Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions src/trees/internal/security.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,11 +43,11 @@ In all of these protocols, the same layered pattern appears: an interactive, inf
### Targeting 128 Bits of Security
Before proving becomes mandatory on Ethereum L1, zkEVM systems are expected to achieve at least **128 bits of security**. This level of assurance ensures that even powerful, well-resourced adversaries cannot forge proofs or compromise the integrity of the system. During the initial rollout—where proofs may be optional and value at risk is low—some projects may temporarily operate at lower thresholds (e.g., 100-bit security) to test APIs and proving infrastructure. But the target remains clear: 128-bit security is a requirement before mandatory proving can be considered safe.

So what does 128-bit security mean? In cryptographic terms, it means that any adversary's probability of successfully breaking the system per unit of time is bounded by $2^{-128}$. More formally, if an attacker has an advantage $\epsilon$ after spending time $t$ trying to break the system, then 128-bit security requires that $\epsilon / t \leq 2^{-128}$. This benchmark reflects what the cryptographic community considers a safe margin, even against nation-state level adversaries.
So what does 128-bit security mean? In cryptographic terms, it means that any adversary's probability of successfully breaking the system per unit of time is bounded by \\(2^{-128}\\). More formally, if an attacker has an advantage \\(\epsilon\\) after spending time \\(t\\) trying to break the system, then 128-bit security requires that \\(\epsilon / t \leq 2^{-128}\\). This benchmark reflects what the cryptographic community considers a safe margin, even against nation-state level adversaries.

To put this in context, [NIST’s guidelines on key management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf) cite 128 bits as the minimum acceptable security level for long-term use, particularly for systems intended to remain secure beyond 2031. This standard underlies a wide range of protocols and systems, including AES-128, elliptic curve cryptography over 256-bit fields, TLS, IPsec, and others.

For a concrete sense of what’s computationally feasible, consider Bitcoin mining. As of 2025, the most difficult known Bitcoin block ([Block 756951](https://blockchair.com/bitcoin/block/756951)) had a hash with 97 leading zero bits. Statistically, achieving such a result requires around $2^{97}$ SHA-256 evaluations in expectation. This gives a tangible measure of the scale of effort possible with globally distributed hashpower.
For a concrete sense of what’s computationally feasible, consider Bitcoin mining. As of 2025, the most difficult known Bitcoin block ([Block 756951](https://blockchair.com/bitcoin/block/756951)) had a hash with 97 leading zero bits. Statistically, achieving such a result requires around \\(2^{97}\\) SHA-256 evaluations in expectation. This gives a tangible measure of the scale of effort possible with globally distributed hashpower.

## Measuring Bit Security in zkEVMs

Expand All @@ -63,7 +63,7 @@ Assessing the bit security of a zkEVM means understanding how soundness can degr
The Fiat-Shamir transform replaces verifier randomness with hash outputs. Soundness here assumes the hash behaves like a **random oracle**, which is a heuristic assumption. Bit security is typically estimated from the preimage or collision resistance of the hash function, though it's often slightly weaker in practice due to modeling gaps.

- **Grindability of Fiat-Shamir**
In some systems, adversaries can try multiple inputs to the hash function—called **grinding**—to find a challenge that helps them cheat. If the success probability per attempt is $p$, and the adversary can try $n$ transcripts then the overall success probability is bounded by $p \cdot n$. In multiround protocols with many Fiat-Shamir challenges, this attack can reduce the effective bit security.
In some systems, adversaries can try multiple inputs to the hash function—called **grinding**—to find a challenge that helps them cheat. If the success probability per attempt is \\(p\\), and the adversary can try \\(n\\) transcripts then the overall success probability is bounded by \\(p \cdot n\\). In multiround protocols with many Fiat-Shamir challenges, this attack can reduce the effective bit security.

In practice, the total bit security of a zkEVM is limited by **its weakest link**. Even if most components offer 128-bit security, a single step with only 110 bits of assurance could lower the system’s effective strength. Because of this, security analysis should account for all components, their assumptions, and how they compose.

Expand Down