ZK/SEC Quarterly

Variants of KZG · Part 2

Variants of KZG: Part II, Multilinear Commitments with PST

In this blog post, we extend the ideas behind univariate KZG commitments to multilinear polynomials through the PST commitment scheme. We derive the multilinear quotient identity, explain how PST commits to and opens multilinear polynomials using a specialized multilinear setup and walk through its opening protocol. We conclude by examining the proof size, prover and verifier costs, and the limitations that motivate other multilinear polynomial commitment schemes.

Varun Thakore July 28, 2026 7 min Read →

crypto · mpc

Threshold ECDSA: Building CGGMP from scratch

A step-by-step build of CGGMP, an n-of-n threshold ECDSA scheme where parties jointly produce a signature without ever reconstructing the private key. We start from the multiplicative-to-additive (MtA) protocol and a semi-honest version of the signing protocol, then harden it into a maliciously secure one by layering in zero-knowledge proofs at each step. Along the way we cover the auxiliary Ring-Pedersen and Paillier parameters and the proofs that make them safe to use.

Samuel Tang July 27, 2026 37 min

Proof is in the Pudding · Part 10

Archetype x zkSecurity - Proof is in the Pudding: Groth16

In Session 10 of "Proof is in the Pudding," we work backward from Groth16's famously compact verifier equation to explain why the protocol is shaped the way it is. We cover how R1CS constraints become polynomial identities, why pairings are needed to multiply hidden commitments, how random linear combinations and the Schwartz-Zippel lemma enforce witness consistency, and how the separating factors gamma and delta restrict which pieces of the CRS a prover can use.

ZK/SEC July 23, 2026 2 min

zkao 2 of 3 parts in this issue

Part 3

zkao 2.0 is here

zkao 2.0 is out: a complete redesign of our continuous security scanning tool, a new pay-as-you-go model that replaces subscriptions, and a long list of improvements across scanning, triaging, and reporting.

zk/sec, False Witness team July 24, 2026

Part 2

Bringing Aleo and Leo into zkao

We recently brought Leo and Aleo support to zkao, our AI-powered bug-detection tool, and put it to work on a real engagement with HumanityLink. Getting an LLM to audit a young ecosystem like Aleo turned out to be less about the model and more about what we fed it - custom prompts or skills so it actually recognizes Aleo bug patterns, a harness called cheatVM that turns findings into real end-to-end proofs of concept instead of code that just looks right, and a clear threat model that significantly cut down our false positives.

zk/sec, False Witness team July 20, 2026

announcement · cryptography

Nine Years to Halve a Hash Function: RFC 9861 Is Out

After nearly a decade in the making, RFC 9861: KangarooTwelve and TurboSHAKE was officially published in October 2025, with zkSecurity among its editors. This post explains why these hash functions deserve to be far more widely used than they are today. Built on the same Keccak permutation as SHA-3 and SHAKE but with the round count halved, they do the same job at the same security level roughly twice as fast. We cover why halving the rounds is safe, what the RFC actually defines, the caveats around FIPS compliance and workload-dependent speedups, and why a standard like this took nine years to land.

David Wong July 21, 2026 8 min

announcement · zk

zk.golf: Fearless and Collaborative Optimization of Circuits

zk.golf is a platform where people can compete on creating the most efficient zk circuits for specific problems. It is enabled by what we call "fearless optimization", which is achieved by combining formal verification and frontier AI models. By the end, you will be convinced that nobody should look at constraints ever again in their life.

Giorgio Dell'Immagine, Mathias Hall-Andersen July 02, 2026

announcement

zkNews Is Now Open to Everyone

zkNews is now open to everyone. When we first launched, access was limited to a small beta group to keep things stable while we found our footing. That rate limit is gone. Anyone can now sign up, submit links, and join the discussion at news.zksecurity.xyz. Come help us build the home for zero-knowledge news.

ZK/SEC June 06, 2026

AI meets Cryptography 3 of 3 parts in this issue

Part 3

AI meets Cryptography 3: What AI Found in Bron Labs's bron-crypto

We pointed our AI audit pipeline at bron-crypto, Bron Labs's Go library for MPC and threshold signatures, and confirmed four bugs. All of them are now fixed upstream. This is the third post in our series on bugs our agents found across open source cryptography.

Stefanos Chaliasos, Hao Pham, False Witness Team July 22, 2026

Part 2

AI meets Cryptography 2: What AI Found in OpenVM's zkVM

We turned zkao (our AI auditor) on OpenVM, a state-of-the-art zkVM, and it found a critical soundness bug: the pairing check accepted a prover-supplied witness without proper subfield checking, which lets a malicious prover forge any pairing equality. It is fixed in OpenVM 1.6.0 and tracked as CVE-2026-46669. This is the second post in our series on bugs our agents found across open source cryptography.

Stefanos Chaliasos, Hao Pham July 17, 2026

Part 1

AI meets Cryptography 1: What AI Found in Cloudflare's CIRCL

We pointed our AI audit pipeline at Cloudflare's CIRCL experimental cryptography library and confirmed seven real bugs, from a critical float64 precision loss in threshold RSA to a complete access-control break in attribute-based encryption. All seven are now fixed upstream. This is the first post in a series on bugs our agents found across open source cryptography.

