytic attacks, with approximately 12 attack papers indexed on eprint. Bünz argues Flock's result means Ethereum could rely on Blake3 instead of Poseidon. In practical terms, Flock can prove approximately 3,500 Ethereum transactions per second on a consumer laptop and can prove a Bitcoin block containing roughly 5,000 hash-based signatures in one and a half seconds. Flock is six to twelve times faster than Binius and approximately six times faster than Plonky3. It is not zero-knowledge yet, and achieving ZK without performance loss is identified as an open problem. The team relied heavily on AI-assisted coding and Bünz estimated the project would have required roughly six engineers working for a year without AI assistance. Rather than auditing the entire codebase, the team audited only the verifier, relying on the SNARK property that a correct verifier guarantees overall system security.

Golden is a non-interactive distributed key generation protocol co-authored with Chelsea and Kevin, useful for threshold signatures, threshold encryption, MPC, and randomness beacons. Interactive DKG protocols are problematic because if one party drops off the protocol must restart, whereas in Golden each party sends only one message and a party that was offline can later recover their secret share as long as a threshold of others sent their messages. Golden uses an elliptic curve VRF and bulletproofs under the hood, and relies on the insight that the message needing encryption is a short random string that can be encrypted efficiently with a one-time pad. Golden is entirely broken by quantum computers, and a lattice-based version is being considered but is not straightforward. Bünz argues a nuanced view of post-quantum priority is warranted because a public key visible on a blockchain is a higher-priority target than a one-time DKG between trusted parties.

MULPIRM originated as a subsection in the Hyperplonk paper and was later developed with Jessica and students including Zach. It is a permutation argument that can also function as a lookup argument and is based solely on sum checks, making it well suited for smaller fields. Permutation arguments prove wiring in arithmetic circuits, ensuring the output of one gate matches the input of another, a check called copy constraints in Plonk. Bünz noted that the Twists and Shouts papers represent a bivariate permutation version of MULPIRM.