Benedikt Bünz
@benediktbuenz
Followers
10,189
Following
744
Media
53
Statuses
1,911
Chief Scientist @espressosys ☕️ (WE ARE HIRING) Assistant Professor Computer Science @NYU_Courant
San Francisco, CA
Joined November 2016
Don't wanna be here?
Send us removal request.
Explore trending content on Musk Viewer
My World
• 164770 Tweets
Into the Depth with YUTA
• 36615 Tweets
渋沢栄一
• 35028 Tweets
スーパーヒーロー
• 16387 Tweets
TEN FIREWORK IT
• 16087 Tweets
Gセルフ
• 15187 Tweets
タリーズ
• 13022 Tweets
マックス
• 11035 Tweets
イグナイター
• 10290 Tweets
Pinned Tweet
Espresso is building a marketplace for rollups to sell their sequencing rights. We wrote up a detailed post on our market design: a combinatorial lottery that sells execution tickets for rollups or bundles of rollups. Please give us feedback on the design:
8
21
115
Ph.Done! Thank you to all the amazing people that have helped me along the way and the great and supportive communities I have been able to be part of.
You can find my thesis (Improving the Privacy, Scalability, and Ecological Impact of Blockchains) here:
70
27
498
New version of the Bulletproofs paper is online: . Greatly expanded the evaluation section. BPs are now implemented in libsecp256k1. Amazing work by Andrew Poelstra and
@pwuille
. Batch verifying 16 aggregate range proofs=16 ECDSA signatures (It's fast)
14
173
469
Very excited to join A16z crypto research as a founding research partner!
14
27
341
Defended my Ph.D. Thanks to everyone who helped me along the way. Especially all my amazing collaborators!
42
37
304
I am very excited to announce that I’ll be joining the Courant Institute at NYU as an assistant professor of computer science, starting next fall!
If you are considering a PhD in crypto (graphy/currency) please do apply (deadline 12/12). We have an amazing crypto/security group!
19
38
297
New paper on batching techniques for accumulators. Applications to stateless blockchains (miners only need 2kb digest to store the entire UTXOs) and shorter STARKs/Aurora. Also new succinct proofs for groups of unknown order: Joint work:
@benafisch
& Dabo
10
62
242
Apparently you have to run marathons to be considered a real runner. So here you go:
39
3
246
New paper with
@aszepieniec
and
@benafisch
: Supersonic a true SNARK (<8KB, ~75ms verif.) without trusted setup. It uses a new polynomial commitment in groups of unknown order called DARK. We can compile polynomial IOPs such as Sonic/Marlin/Plonk to SNARKs
3
69
233
Happy to announce that the HyperPlonk paper is online! It moves Plonk to the boolean hypercube which removes the need for using FFTs and makes Plonk linear-time and eases parallelization. It also enables high-degree custom gates. CC:
@Charles_Chen533
@zhenfei_zhang
@danboneh
#ePrint
HyperPlonk: Plonk with Linear-Time Prover and High-Degree Custom Gates: B Chen, B Bünz, D Boneh, Z Zhang
2
16
70
6
41
205
I am no longer associated with Findora and do not endorse any ICO related to it.
38
98
199
The call for papers for the Stanford Blockchain Conference 2019 (formerly known as BPASE) is up:
Please retweet, submit papers and attend!
4
104
170
Am I the only one who thinks that a blockchain based vaccine passport isn't THE worst idea ever?
67
8
147
Grateful to have received a scholarship from the ZCash Foundation for my research on Cryptocurrencies and Zero-Knowledge proofs! Especially big thanks to
@ZcashFoundation
’s flexibility in accepting an unusual grant proposal.
"The Zcash Foundation is delighted to announce the winners of our 2018Q2 Grants Program — 13 projects that will benefit the Zcash ecosystem and community." Read all about them here:
7
27
93
4
13
140
New folding paper with my Ph.D. student Jessica Chen: We break through the "witness barrier" and go beyond the "lookup singularity". We show how to do reads AND writes to memory by committing to just 4 small elements. We also show how to avoid committing to intermediate witnesses
3
23
147
New paper with Lucianna Kiffer (joint first author),
@loi_luu
,
@mahdi_zamani_
on Flyclient. Super light clients for PoW chains. You only need to download O(log(n)) block headers. We prove that our scheme is “optimal”. For Ethereum 3.6GB-> 500kb.
