Ethereum co-founder Vitalik Buterin stated that he hopes to incorporate EIP-8288 into a future network upgrade. This proposal aims to move the main computations required for quantum-resistant signatures and STARK proofs out of the execution path, thereby significantly reducing the costs of private transactions.

Current costs are relatively high.

According to the data provided by Buterin, quantum-resistant signatures currently typically range in size from 2 KB to 3 KB. A single verification process costs approximately 150,000 to 200,000 gas. STARK proofs are even larger in size, exceeding 128 KB. If faster generation is desired, the size can even reach 512 KB, and the corresponding verification cost can rise to several million gas.

He stated that the current cost of a well-designed privacy transaction is about 300,000 gas; if quantum resistance is also required, the cost would rise to around 10 million gas. If EIP-8288 is adopted, the costs for both types of transactions could be reduced to the low range of several tens of thousands of gas.

Each block retains only one copy of the proof.

The core approach of this proposal is not to perform the most computationally intensive cryptographic operations directly on the blockchain. Transactions only need to declare a “dependency,” which is a short statement indicating that a message has been signed by a certain key, or that a piece of data meets a certain verification condition. The length of such a declaration is approximately 96 bytes.

Subsequently, the mempool node will collect these declarations every second, generate a recursive STARK proof, and then pass it on. In the end, a single block only needs to carry a unified proof that covers all related transactions.

• Quantum-resistant signature verification: approximately 150,000 to 200,000 gas
• Quantum-resistant privacy transactions: Currently around 10 million gas
• Proposal goal: Reduce to the tens of thousands gas range

RISC-V becomes a key choice

Buterin also mentioned that recursive proofs require a unified language to express the statements to be verified. The currently leading candidate is RISC-V, which is an open instruction set already used in chip design.

If this plan is adopted, RISC-V will actually become one of Ethereum's standard instruction sets. Buterin believes that this is an important decision that requires careful consideration, but he also indicates that this step is necessary.

In July of this year, he proposed a similar direction in a "simplified Ethereum" roadmap, planning to restructure multiple core components of the protocol within three to four years and to place the recursive STARK in a more central position.

It can also be used for private account abstraction.

Buterin also mentioned that another use of this design is to support the abstraction of private accounts. Specifically, the account logic does not need to be made public on the blockchain, and at the same time, all changes in ownership of positions and assets held by that account can be completed through a single transaction, without exposing the specific correspondence between them.

Currently, EIP-8288 is still in the draft stage. Buterin indicates a hope that it will be included in the discussion scope during the next fork after Hegota. Prior to this, he just promoted a transaction structure adjustment plan named Frames, and EIP-8288 is regarded by him as the subsequent step in this direction.