Stefanos Chaliasos, Hao Pham, False Witness team July 07, 2026

Jolt · Part 4

Breaking Jolt’s Verifier with an Unbound Uni-Skip Claim

We found a critical soundness bug in Jolt’s transparent verifier that allowed a forged proof for an invalid execution to verify. The issue was fixed quickly after disclosure, and the full PoC and write-up are available in the linked repository.

Minsun Kim May 09, 2026

educative · zk

Notes and Proofs for Divisor Techniques

Notes and proofs for the divisor-based ECIP protocol of Eagen, written with Diego F. Aranha and supported by MAGIC Grants. The document is self-contained: it works through the necessary algebraic geometry, the interactive proof and its soundness, the composition with a simulation-extractable NIZK, and the R1CS verifier circuit used by Parker's gadget in Monero's FCMP++.

Mathias Hall-Andersen May 08, 2026

encrypted mempool · blockchain

Encrypted Mempools: Security Beyond Encryption

Encrypted mempools are an emerging approach to reducing transaction-ordering MEV. They are not just normal mempools with encryption added on top: they introduce a new security boundary around the exact moment a transaction becomes plaintext. This post explains the security model, the core invariant, and the subtle failure modes protocol designers need to consider.

Suneal Gong May 07, 2026

mpcsec.org 2 of 2 parts in this issue

Part 2

New on mpcsec.org: An MPC Bug Tracker, Templates, and a Cleaner UI

A month after launching mpcsec.org, we added a searchable tracker of real-world MPC bugs, expanded the pitfall taxonomy, published contribution templates and refreshed the site UI.

ZK/SEC June 25, 2026

Part 1

Announcing mpcsec.org: What Goes Wrong When You Implement MPC

mpcsec.org is a new collaborative reference for common pitfalls in MPC implementations and the cryptographic primitives they rely on, built with contributors from zkSecurity, Trail of Bits, Partisia, and Zama. If you build, audit, or deploy threshold signatures, distributed key generation, or other MPC protocols, it's a starting point for the mistakes you don't want to repeat.

ZK/SEC May 25, 2026

announcement · zk

On ZK Security, ZK Summit, and a Decade of Progress

On May 7th, we'll be in Rome sponsoring zkSummit14. A look back at a decade of progress in zero-knowledge, the current state of ZK security based on 100+ audits, and why events like zkSummit have become infrastructure for the field.

ZK/SEC May 06, 2026 4 min

cryptography · algebra

Powers-of-Funbenius

A one-character repeated-squaring bug in Inferno's Limbo implementation turns the intended random polynomial check into a linearized Frobenius check over a binary extension field. This post walks through why the usual Schwartz-Zippel argument disappears, how periodicity of the Frobenius map makes collisions immediate after 64 multiplication gates, and how even smaller circuits can cheat with noticeably higher probability.

Mathias Hall-Andersen May 05, 2026

educative · zk

Groth16, Intuitively

Groth16 is still the gold standard for succinct SNARKs: 128-byte proofs, constant-size verification, and a decade of real-world deployment. But despite its ubiquity, almost nobody explains *why* it works the way it does. In this post, we build Groth16 from the ground up, starting from R1CS and QAPs, then layer in pairings, trusted setup parameters, and the separator tricks (α, β, γ, δ) that make the scheme sound. By the end, you should have an intuitive grasp of every term in the final verifier equation.

David Wong May 01, 2026

Clean 2 of 3 parts in this issue

Part 3

Clean: From Verified Circuits to Verified zkVMs

Clean, our circuit DSL, is growing toward verification of complex multi-AIR ensembles. We introduce channels as a way to model lookups, permutation arguments, and zkVM cross-table interactions, then explain how local gadget proofs can compose into global soundness theorems. Watch our talk from ZKProof 8 or read the post.

Gregor Mitscha-Baude June 05, 2026

Part 2

Verifying Poseidon in Clean: Why the Last 'sorry' Is About Primality

We walk through a Lean 4 proof of correctness for a Clean model of circomlib's optimized Poseidon hash circuit at arity 1. The theorem says the modeled constraints are sound and complete with respect to the optimized Poseidon spec. After weeks of work, the only remaining `sorry` was a primality proof for the BN254 scalar field: a 254-bit number that no proof assistant can decide by trial division. Closing it requires a Pratt certificate, a recursive proof structure based on a theorem Lucas published in 1876.

Martin Ochoa May 04, 2026

Sum-Check as an Algebraic Tensor Reduction 2 of 3 parts in this issue

Part 3

Sum-Check as an Algebraic Tensor Reduction: Part III

This post is all about the maps that let us move between modules without breaking their structure. We’ll see when a map is truly “linear,” when two modules are (secretly) the same, and why two-input maps deserve special attention. Along the way, (bi-)linear maps and isomorphisms become less like abstract definitions and more like tools we can actually use. By the end, we’ll have all the tooling we need to tackle abstract tensor products head-on.

Marco Besier May 18, 2026

Part 2

Sum-Check as an Algebraic Tensor Reduction: Part II

In this part of our series, we start introducing the algebraic language needed to formalize sum-check as a tensor reduction. We start with the basics of rings and modules. Rings generalize fields by dropping the requirement that every non-zero element has a multiplicative inverse. Modules then generalize vector spaces by allowing scalars to come from a ring instead of a field. In this post, we’ll use plenty of examples to make these ideas concrete and build intuition along the way.

Marco Besier May 10, 2026