ZKM on X: "https://t.co/PjW9gY4GuX" / X<br>Post

Log inSign up

Post

ZKM

@ProjectZKM

Why Ethereum Walked Away from Poseidon<br>Nearly every major zkVM and zkEVM in production today - including Ziren - runs on Poseidon2. So this decision reaches far beyond Ethereum L1, and it did not come out of nowhere: the pivot has been under open discussion for at least four months. It is genuinely significant.<br>Why did Ethereum adopt a hash function published in 2019 in the first place?<br>The cost of a SNARK/STARK proof is set by the size of the computation after arithmetization - the number of rows once the computation is expressed as a polynomial constraint system over a finite field. Traditional hashes like SHA-256 were designed for CPUs: internally they are AND, XOR, modular addition, and rotation on 32-bit words. Over a large prime field those bit operations are brutally expensive - each bit occupies its own field element, every carry needs constraints, and a single SHA-256 compression costs tens of thousands of R1CS constraints.<br>Poseidon inverted the philosophy: make the hash out of field operations. Its round function has only three components - round-constant addition, an S-box (x^a, a = 3/5/7), and a linear mixing layer - all native additions and multiplications over F_p, so one permutation costs a few hundred constraints. In the Plonky2 era, Poseidon hashing was roughly half of total proving time and the dominant bottleneck. That is the origin of the "SNARK-friendly hash".<br>In the lean Ethereum post-quantum roadmap, Poseidon's role went far beyond "a hash": the post-quantum signatures are hash-based, the state commitments are Merkle trees, the STARK polynomial commitments (the FRI/WHIR line) are Merkle trees too, and the Fiat-Shamir transform is again a hash. The entire post-quantum security reduction of the stack rested on this single primitive - a young one. Which raises the question: would you stake the security of a whole chain on a 2019 design?<br>On security: not broken, but not mature<br>Five months before this decision, Ethproofs held a dedicated Poseidon security review (Call #8, March 20), with attackers and defenders presenting side by side. The picture in one sentence: no break, but the margin is shrinking and the threat model is highly concentrated.<br>The attack progress is real. Merz and Rodriguez Garcia (ETH Zurich, "Skipping Class," ePrint 2026/306) exploited the tensor structure of Poseidon2's external linear layer - (0, 1, -1, 0) is an eigenvector of its left factor matrix, so a +/-X difference pattern passes through the linear layer round after round without diffusing - and built round-skipping algebraic attacks that cut the degree of the equation system from a^R to a^r. They broke the largest instance in the Ethereum Poseidon bounty program (t = 16, p = 2^31 - 1, x^5, 3 full + 4 partial + 3 full rounds), a ~2^18.5 speedup over prior methods, solved in 5.5 hours on a 64-core EPYC.<br>The margin loss comes with numbers. Poseidon co-author Schofnegger reported at the call: Poseidon1 (MDS matrices throughout) is unaffected, but for Poseidon2 the Grobner-basis preimage estimate drops from 2^164 to 2^126 for the 31-bit, t = 16, a = 3 instance, and from 2^174 to 2^123 for t = 24 - both now under the 2^128 mark. Koschatko (TU Graz) re-derived round numbers from the true bottleneck of the Grobner solving pipeline (the FGLM step) and concluded current parameters should gain rounds: t = 16, d = 7 from 8 full / 14 partial to 10 full / 17 partial. In 2026, "are the parameters sufficient" is still an open question under active revision.<br>The concentration is the deeper issue. Perrin (Inria, independent of the design team) made the point at the call: statistical, linear, and differential attacks pose essentially no threat to Poseidon - its entire security rests on a single line of algebraic attacks (polynomial system solving), and the complexity scaling of exactly that line is what the field has not pinned down. His verbatim conclusion: "at this stage, one of the safest AO permutations... which isn't saying much. Still a lot of unknowns!" Contrast SHA-2: twenty-five years of cryptanalysis across the full spectrum - differential, linear, algebraic, structural - and the best pseudo-preimage attack still stops at 52 of 64 rounds of SHA-256. Poseidon2 has had three years of exposure. Poseidon1, seven. The SHA family, decades.<br>The defenders were not without options. The repair paths presented at the call were complete: switch back to MDS matrices (Khovratovich showed the four-round skips cannot exist under an MDS linear layer), circulant MDS layers built from Reed-Solomon codes with manageable performance loss once accelerated by NTT and Karatsuba (Schofnegger), add full rounds at roughly 15% overhead, or a hybrid of Poseidon1 full rounds with Poseidon2 partial rounds. The bounty fund was raised to roughly $1M.<br>Note the posture: the March consensus was "repairable." But a primitive that requires a million-dollar bounty program...