Post-Quantum Privacy Pool Research Proves A Withdrawal In 28.6 ms

Researchers have shown a Tornado Cash style withdrawal being proven in under 30 milliseconds with a post-quantum privacy pool design. The write-up was posted on ethresear.ch on October 19 by a researcher named Pierre, in collaboration with a second author who goes by winderica. It is a research proposal with a working prototype, not a product.

Why classical privacy pools are exposed

Pools like Tornado Cash lean on discrete logarithm hardness. It shows up twice, in the Pedersen commitments and in the Groth16 proofs. A quantum computer able to break discrete logs would undermine both.

Summary at the top of the post. Source: Ethereum Research, "Faster, Aggregatable and Quantum Safe Privacy Pools".

The authors point to three recent developments: binary-field proving systems, Zcash's ZIP 2005 for its Ironwood upgrade, and the leanVM aggregation work. In their view these argue for moving privacy pools onto sturdier primitives. Their prototype uses Flock, which the post calls a plausibly post-quantum, transparent, hash-based SNARK. The pool's Merkle tree and nullifier derivation both run on SHA-256.

From 0.81 seconds to 28.6 milliseconds

A withdrawal from a tree of height 32 needs 34 SHA-256 compressions. One covers the commitment, one the nullifier hash, and 32 follow the Merkle path to the root. A single large circuit for all of them works but leaves most of the proof system idle.

So the team wrote one small circuit with a single compression and a multiplexer. It then ties 34 runs together with a sumcheck argument. The post-quantum privacy pool prototype proves a depth-32 withdrawal in 28.6 milliseconds, against 0.81 seconds for the single large circuit. The post calls that 28 times faster, and the proof is 266 KiB.

Prover times for each approach, as printed in the post. Source: Ethereum Research post.

Smaller trees gained less. A depth-8 tree dropped from 0.23 seconds to about 32 milliseconds. Depth 20 went from half a second to about 27 milliseconds. The post explains that proof time barely moves with depth because the circuit stays the same size.

Folding many withdrawals into one proof

The post also tests an aggregator for the post-quantum privacy pool. Each user proves a single withdrawal in 19.5 milliseconds and gets a 203.6 KiB proof. The aggregator then folds them together.

Folding 4 withdrawals took 1.7 seconds, and the biggest test, 128 of them, took 87.6 seconds. The final proof stays at 343.9 KiB and verifies in 46 to 64 milliseconds whatever the count. That works out to roughly 0.68 seconds of aggregator time per withdrawal, by our arithmetic.

A recovery plan for existing pools

The second idea is a recovery protocol borrowed from ZIP 2005. Deposits would take their two secrets from a 256-bit seed in place of fresh random numbers. User software would make that change, and the pool contract would not need to.

If a quantum computer capable of breaking discrete logs became public knowledge, the pool would freeze. Users would then withdraw through a recovery verifier, proving they know the seed behind their deposit with a post-quantum proof. The nullifier hash stays the same, so the contract keeps one list of spent notes.

This article describes published research and offers no advice on using or building any such pool.