Bitcoin's Quantum Dilemma: Expand Blocks or Adopt STARK Proofs?

Author: Andrew Fenton; Source: Cointelegraph; Compilation: Shaw, Golden Finance

StarkWare co-founder Eli Ben-Sasson said that ZK-STARK is the optimal solution to address the various issues arising from achieving quantum resistance for Bitcoin, while also driving Bitcoin toward mass adoption.

Additionally, he claims that Blockstream founder Adam Back agrees with this view.

This week, Eli Ben-Sasson made headlines for posting a controversial proposal on X, suggesting raising Bitcoin's annual inflation rate to 4%. Grok's analysis of the comments showed that no one explicitly supported the proposal.

However, as the co-inventor of STARK (a quantum-safe, hash-based zero-knowledge proof system), his stance on this technological path is much more solid, with some top Bitcoin researchers also endorsing the idea.

Eli Ben-Sasson's project StarkNet last week released its Phase 3 roadmap, aiming to achieve quantum resistance for its own network.

The Challenge of Large Post-Quantum Signatures for Bitcoin

Simply introducing zero-knowledge proofs to Bitcoin does not directly make the blockchain quantum-safe. The introduction of ZK proofs is to solve the various pain points that arise after Bitcoin deploys much larger post-quantum (PQ) signature schemes.

The post-quantum signatures currently selected by the National Institute of Standards and Technology (NIST) are 10 to 100 times larger in data size than Bitcoin's existing ECDSA and Schnorr signature schemes.

Some argue that if such signatures are deployed directly, Bitcoin's network throughput could drop to less than one transaction per second. However, all the bulky transaction signatures in a block can be compressed into a single tiny ZK-STARK proof. Since this proof is even smaller than the total size of existing signatures, the blockchain could ultimately run faster.

Eli Ben-Sasson pointed out: "If you don't adopt ZK-STARK signature aggregation, it would undoubtedly be a bad move, because it doesn't truly solve the core problem — whether ordinary people can use Bitcoin smoothly."

"To achieve the goal, the network must have extremely high scalability. To achieve this, technologies like signature aggregation are indispensable; simply increasing block capacity is far from enough."

Another Path in the Quantum Era: Scaling Bitcoin's Block Size

Marin Ivezic, a contributor to PostQuantum.com and founder of Applied Quantum, told Cointelegraph that Bitcoin's Segregated Witness (SegWit) scheme can reduce the occupancy of large signatures by up to 75%. However, he conducted modeling calculations on NIST's ML-DSA-44 algorithm: the single signature size is up to 2420 bytes, reducing the number of transactions per block from the current 2500–3000 to about 500–700, bringing the block size debate to the forefront.

Scaling Bitcoin's block capacity is indeed a viable alternative, but as early as 2017, the community was deeply divided over the proposal to double block capacity. Many of the objections from back then still hold true today: block size scaling is a crude solution that requires all nodes to transmit, store, and verify significantly larger amounts of data. This raises the cost and hardware requirements for running nodes, which critics argue will push the network toward centralization.

Blockstream Research has been studying how to compress hash-based post-quantum signature schemes suitable for Bitcoin over the past few months, introducing promising SHRINCS and SHRIMPS signature algorithms. In normal scenarios, the signature size of both is about five times that of Bitcoin's existing signatures; but if a user loses their wallet and needs to recover their account, the signature size can swell up to 40 times that of existing signatures.

Although SHRINCS has been used for real transactions on the Liquid sidechain, the technology is still in early development, with shortcomings in implementation complexity and user experience. Unless block capacity is simultaneously expanded, the surge in signature size will still slow down the entire blockchain.

Regarding block scaling, Marin Ivezic commented: "Increasing native network throughput is the simplest from an engineering perspective, but the most difficult to implement from a governance standpoint. We don't have enough time to repeat this kind of debate."

ZK Proof Aggregation Offers Multiple Advantages

Compared to block scaling, ZK proof aggregation can also increase network capacity while maintaining decentralization and improving Bitcoin's efficiency, making it a better choice.

In the simplest terms, a zero-knowledge (ZK) proof is a mathematical verification method: it can prove a fact without revealing all the details. For example, using a ZK proof, you can prove that you know the password to a safe without revealing the password itself.

