Ethereum L1 abandons Poseidon in post-quantization operations

Justin Drake, a researcher at the Ethereum Foundation, said that the first layer of the network will abandon Poseidon and switch to mature hash functions such as SHA-2 or BLAKE2s after eight years of eight-digit research investment.

Summary

Ethereum's L1 roadmap will use traditional hash functions rather than the Poseidon function that focuses on SNARK. The binary domain SNARK is said to be able to certify approximately 1 million traditional hash calls per second. leanVM for production environments is planned to be launched in 2027, followed by layer deployment in 2028. Hash-based signatures are a core part of Ethereum's plan to deal with quantum computers.

Ethereum L1 abandons Poseidon

Justin Drake said in a platform X post on August 13 that the Ethereum Foundation is abandoning the use of Poseidon in its L1 roadmap in favor of traditional options such as SHA or BLAKE. "Goodbye, Poseidon!" Drake wrote that he described the decision as the dream ending of an "eight-year, eight-digit exploration journey" in post-quantum cryptography.

Poseidon appeared in 2019 as a hash function designed specifically for zero-knowledge proof systems. Its structure makes it cheaper to process within the Concise Non-Interactive Demonstration of Knowledge (SNARK) than traditional hash functions based on binary operations. Since 2018, the Ethereum Foundation has been investing in dedicated hash functions as part of its zero-knowledge technology work. Poseidon subsequently became a common choice for zk-rollup and zkVM, including those that protect billions of dollars in crypto assets.

Drake's announcement concerns Ethereum's future L1 architecture, rather than immediately removing Poseidon from existing applications. Rollup, virtual machines, and other projects that already use this function do not need to replace it due to roadmap decisions. Prove that advances in system design have now changed the trade-offs that initially favored Poseidon. According to Drake, when paired with SNARK, which is designed around binary computing, mature functions such as SHA-2 and BLAKE2s can match its performance. "In hindsight, the key is not the SNARK-friendly hash function, but the hash-friendly SNARK."

Binary fields SNARK make traditional hash functions practical

Binary fields allow the proof system to more naturally handle the Boolean logic used by standard hash functions. Early SNARK designs often relied on large prime fields, where bit-based operations such as XOR can be costly. Working on the smallest prime number 2 allows the binary field system to align its calculations with the 0s and 1s used in regular calculations. Drake said the resulting design could prove about 1 million traditional hash calls per second on a laptop, at approximately 100 times the cost of local CPU execution.

Research projects including Binius and Flock have contributed to performance improvements, according to posts. Binius applies binary field arithmetic to zero-knowledge proofs, while Flock focuses on proving large quantities of Boolean calculations, including calculations involving SHA-256, Kescak, and BLAKE3. Drake also mentioned SNARK.fast, an open automation research project that uses artificial intelligence to improve proof code. Its strongest result reached 1.8 million BLAKE3 compressions per second, a 255% increase over the initial benchmark.

Using mature hash functions can reduce Ethereum's reliance on dedicated cryptographic functions that require years of separate analysis. SHA and BLAKE have been extensively studied outside of zero-knowledge systems, although their implementation within Ethereum still requires research, auditing and testing. This decision also changed the relationship between the Ethereum hash function and its proof infrastructure. Instead of designing new hash functions around the limitations of SNARK, researchers can build SNARK around hash functions with a long-term security record.

Ethereum's post-quantum work favors hash-based signatures

Drake linked the decision to Ethereum's post-quantum security program, which is preparing computers capable of cracking elliptic curve cryptography. Ethereum currently relies on such systems for user accounts and part of its consensus and data infrastructure. Co-founder Vitalik Buterin has reportedly elevated quantum security to a higher position on the Ethereum update roadmap. The plan also covers native privacy, formal verification, post-quantum extensions and possible replacements of some components of the Ethereum virtual machine.

Drake said recent advances in artificial intelligence-assisted cryptanalysis have caused setbacks for more complex post-quantum systems. He specifically mentioned the HAWK design based on lattice signatures and SQIsign, which relies on homology cryptography. According to his assessment, these issues strengthen the case for using hash-based signatures on blockchain. Such designs use relatively simple and extensively researched assumptions, although a single signature may be too large for Ethereum's current size. SNARK aggregation provides a way to solve size issues. Rather than requiring each signature to be placed and checked separately, a certification system can verify many hash-based signatures and compress the results into a smaller certification to be submitted to the network.

The same approach can support multi-signature arrangements and k-of-n threshold signatures, where transactions require approval from a specified number of participants. Drake said flexibility comes from using SNARK to prove authorization rules without having to put all the underlying signature data on the chain. Wallet level preparations are already under testing. In June, an Ethereum researcher demonstrated account protection using a SPHINCS-based signature verifier, an optimized version of which consumed approximately 127,000 gas and carried a 3704-byte signature. The researchers estimated the verification cost per account to be approximately $0.07.

U.S. standards increase pressure for advance preparation

For U.S. investors and businesses using Ethereum, the roadmap addresses a security risk that federal standards bodies have begun to view as a migration issue. The National Institute of Standards and Technology finalized the first three post-quantum cryptography standards in August 2024 and encouraged system administrators to start integrating them. NIST's standards do not guide Ethereum's protocol selection, and the algorithm chosen by the agency does not in itself make the network quantum secure. However, its migration work shows that U.S. agencies are preparing before relevant quantum computers are available.

An independent advisory committee to Coinbase reached a similar position in a 50-page paper released in April. Its members include Drake, Stanford cryptographer Dan Bonet, EigenLayer founder Sriram Kanan, Coinbase cryptography head Yehuda Lindell, and distributed systems researcher Dalia Marki. The committee concluded that the current blockchain remains secure from quantum attacks, but warned that replacing vulnerable signatures on the network, wallets and exchanges could take years. According to the consultant paper, some quantum-resistant alternatives could increase blockchain data requirements by as much as 38 times. Ethereum Proof of Use aggregation aims to limit such costs while replacing vulnerable cryptography. Drake said that hash-based SNARK can compress any number of post-quantum signatures into a compact proof that is suitable for inclusion in a block.

LeanVM targets to go into production in 2027

The Ethereum Foundation's post-quantum team is developing binary domain infrastructure as part of leanVM. leanVM is the smallest zero-knowledge virtual machine designed to verify and aggregate cryptographic proofs. Drake said the current plan is to launch production-grade leanVM in 2027. Deployments involving the Ethereum consensus, data and execution layers are planned for 2028, although each protocol change still requires implementation, testing and consensus among Ethereum's independent development teams. The timetable is located in Ethereum's "Strawmap", a technical coordination document that covers until 2029 rather than a finalized activation calendar. An early Strawmap report described seven proposed forks, covering faster time slots, shorter final confirmation times, post-quantum cryptography, privacy and higher network capacity.

Ethereum's post-quantum team is currently working with Binius, Flock and related binary domain systems while developing leanVM benchmarks. Drake said that the planned 2028 work will apply the resulting proof technology to the consensus layer, data layer and execution layer respectively.