10
38
127
There was a vulnerability in the Fiat-Shamir description of Bulletproofs (it did not explicitly hash the statement). This leads to a full soundness break of the protocol. The paper has been updated and thank you to ToB for finding and disclosing the vulnerability!
Your code might be vulnerable! Our cryptography team has discovered a number of Fiat-Shamir vulnerabilities affecting proof systems such as Bulletproofs and PlonK. Check out this blog series for details and contact us if you think your codebase might be…
12
131
381
6
36
122
I humbly accept the award as
@Cointelegraph
's top person in crypto. . This is the biggest award I've received after being the Time Magazine
Person of the Year 2006.
11
7
112
If you are thinking about doing a Ph.D in cryptography or any other blockchain related topic you should apply to NYU courant. We have an amazing crypto and security group with Sunoo Park,
@zaumka
, Marshall Ball, Nir Bitansky,
@josephbonneau
, and Mike Walfish. Also New York City!
4
14
102
We showed how to do accumulation/folding without homomorphism (Short answer spot check and build a tree). To quote
@pumatheuma
slightly out of context: "This seems extremely great... what more could you want from a proof system". Read more below:
I wrote a paper:
We construct the first folding scheme without using public-key cryptography. This yields efficient IVC with several benefits: plausible post-quantum security, support for arbitrary fields, etc. With
@bbuenz
,
@zkproofs
,
@mercysjest
8
62
243
8
17
115
Me: It's crazy there is a travel ban from Europe now. I basically can't leave the country. My Iranian friend: Oh man I am sorry, I wonder what that feels like
1
9
111
New paper: Verifiable Delay Functions ()
Joint work with
@benafisch
@josephbonneau
and Dan Boneh. To appear at CRYPTO 2018
4
37
110
1/n Technical explainer on what CAPE is and how it works. CAPE is configurable asset privacy for Ethereum. Blockchains like Ethereum essentially have no privacy. Everyone can see the sender's and receiver's accounts and the amounts being transferred.
Really excited to announce that we just launched CAPE on the Görli testnet! CAPE let’s you wrap any ERC20 token into a CAPEd token with customizable privacy. Please go play around with it and let us know what you think!
0
7
53
4
27
108
@Zac_Aztec
Reed - Solomon code: Polynomial
Zero-Knwoledge Proof Systems: Polynomials
Secret Sharing: Polynomial Evaluations
Identity Testing: Polynomials equal?
FFTs: Polynomials
FRI: FFTs-> Polynomials
SNARK: Polynomials
STARK: SNARK
Security Parameter: Polynomial
Lagrange: Polynomial
5
8
100
Our new paper is finally on Eprint. We construct a confidential payment system on top of Ethereum. It works with Ethereum today and is compatible with other smart contracts. The techniques apply to account based payments in general. Also: extension to BP called Sigma-Bullets
[New] Zether: Towards Privacy in a Smart Contract World (Benedikt Bunz and Shashank Agrawal and Mahdi Zamani and Dan Boneh)
1
1
3
2
32
98
My mom just asked me if we can use signal. Watch out WhatsApp you are loosing the +60 German women demographic by the minute
3
1
93
New paper with
@Charles_Chen533
We build ProtoStar, a new accumulation/folding based IVC scheme with support for degree d gates, N different circuits, lookups in a table T. The recursive statement is just d EC muls and the prover is independent of T and N
3
25
93
I am incredibly excited to finally announce what we have been brewing:
CC:
@benafisch
@jillrgunter
@charleslu1
@M_Mosier_
Introducing Espresso Systems: a single-shot scaling & privacy solution for Web3.
10
32
221
6
8
84
The great and very talented folks from Cambrian Labs have implemented accumulators with both a Class Group and an RSA interface. And yes of course it's in Rust! Go check it out here:
2
29
84
New paper (technically updated) alert:
We prove a Schwartz-Zippel lemma for multi-linear polynomials modulo composite.
