Just thought I’ll drop a quick preliminary update here. Remember this is all work in progress and nothing is final.
Research Direction for a Post-Quantum Successor to Lelantus Spark
Representatives from Firo, HashCloak, and CypherStack discussed possible foundations for a post-quantum successor to Lelantus Spark. No final protocol has been selected; the immediate goal is to identify and test the most promising building block before designing the complete system.
Leading direction: BLOOM
The leading candidate is BLOOM, a lattice-based one-out-of-many proof system that can produce relatively compact ring signatures and public keys.
BLOOM does not currently provide every property required by a Spark successor. In particular, the system needs linkability: the ability to recognize repeated use of the same secret without revealing which ring member owns it. This is essential for preventing double-spending in a privacy-preserving cryptocurrency.
The central research question is therefore whether BLOOM can be extended with a secure linking tag using techniques similar to those in Calamari and Falafl. The construction appears plausible because the schemes share similar one-out-of-many proof components, but its security and compatibility still need to be established formally.
Why implementation and benchmarking are necessary
Academic results alone do not establish that a construction is practical for Firo. Compact signatures and keys may come at the cost of slow proof generation or verification, and published benchmarks may use unrealistic parameters or high-end hardware.
A first implementation should measure:
-
Signature and public-key sizes
-
Signing and proof-generation time
-
Verification time
-
Bandwidth and storage requirements
-
Scaling as the anonymity set grows
-
Performance on ordinary consumer hardware
Testing should emphasize realistic anonymity sets rather than extremely large rings that are unlikely to be used in practice. The group also identified linear growth, limited batching, and slow verification as potential concerns.
Alternatives considered
Several related constructions were discussed, including Calamari and Falafl, SMILE, MatRiCT, Lattice RingCT, PURSE, and newer work on many-time linkable ring signatures.
These provide useful techniques, but none was immediately identified as a complete replacement for Spark. Potential limitations include large signatures, linear scaling, slow computation, one-time-key restrictions, and insufficient or unclear real-world benchmarks. PURSE’s lattice-based verifiable random function may still be useful as a component, while newer many-time constructions warrant further study.
The preferred strategy is to begin with BLOOM and reuse established linkability techniques where possible, rather than designing an entirely new construction from scratch.
Migration should follow protocol design
The group agreed that a detailed migration mechanism cannot be designed responsibly until the successor protocol is better defined. Migration will need to prove ownership of funds between the existing and new systems while preventing supply inflation, theft, or accidental loss.
Generic proof systems such as STARKs could potentially support migration, but their proof sizes and performance may conflict with Firo’s design and throughput requirements. The appropriate mechanism depends on the final destination protocol.
The group was also skeptical that narrow “harvest now, decrypt later” mitigations would meaningfully protect existing on-chain data. Hybrid post-quantum measures may help at the networking layer, but they do not solve weaknesses elsewhere in the transaction system. Any interim protection should therefore be evaluated against a complete and clearly quantified threat model.
Proposed first milestone
The proposed first phase is deliberately narrow:
-
Determine whether BLOOM can be securely extended into a linkable ring-signature construction.
-
Build a practical implementation and benchmark it under realistic parameters.
-
Evaluate its suitability as the foundational privacy component of a post-quantum Spark successor.
-
Document any failure clearly and identify which implementation work can be reused for the next candidate.
-
Use the results to scope the remaining components and eventual migration strategy.
The theoretical analysis and implementation work can proceed in parallel. Much of the underlying lattice arithmetic and supporting infrastructure should remain reusable even if BLOOM proves unsuitable.
The result of this milestone should be a concrete, evidence-based decision: either BLOOM provides a viable foundation for the successor protocol, or the project moves to the next candidate with a clearer understanding of the practical constraints.