advancing confidential systems for institutional ethereum @eth_systems prev: @ethereumfndn @fuel_network @logos_network @hiFramework
Joined October 2022
- Tweets675
- Following492
- Followers867
- Likes2.7K
rymnc retweeted
Kaushal Vyas (@liftlines ), our Managing Director, joins the Building Ethereum panel at @LFDecentralized's Privacy for Financial Services Workshop in New York on Friday 23 October (12:00 to 12:45 pm ET), moderated by Johnna Powell of DTCC.
He will bring our open map of institutional privacy use cases, each with the requirements institutions named, the approaches already ruled out, and starter kits for several of them.
Looking forward to the conversation with fellow panelists, and to building on it together after 🤝🏻
rymnc retweeted
We published a writeup on Ethereum's upgrades, past and coming, read through what banks, custodians and other institutions need.
Apart from the move to proof of stake, most institutions we talk to haven't followed the forks closely. Since 2021 the gas limit has doubled, and accounts and rollups can now do things they couldn't before.
The next two forks have different focuses. Glamsterdam, due in December, is mostly about capacity: it prepares clients for a 200M gas limit and makes writing new storage more expensive. Hegotá, planned for 2027, is about control. Frame transactions give accounts more say over how they sign and pay fees, and FOCIL makes it harder for block producers to leave valid transactions out.
We looked at each change through five needs: key control, capacity at a cost firms can plan for, speed to finality, neutral inclusion and confidentiality. Each section opens with a summary for six kinds of firms, from bank treasuries to staking providers, and a replay of mainnet transactions under the new gas rules shows where costs move.
One of those needs the forks leave open. More below.
rymnc retweeted
Intercompany cash on a public chain publishes the group’s structure, and that includes who funds whom, how much, how often. Competitors can read it even before your annual report.
Our private payments starter kit tests the reverse: hidden on chain, visible to treasury, open to a tax authority on request.
There are still two gaps remain, see threads for more 👇🏻
rymnc retweeted
Most banks started on permissioned networks, and that did real work for hedging the risk and building capability. @motypes 's EthConnect 2026 keynote was about what comes after, because the architecture chosen at step one sets the cost of step three, and the wall on the way to a public network is almost always confidentiality.
Confidential is not anonymous. It is control over who sees what, when and how: the counterparty sees the trade, everyone else sees only a proof that it is valid, the operator sees nothing, and the regulator holds a disclosure key.
The same question ran through both panels. Good conversations with @Sharplink , @LidoFinance , @ETHGasOfficial , @Offchain , @zama , @axelar and @FourPillarsFP , and our thanks to @0xundefined_ for hosting.
Coverage in threads 👇🏻
rymnc retweeted
New chapter: I've joined EthSystems to work on privacy infrastructure for institutions building on Ethereum.
It's right in the intersection I've spent most of my career in, so it feels like the right place to be. Looking forward to what we build 🏗️🚀
We're glad to welcome David (@david__nunez) to EthSystems as Protocol Engineer.
David has spent more than 15 years in cryptography and information security, the last 8 in Ethereum and web3. Most recently he was CTO of NuCypher, leading TACo, an access control layer built on threshold cryptography, and he built the staking and governance smart contracts for Threshold Network.
He holds a PhD in Cryptography from the University of Málaga, and his research has been published at CRYPTO, AsiaCCS and in the Journal of Cryptology.
At EthSystems, David joins as Protocol Engineer. He'll work out which cryptographic building blocks hold up against institutional requirements, how they compose, and what they cost to run, and turn that into reference implementations institutions can test themselves.
Welcome, David.
Let's build confidential systems on Ethereum for institutions.
David's been crushing it since he's joined. Couldn't be happier working with him!
Welcome @david__nunez 🎈
We're glad to welcome David (@david__nunez) to EthSystems as Protocol Engineer.
David has spent more than 15 years in cryptography and information security, the last 8 in Ethereum and web3. Most recently he was CTO of NuCypher, leading TACo, an access control layer built on threshold cryptography, and he built the staking and governance smart contracts for Threshold Network.
He holds a PhD in Cryptography from the University of Málaga, and his research has been published at CRYPTO, AsiaCCS and in the Journal of Cryptology.
At EthSystems, David joins as Protocol Engineer. He'll work out which cryptographic building blocks hold up against institutional requirements, how they compose, and what they cost to run, and turn that into reference implementations institutions can test themselves.