We define a new security notion: Almost Special Soundness.
We show that a lattice and a GUO (akin to DARK) generalization of BP is secure.
With
@benafisch
5
22
79
Some exciting HyperPlonk news
We have open-sourced our HP implementation!
We are collaborating with EF on integrating HP with the Halo2 library.
New benchmarks and a new variant for small fields:
And finally, HP will appear at Eurocrypt
We have open sourced HyperPlonk!
We are glad to also be collaborating with the Ethereum Foundation on integrating HyperPlonk with their Halo2 library and front end.
Read more here 👇
17
91
254
1
26
75
We are building a decentralized sequencer at Espresso Systems. Read here about what, how, and why we are doing it in the most detailed blog we have released so far!
Rollups are delivering on their promise to scale Ethereum & make it useful for a wider range of applications, but today rely on centralized sequencers.
We are building the Espresso Sequencer: the way rollups will decentralize.
Read more (much more) now:
23
108
373
4
16
70
I felt a great disturbance in the force. As if millions of sleep deprived cryptographers suddenly sighed in relieve and then suddenly fell asleep.
3
2
68
We significantly updated our paper. One key highlight is that it achieves recursive snarks very very efficiently (useful for succinct blockchains, roll up, VDFs, ...). The recursive circuit only has 3! group exponentiations (aka scalar multiplications)
We've updated the full version of our paper on recursive *NARKs* (no succinctness necessary!). Key takeaways:
* a very simple NARK and acc scheme for it
* recursion from any curve cycle , including secp-secq
* optimizations to our impl (online soon)
@benediktbuenz
@_nickspoon
6
16
63
6
18
68
Espresso is not trying to take your sequencing rights! We are building a marketplace where rollups can sell their sequencing rights temporarily (and only if it’s profitable). We are not a shared sequencer but we enable ad hoc, temporary shared sequencing!
5
5
68
We posted an updated version to the accumulator paper: . Now with non-interactive aggregation of exclusion proofs and vector commitment openings. Also a more efficient way to use accumulators and vector commitments in the account model.
@benafisch
@danboneh
2
21
64
Beyond excited to partner with
@a16zcrypto
and many other amazing partners and angels to make our marketplace for shared sequencing a reality! If you are excited about shared sequencing or simply like coffee based puns go check out the job descriptions in the thread below!
We’re excited to announce that Espresso Systems has raised a $28 million Series B round led by
@a16zcrypto
.
138
314
2K
4
3
63
Decentralized Private Computation allows you to not just hide senders/receivers and amounts of transactions but even the rules (think smart contract or SCRIPT) of the transaction itself. We developed VERI-ZEXE which makes DPC practical by (almost fully) removing trusted setups.
Introducing VERI-ZEXE!
VERI-ZEXE is a decentralized private computation system that will be used in future versions of CAPE to enable arbitrary, user-defined privacy policies for Web3 assets and interactions.
2
11
64
10
13
63
O(1) labs is using recursive SNARKs to build a constant size/ constant time to download and check blockchain. One of the coolest projects out there! They raised some money to do this but more importantly you can now build on Coda and help contribute in many new ways:
We're announcing a $15M fundraise in
@o1_labs
and new ways community members will be able to contribute to Coda. Check out our full announcement here:
13
51
191
1
10
60
Dan Boneh
@benafisch
and I wrote a small survey about the recently published VDFs by Pietrzak and Wesolowski showing how one of them can be instantiated without a trusted setup and comparing their security assumptions:
1
22
60
"Crypto literally solves this" is almost a meme, but in this case, it actually does. Of course, there is a lot of work to do, but self-custody/decentralized finance/proofs of reserves all exist and help against fraudulent, overleveraged, centralized exchanges.
The collapse of a centralized casino actually demonstrated the need for crypto (self custody, transparency etc.)
But what are the actual use cases of crypto and why does it matter?
I'm doing a deep dive on one of them: DeFi lending
52
82
395
12
8
58
Marketing spend worth it!
