Ethereum Researchers Ask the Network to Pick an Instruction Set for Post-Quantum Proofs Under EIP-8288

A post on the Ethereum Research forum published on October 8 sets out the next design decision for Ethereum's post-quantum path. EIP-8288 lets a transaction depend on post-quantum signatures (leanSPHINCS) and Scalable Transparent Arguments of Knowledge (STARKs) built with leanSTARK, and the Ethereum Virtual Machine (EVM) does not verify either of them. Each dependency is carried as a frame inside an EIP-8141 frame transaction. Nodes check it before they forward the transaction, and every block carries a single recursive STARK that proves all of that block's dependencies are valid.

The open question is the computation model. The draft identifies each proof's program by a verification key hash, and the post calls that hash a placeholder "until Ethereum decides what to expose." Ethereum would then have to choose the instruction set architecture (ISA) in which those programs are written. According to the post, that choice determines how fast users can generate proofs on their own devices and which new cryptography applications can adopt without a protocol change. Privacy pools are the first beneficiary. Under the design, a pool contract does not run a verifier. It only checks that the transaction depends on a proof for its own circuit with the expected public inputs.

The cost numbers explain the urgency. Post-quantum signatures today are 2 to 3 kilobytes and cost 150,000 to 200,000 gas to verify, Crypto Briefing reports. The EIP allows at most 16 leanSPHINCS signatures and one leanSTARK proof per transaction. Vitalik Buterin wrote EIP-8288, which was merged into the EIP repository on September 9. He argues that private transactions costing about 10 million gas to make quantum-safe today could fall to tens of thousands. Aggregation takes place in the mempool and at block builders, outside of consensus. That design gives more work, and more trust, to builders.

Two other forum posts this week target the same Lean Ethereum base layer. One shows that stacking the Fast Confirmation Rule (FCR) with the Ethereum Economic Zone (EEZ) could let a user holding ether on a rollup pay at a card terminal with no bridge and no intermediary, with confirmation in about two slots today and less as slot times shrink. Another revisits a paper by Saraf and co-authors on the cost of censoring transactions when several proposers build blocks at once, and asks how that cost changes when one actor controls many proposer identities.