Fragile Nonce Selection and ZKPs as a Solution

on YouTube ↗26m

" summary

Shows that deterministic nonce generation (RFC6979/Merlin) fixes single signatures but fails for multi‑party Schnorr/ECDSA because differing challenges leak keys, and proposes embedding a PRF/VRF‑like primitive inside a ZKP so nonces are deterministically proven rather than trusted. Reports an optimized construction for arithmetic circuits under DDH that fits under 2048 multiplication gates (work in progress). ZKPs make transcripts unique and cut replay attacks, but threshold signatures need a broadcast channel — ZKPs don’t remove the requirement when parties can disappear.

AI-written summary · about

" chapters (8)

1. 0:00Fragile nonce selection
2. 2:34Risks of biased nonces
3. 5:43Hardware wallet security
4. 9:57Multi-signature nonce challenges
5. 13:51ZKPs for deterministic nonces
6. 17:04Threshold signatures and broadcast
7. 22:38Can ZKPs replace broadcast?
8. 25:05Conclusion

" related talks

• 51mWhy you shouldn't trust meKeerthana Ganesh, Shubham Patil · NDC Oslo 2022
• 08mCompany PitchesAndrew Poelstra · 1st ZKProof Standards Workshop 2018
• 34mSNARKs and their Practical ApplicationsEran Tromer · Securing Computation (Simons Institute, June 2015)
• 29mZKP Ideal functionalityRan Canetti · 1st ZKProof Standards Workshop 2018
• 37mWhat ZK Can—and Can’t—Do for YouJustin Thaler, Abhi Shelat · DC Privacy Summit 2025
• 01h 05mAn Algebraic Framework for Universal and Updatable zkSNARKsArantxa Zapico · 4th ZKProof Workshop (Home Edition)
• 41mThe Future Is Trustless: How ZkVMS And ZkTLS Transform BugAnto Joseph · Nullcon Goa 2025
• 48mzkSNARKs — Cryptographic Proofs for Scaling and Security ChallengesSergey Prilutskiy · HighLoad++ 2023