0
2
58
@TheBlueMatt
Serious question: What has made lightning so hard to build? Bitcoin and other blockchain protocols were built in a few years (and been stable) but lightning has seemingly been in alpha/beta for a decade.
19
1
52
I guess I am doing twitter now... Check out my new website
4
9
53
Excited for
#SBC20
tomorrow! 1400 tickets given away for free, amazing talks set up and for once Stanford is coming through with good weather!
2
9
54
Seems like people are excited about the new 2015 MacBook
3
5
55
We've updated the ProtoStar paper to add optimized algorithms for computing the cross/error terms in different scenarios. We also fixed a bug related to non-uniform circuits.
CC:
@Charles_Chen533
1
8
54
Really excited to announce that we just launched CAPE on the Görli testnet! CAPE let’s you wrap any ERC20 token into a CAPEd token with customizable privacy. Please go play around with it and let us know what you think!
CAPE is now live on Ethereum's Goerli testnet 🦸🏻
If you don't know, CAPE stands for Configurable Asset Privacy for Ethereum: meaning you get to decide who can see data about your transactions
You can get started with CAPE here:
40
87
226
0
7
53
We are building a decentralized sequencer! Read all about it, our first testnet, our hotshot consensus and our roadmap in the blog posts below!
☕️ Testnet 1 and Roadmap Release! ☕️
Today we are sharing more about our plans to contribute to L2 scaling efforts in the Ethereum ecosystem and beyond.
Introducing the Espresso Sequencer:
102
150
374
3
27
49
Flyclient (Super light clients aka NIPoPoWs for PoW chains) has been accepted to Oakland which is a conference that is called IEEE S&P and is in San Francisco. It's been a super fun project with great coauthors
@lululixious
@mahdi_zamani_
@loi_luu
Paper:
Super thrilled to announce I’ve had a paper accepted to IEEE S&P ‘20! It’s a work titled “FlyClient: Super-light clients for cryptocurrencies” with
@benediktbuenz
,
@mahdi_zamani_
and Loi Lulu
4
9
41
1
7
50
Are you concerned about the environmental impact of Proof of Work?
Yes
170
No
449
38
4
45
Agreed. We wrote a paper after the Mtgox hack on how to efficiently do this with ZK proofs: it should be much more efficient these days with new zk proofs like Bulletproofs, Hyrax, SNARKs, STARKs...
Given the recent rumors about fractional reserve at exchanges, and in particular them not being upfront with it, I'm tempted to pick up the blinded proof-of-reserves work again:
4
30
120
2
7
48
We significantly updated the Flyclient construction and paper especially how we handle the variable difficulty setting.
@lululixious
@mahdi_zamani_
4
11
46
Screw blockchains the fashion industry is where Bulletproofs will have the largest impact.
By popular demand, the Bulletproofs R1CS proof system diagram tshirts (designed by
@oleganza
) are available for purchase on teespring!
We hope this shirt will be a helpful visual as you explain Bulletproofs to others in your day-to-day conversations :)
1
16
100
3
1
48
@pwuille
@udiWertheimer
@nopara73
Totally agree but expanding on "cooler things": With BLS all signatures in a block (or even in the whole blockchain) can be aggregated to be just 32 bytes. Not per signature but 32 bytes total. Also am contractually obligated to hype BLS ;). For more:
1
5
47
Is it fair to claim that Bulletproofs is the most widely used zero-knowledge proof today? Monero has ~20k transactions per day vs. ZCash <1k shielded. Anything outside blockchain? Don't want to make a false claim.
16
2
44
Wild day: almost late to first panel cause my brother (“accidentally”) locked me into his apartment.
Almost late to second panel cause I had to recover my stolen headphones by knocking on the thieves door (“look buddy it’s ringing inside your apartment”). Thanks apple FindMy!
