Bitcoin faces crucial choice: Expanded blocks versus STARK proof technology
Implementing STARK proofs may be the solution to keeping Bitcoin functional after quantum-resistant upgrades. However, expanding block capacity continues to be a viable alternative approach.
According to Eli Ben-Sasson, co-founder of StarkWare, ZK STARKs represent the optimal solution for addressing challenges that arise when making Bitcoin resistant to quantum computing threats — while simultaneously enabling the network to achieve widespread adoption.
Beyond that, he asserts that Adam Back, founder of Blockstream, shares this view.
Ben-Sasson made headlines recently after proposing a contentious idea on X to raise Bitcoin's annual inflation rate to 4%. Analysis by Grok of the community responses revealed "zero clear support for the proposal."
However, as the co-inventor behind STARKs — which are quantum-resistant, hash-based zero-knowledge proofs — he stands on considerably stronger ground, earning backing from several prominent Bitcoin researchers for this concept.
Starknet, Ben-Sasson's own initiative, unveiled a three-phase roadmap last week aimed at achieving quantum resistance.
The challenge of oversized PQ signatures on Bitcoin
Incorporating zero-knowledge proofs into Bitcoin doesn't directly make the blockchain resistant to quantum attacks. Rather, ZK proofs serve as a solution for handling the complications that arise from implementing significantly larger post-quantum (PQ) signature schemes within Bitcoin.
The present generation of PQ signatures that have received approval from the National Institute of Standards and Technology (NIST) ranges from 10 to 100 times the size of Bitcoin's current ECDSA and Schnorr signature schemes.
Critics suggest this expansion could reduce the blockchain's processing speed to below 1 transaction per second. However, all the oversized transaction signatures within a block could be condensed into a compact ZK STARK proof. Since the proof would be significantly smaller than even the current signatures, the blockchain could potentially operate more efficiently.
"If they don't allow for ZK STARK aggregation, then definitely it will be a very unfortunate move because it won't really solve the problem ... where the problem is 'can everyone actually use Bitcoin?'" Ben-Sasson said.
"So for that you need massive scale. And for that, you need things like signature aggregation and just increasing the block size isn't enough."
The quantum alternative: Increase Bitcoin's block size
According to Marin Ivezic, who authored PostQuantum.com and founded Applied Quantum, Bitcoin's SegWit implementation decreased the effect of large signatures by as much as 75%. However, his analysis of NIST's ML-DSA-44 scheme, featuring 2,420 bytes per signature, "puts block capacity at roughly 500 to 700 transactions, down from 2,500 to 3,000 today. That is where the block-size debate comes in."
Expanding Bitcoin's block capacity represents a legitimate option, though the community experienced division in 2017 over a proposal to double block size. Numerous arguments against such expansion continue to hold weight, since it represents a crude solution requiring every node to carry, store and verify substantially more data. This increases costs and equipment demands, which detractors contend would push the network in the direction of centralization.
In recent months, Blockstream Research has conducted experiments with reducing the footprint of hash-based post-quantum signature schemes for Bitcoin implementation. The team has developed the encouraging SHRINCS and SHRIMPS schemes, which feature regular signatures approximately five times larger than Bitcoin's existing ones, though potentially up to 40 times larger when wallet recovery becomes necessary.
Although SHRINCS has been utilized to sign actual transactions on the Liquid sidechain, its development remains in early stages and presents disadvantages regarding complexity and user experience. The considerably larger signatures would additionally degrade blockchain performance, unless block size received an increase.
"Raising capacity natively is the simple engineering answer and the hardest governance answer," said Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, about a block size increase. "We just don't have time for those debates."
ZK proof aggregation has advantages
Expanding block size would resolve the challenge, though preserving decentralization while simultaneously improving Bitcoin's efficiency would arguably yield superior results.
In their most basic form, ZK proofs provide a method to mathematically verify that something exists without requiring the inclusion of comprehensive details. As an illustration, a ZK proof could confirm that you possess knowledge of a safe's combination, without revealing what that combination actually is.
Creating a ZK proof for an individual block technically requires completion just once (though generating additional backups for redundancy purposes is safer), and the hardware necessary for this task appears to be considerably less costly than a commercial mining operation.
According to Lean Ethereum's specifications, proving equipment costs less than $100,000 (and operates from a standard home). In contrast, verifying a ZK proof can be accomplished on virtually any hardware, including a Raspberry Pi.
Ben-Sasson said that early Bitcoin devs like Greg Maxwell and Mike Hearn were "very bullish about ZK STARKs, which are post-quantum secure and have no trusted setup," and that he believes Bitcoin Core developer Luke Dashjr and Blockstream founder Adam Back are coming around to the idea.
"I heard this myself from them. They are bullish on things related to and using ZK STARKs. I think each of them has spoken well, definitely privately but also publicly, in favor. Adam Back and Luke Dashjr don't exactly see everything eye to eye, but on this I think they actually agree that it's a great technology that, under the right terms, could find its way to Bitcoin."
Cointelegraph contacted Back for comment, but did not receive a response.
Justin Drake, an Ethereum researcher, has publicly expressed his enthusiasm for Bitcoin adopting Lean Ethereum's ZK proof aggregation technology to establish it as an industry-wide standard. Political considerations may render this approach impractical.
Bitcoin specific ZK proposals
Considering Bitcoin's cautious culture, the most politically viable pathway for integrating ZK into Bitcoin would probably involve re-enabling OP_CAT, which consists of nine lines of code authored by Satoshi.
"[He] even introduced and then he removed it," said Ben-Sasson. "And if you add that, you can get things like STARK proofs and then aggregation and post-quantum security."
"I think it's the best and safest solution that will really, really just jump-start again this journey that Satoshi really started and wanted."
Despite a surge of enthusiasm for OP_CAT approximately 12 to 24 months ago, momentum appears to have diminished recently (though Bitcoin governance operates in unpredictable ways).
Additional speculative proposals exist, including OP_STARK_VERIFY, which would introduce opcodes specifically engineered to verify STARKs on Bitcoin more efficiently. Additionally, BIP-360 co-author Ethan Heilman put forward a proposal to aggregate Bitcoin's signatures and public keys into a unified STARK proof, which he named BitZip.
Heilman told Cointelegraph earlier this year there are two main ways to achieve the desired result:
"Either add a bunch of general purpose opcodes to Bitcoin and then build something like a ZKRollup in Bitcoin or support STARKs at the consensus layer of Bitcoin. Alternatively, other less powerful aggregation schemes, such as CISA [Cross Input Signature Aggregation] might help here as well."
What are the chances though?
According to Ivezic, Bitcoin governance represents the primary obstacle, rather than technical feasibility.
"Eli's cryptography is rock solid: pure hash assumptions, no trusted setup, thousands of signatures compressed into one small proof. The problem is everything around the cryptography," he says.
"Bitcoin Script cannot verify a STARK today, and a production verifier is a massive consensus surface compared with a narrow hash-signature opcode. Given that a tiny opcode like OP_CAT has spent years in debate, a base-layer STARK verifier is realistically a 2030s conversation."
In the meantime, Ethereum has set 2029 as its target date for transitioning to post-quantum security, and Solana has likewise been testing the integration of post-quantum signatures. StarkNet's three-phase transition stands to benefit from account abstraction, which allows underlying cryptography to be upgraded without requiring every user to manually migrate to new accounts.
Consequently, Ben-Sasson said that Solana and Ethereum's post-quantum roadmap will be "extremely hard."
"On Starknet, we have this big advantage that we have already native account abstraction and smart wallets, which means that nothing is enshrined so its very easy to upgrade the wallets and the infrastructure to be post quantum."