Author: ChandlerZ, Foresight News
On August 13, Ethereum researcher Justin Drake posted on X that the Ethereum Foundation has decided to abandon the SNARK-friendly hash algorithm Poseidon at the L1 layer and instead adopt traditional hash functions such as SHA2 or BLAKE2.
This decision is backed by eight years of research, tens of millions of dollars of investment, and a significant revision of the post-quantum cryptography roadmap.
Since its launch in 2019, Poseidon has been regarded as an ideal hash solution for applications like zkRollup and zkVM, as its structure makes it cheaper and more efficient in SNARK circuits compared to traditional binary operation-based hash functions. However, as post-quantum security became a necessity for Ethereum, the limitations of Poseidon began to emerge.
Justin Drake stated that this shift is made possible by groundbreaking advancements in SNARK design, specifically through the use of "binary field" computation, which allows traditional hash functions to perform comparably in SNARK circuits to Poseidon, which was previously optimized specifically for SNARK, achieving about 1 million traditional hash call validations per second on a single laptop.
The article explains that Poseidon has been the mainstream SNARK-friendly hash solution providing security for applications like zkRollup and zkVM since its launch in 2019. Justin Drake indicated that plans show that a production-grade leanVM is expected to be launched in 2027, with relevant deployments for the consensus layer, data layer, and execution layer expected to be completed by 2028. The Ethereum Foundation's post-quantum team is also accelerating research related to binary fields.
Why Now?
Traditional hashes have long struggled to enter SNARK due to significant barriers from differences in computational languages. SHA2, BLAKE2s, and Keccak heavily rely on Boolean operations like XOR and shifting, while traditional SNARK typically handles arithmetic over large prime fields, leading to expensive constraint costs when simulating each bit operation. Poseidon was designed directly around arithmetic in prime fields, trading fewer constraints for higher proof speeds, but at the cost of a shorter algorithm history requiring ongoing cryptanalysis.
Binary fields shift the underlying mathematics to the minimal prime field containing only 0 and 1, using binary expansion to carry larger data. Bitwise operations can thus directly enter the proof system, allowing SNARK to adapt traditional hashes, focusing the technology shift from designing SNARK-friendly hashes to designing hash-friendly SNARKs.
The Binius proposal presented by Jim Posen and Benjamin Diamond in 2023 showcases a binary tower-field SNARK pathway. The Flock paper by Benedikt Bünz, Ron Rothblum, and William Wang was uploaded to arXiv on July 29, 2026, with its M4 Max benchmark proving 82,000 BLAKE3 compressions, 42,000 SHA-256 compressions, and 30,000 Keccak permutations per second on a single core, while 10 cores exceeded 660,000 BLAKE3 throughput.
Drake noted that about 1 million traditional hash calls can be proven per second on a laptop, with costs approximately 100 times that of native CPU Boolean computation; SNARK.fast achieved 1.8 million BLAKE3 calls per second on an M3 Max a few days ago.
2027 LeanVM, 2028 Three-Layer Deployment
Another key reason for abandoning Poseidon is that the timeline for post-quantum security is accelerating. The Project Eleven report "The Quantum Threat to Blockchains - 2026 Report" points out that the rapid development of quantum computers poses a serious threat to blockchain security. Once "cryptographically relevant quantum computers" (CRQC) emerge, Shor's algorithm could quickly break ECDSA (used by Bitcoin and most public blockchains) and RSA asymmetric encryption, with Q-Day (quantum break day) anticipated between 2030 and 2033, at which point tens of trillions of dollars in on-chain assets would face risks.
As blockchain public keys are static for long periods and cannot be rolled back, migration becomes extremely difficult. The report recommends an immediate start to post-quantum cryptography (PQC) migration, including lattice-based, hash, and other quantum-resistant signature schemes, and a gradual transition through hybrid solutions to avoid a total quantum threat outbreak.
Justin Drake warned that the enhanced capabilities of AI in cryptanalysis have already put lattice-based schemes HAWK and its homologous scheme SQIsign under pressure. This has forced the Ethereum Foundation to stake its bets on hash-based solutions, which are believed to have stronger resistance to quantum attacks.
Previously, Ethereum has unveiled its post-quantum roadmap, including the deployment of production-grade leanVM in 2027 and completion of deployments for the consensus layer, execution layer, and data availability layer in 2028. LeanVM is a minimized zero-knowledge virtual machine specifically designed for post-quantum signature aggregation and is seen as a central component of the entire strategy.
In March 2026, the Ethereum Foundation launched pq.ethereum.org as a resource center for post-quantum security, and more than 10 client teams have begun running interoperability development networks weekly. The Foundation also established a $1 million Poseidon Prize and an equal amount Proximity Prize to advance post-quantum cryptography research. Vitalik Buterin has also repeatedly emphasized that post-quantum security is a necessary condition for Ethereum’s "walkaway test" (the test that allows one to leave without concern), stating that unless Ethereum achieves quantum safety, it cannot afford to become "stagnant."
The switch in hash functions will not change the overall architecture of Ethereum’s post-quantum roadmap. The BLS signatures currently used by validators rely on elliptic curves, while future solutions will still be based on hash signatures like leanXMSS, further compressed by leanVM into a small proof per block. The previous comparison given by Ethereum's official page was that leanXMSS signatures are about 3,000 bytes, while BLS signatures are only 96 bytes, with leanVM's data compression target being around 250 times.
SHA2 or BLAKE2s have longer histories of public analysis, enabling the Ethereum Foundation to reduce the waiting time for Poseidon parameters to undergo years of cryptanalysis. The strawmap presented by Drake points to a production-grade leanVM in 2027 and deployments of the consensus layer, data layer, and execution layer in 2028.
Racing Peers, Solana Selects Falcon
Ethereum is not the only mainstream public blockchain preparing for the post-quantum era; the Solana Foundation released its post-quantum security roadmap in April 2026, with its core development teams Anza and Jump Crypto's Firedancer independently selecting the same post-quantum signature scheme, Falcon.
Falcon is one of the NIST-standardized post-quantum signature schemes known for its compact signatures, suitable for high-throughput blockchain environments like Solana.
The two major validator client development teams, Anza and Firedancer, have independently arrived at the consensus to adopt the post-quantum digital signature scheme Falcon and have publicly released preliminary implementation code on GitHub. The current roadmap consists of three steps: ongoing evaluation of Falcon and alternatives; adopting post-quantum solutions for new wallets when the quantum threat becomes real; and ultimately migrating existing wallets altogether. Additionally, Blueshift's Solana Winternitz Vault has been running within the ecosystem for over two years and was cited earlier this year in a Google Quantum AI white paper as a frontier case in the industry.
The Solana Foundation stated that while quantum computing poses a substantial threat, there are still several years before it becomes a reality, and immediate migration is not necessary; however, research, infrastructure, and ecosystem coordination are already in place for rapid deployment as the timing matures, which is expected to have no significant impact on network performance.
Starknet is currently the closest reference to the Ethereum Foundation's new direction. StarkWare announced its roadmap on June 30, to be conducted in three phases: the first phase will replace the Pedersen hash algorithm with BLAKE2 for state commitments, contract addresses, and network configurations, while also introducing post-quantum consensus signatures, such as Falcon-512; the second phase focuses on migration tools for traditional contracts, while the last phase addresses existing dependencies related to Ethereum, including bridge system calls and blob data availability; the third phase depends on Ethereum's own migration path.
Relative to other public chains, Ethereum has chosen a path of "set standards first, then move code." Abandoning Poseidon in favor of SHA2/BLAKE2 is, in fact, opting for more mature and widely validated cryptographic primitives for the post-quantum era.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