1
1
45
Watch my talk on Accumulators and Vector Commitments for Blockchains and IOPs(STARKs) in 45 minutes:
#ScalingBitcoin
2
14
45
What is a SNARK?
n=size of the statement
I have seen
o(n) proof size
log(n) proof size
O(1) proof size
Same as above but proof size + verification time
Any of the above but with trusted setup
A pairing based protocol akin to GGPR based on knowledge assumptions
a fictional animal
5
2
41
This is open source research for everyone to use and our effort to support the zk (rollup) space. If you want to learn more about what we do at espresso read this:
Cool new paper by
@benediktbuenz
and
@Charles_Chen533
from
@EspressoSys
! Just to clarify for everyone confused (because I got asked), this is just cool research, we are not building our own zk-rollup at Espresso 🤣— we are a platform for decentralized and shared sequencing.
0
3
36
3
11
36
Inner pairing products are already in production and are helping Filecoin aggregate millions of snarks. And all this despite Reviewer 2 repeatedly disliking it
The Filecoin Network is the largest SNARK system in production (over 5M SNARKs daily).
We worked on SnarkPack to aggregate our proofs: no extra trusted setup, no two curves, faster aggregation.
Very excited for the hard work the researchers did to go from theory to production!
3
28
104
0
6
39
My recent talk about Bitcoin,cryptocurrencies, Lightning Network and confidential transaction @ Cafe Sci Stanford Blood Center (
@giveblood
) is online: This fills the void of hour long introductory blockchain talks delivered with a German accent.
2
10
43
In our latest detailed technical blog post, we describe how to derive rollup blocks from espresso blocks. We also show how this pipeline can be used to build atomic transactions.
Cowritten by
@CurryHoward42
@getsqt
with input from many others.
1
6
41
Luckily Monero/Ristretto/zkcrypto/libsecp256k1 had it right from the beginning and were not affected. This shows how error-prone implementing Fiat-Shamir is and it's best to use a library like Merlin
3
6
39
Really proud of all the work that went into our latest testnet Gibraltar. Now with a full
@arbitrum
stack integration! 🧱🧱 ☕️
The Espresso Sequencer exists to scale Ethereum rollups.
To support this vision, we're excited to unveil our work integrating with the
@Arbitrum
stack.
This integration is a part of our latest testnet release:
Gibraltar.
31
168
706
1
5
33
It has also been peer-reviewed and will officially be appear in the proceedings of
@IEEESSP
2018 (Oakland).
0
1
39
Apparently a controversial take but the program committee and session chairs (and anyone else doing work for the conference) should get to attend for free.
5
2
41
Very excited for this! Flyclient will help improve light client support for ZCash and enable atomic swaps with other cryptocurrencies
FlyClient support will be live on
#Zcash
in the Heartwood network upgrade! Kudos to
@benediktbuenz
and
@lululixious
for the FlyClient paper;
@therealyingtong
,
@_prestwich
and
@gakonst
for ZIP 221; and
@NikolayVolf
for the implementation!
3
14
33
4
4
39
Basically new work with Mary Maller,
@zkproofs
and Noah Vessely: Inner Pairing Product for outsourcing BLS, aggregating Groth16 SNARKs and a new poly commit with only sqrt opening time (log proof size/verifier) which works well for sparse polynomials.
0
10
38
Check out our state-of-the-art cryptographic library! It features the fastest and most feature-complete Plonk implementation. Including a Plonk verifier gate with only 22k gates (useful for recursive SNARKs and many other things).
Check out Jellyfish: a toolkit of various cryptographic primitives—ranging from hash functions to accumulators to zero-knowledge proof systems.
1
7
20
3
9
39
BLS and blockchains seem to be a perfect match: 1st: N signers of 1 transaction= 1 signature, 1 pk and ex post aggregation! 2nd N signers N transactions= N pks and 1 signature. 3rd N pks subset signs= Description of subset + 1 sig +1 pk
4
8
33
ICYMI: Based Espresso: A marketplace for shared sequencing. Sequencers can sell their sequencing rights to proposers. Proposers can buy multiple rollups at the same time and satisfy cross-rollup intents (e.g. atomic execution). Learn more here
Our mission is to preserve Ethereum's core value: composability.
Based Espresso is our latest development towards a future of composable L2s.