In theory, a single block only needs to generate one ZK proof (for redundancy, generating a few extra would be safer); and the cost of running the required hardware is far lower than commercial mining equipment.

Lean Ethereum's planned proof generation equipment costs less than $100k and can be deployed in a typical home environment. Verifying a ZK proof is almost hardware-unconstrained, and can be done on small devices like a Raspberry Pi.

Eli Ben-Sasson said that early Bitcoin developers such as Greg Maxwell and Mike Hearn are very optimistic about ZK-STARK. The technology is quantum-safe and does not require a trusted setup. He believes that Bitcoin core developer Luke Dashjr and Blockstream founder Adam Back are also gradually embracing this technical path.

"I've heard their opinions firsthand. They are optimistic about various solutions built on ZK-STARK. I believe both of them have given positive evaluations, both privately and publicly. Adam Back and Luke Dashjr disagree on many issues, but on this matter, they should agree: this is a good technology, and as long as conditions are right, it has every opportunity to be implemented on Bitcoin."

Cointelegraph contacted Adam Back for comment but has not yet received a response.

Ethereum researcher Justin Drake has publicly expressed hope that Bitcoin will adopt Lean Ethereum's ZK proof aggregation technology, pushing it to become an industry standard. However, due to community governance differences, this vision may be difficult to achieve.

Ethereum aims to achieve post-quantum computing by 2029. Source: Ethereum Foundation

Zero-Knowledge Proof-Related Proposals for Bitcoin

Given the traditionally conservative development tone of the Bitcoin community, the most feasible path from a governance perspective to introduce zero-knowledge technology into the Bitcoin network is likely to re-enable OP_CAT — an opcode written by Satoshi Nakamoto with only nine lines of code.

Eli Ben-Sasson said: "Satoshi originally added OP_CAT but later removed it. Once this opcode is restored, developers can implement STARK proofs, signature aggregation, and post-quantum security features."

"I believe this is the best and safest path to restart the technological development that Satoshi initiated and intended to continue."

Although there was a wave of OP_CAT discussion in the market 12 to 24 months ago, recent momentum has clearly weakened (though the direction of Bitcoin community governance is always unpredictable).

There are also more forward-looking proposals, such as OP_STARK_VERIFY, which aims to add a dedicated opcode to allow Bitcoin to verify STARK proofs more efficiently. Additionally, Ethan Heilman, co-author of BIP-360, proposed the BitZip plan, aiming to aggregate multiple Bitcoin signatures and public keys into a single STARK proof.

Heilman told Cointelegraph earlier this year that there are two main technical paths to achieve the desired effect: "The first option is to add a set of general opcodes in Bitcoin and build a ZK Rollup-like architecture on top; or directly natively support STARK at the Bitcoin consensus layer. Besides that, performance-limited aggregation schemes like CISA (Cross-Input Signature Aggregation) could also play a role."

How Likely Is This Path?

Marin Ivezic believes the obstacle is not technical capability but Bitcoin community governance.

He said: "Eli Ben-Sasson's cryptographic scheme is flawless: entirely based on hash assumptions, no trusted setup required, compressing thousands of signatures into one short proof. The difficulties all lie in the supporting components outside this cryptographic scheme."

"Current Bitcoin scripts are not yet capable of verifying STARK proofs. Compared to a single streamlined hash signature opcode, a production-ready STARK verifier would significantly expand the consensus layer's attack surface. Even a simple opcode like OP_CAT has been debated for years; having a native STARK verifier at the base layer realistically won't be on the agenda until at least the 2030s."

Meanwhile, Ethereum plans to complete its post-quantum upgrade by 2029, and Solana is also experimenting with integrating post-quantum signatures. StarkNet's three-phase quantum-resistant transition can leverage account abstraction advantages: when upgrading the underlying cryptographic scheme, each user does not need to manually migrate assets to new accounts.

Eli Ben-Sasson commented that the post-quantum upgrade path for Solana and Ethereum will be "extremely difficult."

"StarkNet has a core advantage: native support for account abstraction and smart wallets. This means the relevant mechanisms are not hard-coded into the underlying protocol; we can easily upgrade wallets and infrastructure to achieve quantum resistance."