Welcome, David.
Let's build confidential systems on Ethereum for institutions.
rymnc retweeted
New post on Eth Research!
PQ anonymity for Stealth Address Protocol
By:
- namnc
🔗 ethresear.ch/t/26094
Highlights:
- The core quantum threat is blockchain permanence: a future CRQC observing on-chain stealth registries/announcements can retroactively recover ECDH secrets (and even spending keys if ECDSA is used), becoming both the scanner and the receiver; therefore SAP needs post-quantum upgrades for both discovery/unlinkability (ECDH side) and spending authorization (signature side).
- Replacing ECDH with standardized ML-KEM (FIPS 203) can provide post-quantum recipient anonymity/unlinkability because ML-KEM ciphertexts are designed to be indistinguishable across recipients (ANO-CCA / IK-CCA), preventing attackers from linking an announcement ciphertext back to a specific recipient’s registered key.
- SchemeId=2 (direct ML-KEM SAP) replaces the viewing keypair with an ML-KEM (ek, dk): sender encapsulates to ek to get shared secret r and ciphertext c; stealth address is derived as P = K + H(r)G; receiver (or delegated scanner with dk) decapsulates c to find matching payments, but only the receiver with spending secret k can spend (k + H(r)).
- A naive 1-byte “view tag” derived directly from h=H(r) can leak a recipient-filter to a quantum attacker once the stealth address P becomes known (e.g., from an ECDSA spend): the attacker can test candidates in the registry with ~1/256 false-positive rate; mitigations require domain-separated derivations so the tag is independently derived from r (e.g., h=H(DS1||r), tag=H(DS2||r)[0]).
- Practical migration favors SchemeId=3 (hybrid combiner): combine classical ECDH secret r_ec and ML-KEM secret r_pq with domain separation so security holds if either remains secure during transition; however ML-KEM introduces large on-chain data (e.g., ~1088-byte ciphertext for ML-KEM-768 and ~1184-byte ek), motivating later pairwise variants (scheme 4/5) that amortize costs after an initial KEM exchange.
ELI5:
Stealth addresses let someone publish one “main” address, but every payment they receive goes to a fresh, one-time address so outsiders can’t easily link the payments together. Today’s versions use normal elliptic-curve cryptography (ECDH/ECDSA), which a powerful future quantum computer could break by “solving the secret keys” from public data stored on-chain. This post explains how to swap the secret-sharing part (ECDH) with a post-quantum method called ML-KEM so that even if a quantum attacker watches the blockchain, they can’t figure out which registered receiver a payment was meant for, and can’t helpfully scan/link payments. It also discusses practical migration options (hybrid mode), size/cost tradeoffs, and a subtle privacy leak from a naive ‘view tag’ optimization.
legacy systems need some love too 🫶
Another building block we use: chainfold
chainfold is a Rust library to deal with some of the inconveniences that come with handling on-chain events, especially reconciling after encountering a reorg.
Instead of forcing you to use a specific runtime, a storage backend, or an arbitrary "safe" block height that can be considered finalized, chainfold puts these batteries in your hands, that you can tune according to your specific usecase.
The design is simple enough: process an event, fold it into your local state, and when the block is finalized, persist the fold to storage, all while being able to roll back to a point that the data was known to be canonical.
We built this library to enable easier legacy system integration, where codebases cannot use modern languages / libraries that are well maintained, and the developers end up having to rebuild most of these components themselves.
More on the design, links and long-form writeup below 👇
rymnc retweeted
It turns out all you need to deploy an encrypted mempool (via Batched Threshold Encryption) is an off-the shelf DKG. No CRS required.
Ciphertext overhead is 2G1 + G2 + 2F and partial decryptions are a single G1 element. Decryption runs in O(B log^2 B) time.
working with @lfdecentralized is going to be really exciting!
more soon
EthSystems has joined LF Decentralized Trust (@lfdecentralized), the Linux Foundation organization where much of the open source identity and cryptography work in this field is maintained.
We are there for the part institutions cannot buy off the shelf: confidentiality, auditability and policy controls holding together in one system.
Those three usually get solved separately, and the seams between them are where the compliance problems appear. Holding them together without giving up the openness that made the platform worth using is the actual engineering problem.