This design sees L2s retain autonomy over their sequencing rights, and supports any Ethereum L2, from based rollups to validiums:
8
62
310
0
4
35
Very excited to announce our second testnet (and our sleek rebrand): Doppio!
As Ethereum builds a rollup-centric future, rollups are exploring how to decentralize their sequencer and improve interoperability.
To further this vision, we are building the Espresso Sequencer.
Today, we are excited to announce our second major milestone and testnet:
Doppio.
17
303
436
1
5
33
@miketwenty1
@pwuille
@udiWertheimer
@nopara73
DSA/ECDSA was designed to circumvent the patent that existed on Schnorr. That patent has since expired and Schnorr seems to be a superior signature algorithm. With segwit Schnorr/BLS can be softforked in. I would also advice any fork/new project to not use ECDSA!
1
6
34
The whole point of decentralization is the removal of single points of failure. The fall of FTX does not affect the underlying protocols and other independent institutions in the ecosystem. In contrast one bank failing directly leads to all banks failing.
The irrationality of being negative on crypto after a centralized casino demonstrated the need for crypto (self custody, transparency etc.) is so fascinating
32
171
686
4
6
34
Watch Ben’s talk on shared sequencers, sequencer economics and based sequencing! If you’ve ever thought about Rollups this is the talk to watch
Sharing a Sequencer Is Caring About Interoperability
Presented by
@benafisch
from
@EspressoSys
Watch the full video below 👇
1
2
15
2
3
33
CoinDesk wrote an article about
@benafisch
, Dan and my paper on accumulators as well as
@tdryja
‘s utreexo.
A new approach to storing bitcoin's "state" could help significantly reduce storage requirements for users of the cryptocurrency.
8
58
161
2
9
34
How does the Espresso Marketplace deal with MEV? There are 3 different ways:
1) MEV capturing and redistribution
2) Reputation and allow lists
3) Encrypted transactions.
Rollups can individually choose between all of them.
A small 🧵
2
3
36
Moves from SF to NYC. Earthquakes seemingly moved with me
3
0
35
#SBC20
is over but fear not you can already relive your favorite memories by watching the videos online:
1
5
33
If you are in Tel Aviv at
#ScalingBitcoin
you should get up early on Wednesday and watch
@benafisch
’s invited talk. Or just stream it at . There will be some exciting new results presented and you don’t want to be left in the dark...
CC:
@aszepieniec
2
2
32
In case you missed it: here is my talk from Sequencing Day about the
@EspressoSys
Sequencer Marketplace Design:
0
5
33
AggLayer and Espresso go together like coffee and milk! AggLayer enables within-block message passing and shared liquidity through aggregated proving. This makes shared block creation, which the Espresso marketplace enables, even more useful.
Espresso 🤝 AggLayer
@0xPolygon
Labs and Espresso Systems are working to solve the biggest challenge facing Ethereum rollups and L2s:
Interoperability.
16
43
257
3
1
33
Very excited to work with the amazing team @ Eigenlayer and use Eigenlayer restaking to bring Ethereum level security to Espresso.
We are excited to announce an ecosystem partnership with
@eigenlayer
.
We'll be collaborating to bring restaking to the Espresso Sequencer network.
11
43
215
0
3
30
We updated the inner pairing product paper: . One of the main things we added is a high quality implementation of all of our primitives which you can find here: Talk:
@SimonsInstitute
: CC:
@zkproofs
@psiv_
0
4
32
Why don’t we use statistical estimation to get the true number of cases? Test 1000 people randomly and go from there or build a model based on the tests that have been done (obviously much harder cause the current tests are highly biased towards symptomatic people)
16
5
30
Seems like Germany is planning to do anti body tests on 100k random people a week:
Why don’t we use statistical estimation to get the true number of cases? Test 1000 people randomly and go from there or build a model based on the tests that have been done (obviously much harder cause the current tests are highly biased towards symptomatic people)
16
5
30
4
2
31
@pwuille
@udiWertheimer
@nopara73
Just for the record, I 100% agree with everything you are saying and let's not forget the real enemy: ECDSA
1
1
31
Submission to the Stanford Blockchain Conference closes in 4 days:
2
9
29