crypto · mpc
A step-by-step build of CGGMP, an n-of-n threshold ECDSA scheme where parties jointly produce a signature without ever reconstructing the private key. We start from the multiplicative-to-additive (MtA) protocol and a semi-honest version of the signing protocol, then harden it into a maliciously secure one by layering in zero-knowledge proofs at each step. Along the way we cover the auxiliary Ring-Pedersen and Paillier parameters and the proofs that make them safe to use.
Samuel Tang
July 27, 2026
37 min
Read →
Proof is in the Pudding · Part 10
In Session 10 of "Proof is in the Pudding," we work backward from Groth16's famously compact verifier equation to explain why the protocol is shaped the way it is. We cover how R1CS constraints become polynomial identities, why pairings are needed to multiply hidden commitments, how random linear combinations and the Schwartz-Zippel lemma enforce witness consistency, and how the separating factors gamma and delta restrict which pieces of the CRS a prover can use.
ZK/SEC
July 23, 2026
2 min
announcement · cryptography
After nearly a decade in the making, RFC 9861: KangarooTwelve and TurboSHAKE was officially published in October 2025, with zkSecurity among its editors. This post explains why these hash functions deserve to be far more widely used than they are today. Built on the same Keccak permutation as SHA-3 and SHAKE but with the round count halved, they do the same job at the same security level roughly twice as fast. We cover why halving the rounds is safe, what the RFC actually defines, the caveats around FIPS compliance and workload-dependent speedups, and why a standard like this took nine years to land.
David Wong
July 21, 2026
8 min