LFDT is a neutral place to do that in the open.
Full announcement in the thread 👇🏻
rymnc retweeted
very helpful @motypes @eth_systems
specific systems 👏
auditors can test👏👏
applications for institutions👏👏👏
$ETH
One of our convictions starting EthSystems was that the next phase of institutional Ethereum requires much more than infrastructure.
It requires turning use cases into properly specified systems that engineers can build, auditors can test, and institutions can actually approve.
The first pieces are now public
would definitely like to thank @RAILGUN_Project @bermudabayzk and @0xprivacypools for their feedback on the spec :)
When we launched EthSystems we said each use case needs its own system, designed, specified, and hardened properly, and that someone has to do that work.
Our specs site is now public: specs.ethsystems.org
Starting small: a shielded pool for confidential payments, an attestation-gated profile of it, and the process behind both. Each spec states what the protocol does, what it assumes, and what it guarantees. This means engineers, auditors, and regulators can work from the same document.
little homelab disaster got me to look at the thermal situation a bit better. i can't believe the airflow was this bad before
(green is the node that became a toaster)
we're shipping faster and more focused with @liftlines on the team, LFG 🚀
We’re glad to welcome Kaushal (@liftlines) to EthSystems as Managing Director.
Kaushal brings 20+ years across financial services, technology strategy and product, followed by five years working directly in Ethereum.
Since 2021, he has led commercial and ecosystem growth for @ethnimbus, alongside privacy-focused infrastructure including Waku and Keycard, driving multi-fold growth in adoption, and helping establish Develp GmbH as an institutional-grade staking infrastructure provider.
At EthSystems, he’ll lead our work with banks, asset managers and financial market infrastructure providers as they move from digital asset experimentation into production.
Our focus is on how institutions can use Ethereum while meeting requirements around confidentiality, selective disclosure, interoperability, compliance and operational control. Kaushal joins as we build on the open-source research, reference architectures and implementation starter kits developed through our work at the Ethereum Foundation.
Welcome, Kaushal.
Let’s build confidential systems for institutional Ethereum 🤝🏻
rymnc retweeted
visited the hometown recently.
rural asf southern appalachia.
smth that stood out?
normies, nerds, & oldies struggling w emails alike are talking about flock, palantir, & even fusion centers rn
ppl know smth's wrong, but they're bombarded by the nothing-to-hides on one side & the nothing-is-safes on the other.
the best thing we can do for our community as tech ppl rn is explain these things in an approachable way.
keep your threat model reasonable:
mary sue is not a drug kingpin,
samuel does not need tor, xmr, or graphene
maddie has shit to do thats not hardening malloc
explain how data flows through a surveillance system:
how sensor fusion joins seemingly disjoint data,
how cops dont need warrants for ring or flock,
how warrants & subpoenas affect cloud providers
if youre talking w activists & organizers, go a lil deeper:
passwords cannot be compelled, biometrics can,
distinguish "obtainable" from "useable in court",
use signal, avoid google drive, blur faces,
ffs PLEASE tell them they dont need a faraday bag
we are in a very read-the-room era of tech & ai,
principled ideological rants are not likely to land,
focus on pragmatic W's for the community first.
we're practicing talking to ppl that experience a v diff world from ours & building community in the process.
good luck out there 💜
commonware throwing their hat into the ring for confidential systems, gotta love it
Fast and scalable private payments. Now available on your favorite blockchain.
Introducing Bonsai, @commonwarexyz’s new protocol for efficient encrypted transfers (hidden balances, amounts, and recipients) with no global nullifier set.
no performance story here, just a cute lib to help us cut the code and prevent us from rewriting a bunch of note encryption for PoCs :)
Next up in our suite of building blocks: `sealring`.
sealring is a Rust library for note encryption. Notes are the unit of value in a confidential system: private records of who holds what. A wallet redeems its notes by trying its key against a public list of envelopes, and sealring covers both halves of that, the sealing and the scanning.
Bring your own curve and note structure. The envelope format and the scan path come with the crate. Adapters for k256, x25519 and grumpkin ship with it, and it's no_std, so you can throw it into a zkVM if that's where you're working.
Five of our PoCs already use it: private transfers, hardened shielded pools, in-pool compliance, private bonds, and disbursement rails.
More on the design, and links to the writeup and the crate, in the thread below. 👇
