Bitcoin\'s expansion choice: larger blocks or STARK proof

Core Limitations: Post-quantum signatures are incompatible with existing signature regimes

Ben-Sasson\'s view begins with a mismatch between Bitcoin\'s existing cryptographic architecture and what the post-quantum scheme expects. He pointed out that simply adding post-quantum signatures \"in and of themselves\" does not make the chain quantum secure in practice; it first introduces an engineering problem: the size of the new signature will be orders of magnitude larger .

According to the article, the size of the post-quantum signature scheme currently approved by the National Institute of Standards and Technology (NIST) is approximately 10 to 100 times larger than the and Schnorr signatures currently used in Bitcoin . The real risk lies in throughput and verification overhead-an oft-cited concern is that the number of transactions that a block can hold will be significantly reduced.

Ben-Sasson\'s proposed response is to migrate most of the data offline and replace it with a compact cryptographic proof. In his view, the signatures of all transactions within a block can be aggregated into a single ZK STARK proof , whose size is much smaller than that containing the original signature. He believes that this method can maintain or even effectively improve efficiency compared to post-quantum upgrades directly on the chain.

\"If they don\'t allow ZK STARK aggregation, it\'s definitely a very unfortunate move because it doesn\'t really solve the problem... and the core of the problem is \'Can everyone really use Bitcoin?\'\" Ben-Sasson said.

\"So you need to scale up on a large scale. To do this, you need techniques like signature aggregation, and it\'s not enough to just increase the block size.\"

Block Size: As a \"simple engineering\" solution and the controversy it has caused

Ben-Sasson admitted through comments from other experts that one alternative is to increase Bitcoin\'s block size. The controversy is not whether it works-but its cost structure and governance path.

Marin Ivezic\'s model shows that under NIST\'s ML-DSA-44 scheme, block capacity could drop to approximately 500 to 700 transactions , compared to 2500 to 3000 transactions .

This number makes the debate about block size inevitable: If post-quantum signatures cause transaction sizes to increase dramatically, the network will need to find storage space for this data. However, as the article points out, critics argue that block scaling is a crude tactic because it brings greater storage, bandwidth and verification workload to all nodes. Over time, this could mean higher operating costs and possibly less hardware diversity-an outcome opponents believe could decentralize Bitcoin.

The article also mentioned Blockstream Research\'s recent experiments in compressing a hash-based post-quantum signature scheme. Among them, the SHRINCS and SHRIMPS schemes are mentioned. The size of a \"daily\" signature is about five times that of the current Bitcoin signature , and in scenarios such as wallet recovery, the size can even reach 40 times 。This means that even with compression techniques, unless the block size is increased, larger signatures will still be a throughput challenge.

\"Increasing capacity from the native level is the simple engineering answer, but it is the most difficult governance answer,\" Ivezic said. \"We simply don\'t have time for those debates.\"

Why ZK aggregation may be more important than simply increasing capacity

The appeal of ZK STARK aggregation is not just that it is smaller. What it changes is the economics of nodes storing and verifying content.

At a high level, the ZK proof allows a party to prove that a statement holds without exposing all underlying details. In the Bitcoin scenario described in the article, the STARK proof can prove that the necessary conditions for multiple transactions associated with the signature have been met without the chain carrying all individual signature bytes.

Ben-Sasson\'s operational proposition is that generating proof for a block is a task that may only need to be done once, and the proof hardware may be much cheaper than commercial miners. The article further points out that verification certification can be done on very simple devices, and cites Lean Ethereum\'s specification benchmark-in which the certification device may cost less than $100,000 , while verification can be run on almost any device, such as a Raspberry Pi.

Ben-Sasson also believes that the development momentum of ZK STARKs already exists among early Bitcoin developers. He claims that people such as Greg Maxwell and Mike Hearn are \"very optimistic about ZK STARKs\" because they believe STARKs provide post-quantum security that does not require a trusted setting. In the article, he added that he believed core Bitcoin developers Luke Dashjr and Adam Back were more inclined to the idea, although the article said he had not received a response from Back.

article is that Ethereum researcher Justin Drake has expressed the hope that Bitcoin will adopt Lean Ethereum\'s ZK proof aggregation method. However, political constraints can make it difficult to implement in practice-even if technical paths exist.

What conditions does Bitcoin need to have to verify STARKs?

For Bitcoin, the question is not whether ZK STARKs are cryptographically trustworthy, but whether Bitcoin can verify them in a practical and acceptable way . This led the discussion to Bitcoin scripting and governance.