VOLE-based zero-knowledge proofs like QuickSilver and Mac'n'Cheese have set the bar for prover and verifier performance on large circuits. Their core limitation has always been the designated-verifier model: the verifier must hold a secret correlated with the prover, making the proofs useless for public verification, digital signatures, or any setting where anyone needs to be convinced. In 2023, Baum et al. changed this with the VOLE-in-the-head paradigm. This talk is a practitioner's walkthrough of that construction. Baum explains how to compile a VOLE-based proof into a non-interactive, publicly verifiable one using nothing more than cryptographic hash functions. The result is a proof system with conservative, post-quantum security assumptions that avoids the heavy machinery of lattice-based or isogeny-based schemes. He then demonstrates concrete applications, including the FAEST signature scheme and the POMFRIT blind signature scheme, with verification times under 100 milliseconds and blind signature sizes around 30 kilobytes. If you need to evaluate post-quantum signature candidates or understand the next generation of efficient ZK infrastructure, this talk provides the technical grounding without the hype.
Key Takeaways
- VOLE-in-the-head compiles a designated-verifier VOLE proof into a publicly verifiable non-interactive proof by having the prover commit to the verifier's secret VOLE states and opening a random subset, checked via a cut-and-choose protocol rooted in Fischlin's paradigm.
- The construction relies solely on symmetric primitives (hash functions), giving it conservative post-quantum security assumptions unlike schemes based on lattices, codes, or isogenies.
- The FAEST digital signature scheme derived from this approach achieves verification times below 100 milliseconds, outperforming other hash-based signature schemes like SPHINCS+ while maintaining comparable security assumptions.
- The POMFRIT blind signature scheme demonstrates the technique's applicability to privacy-preserving digital identity, with blind signature sizes of 30-40 kilobytes.
- The proof system produces linear-size proofs and is designed for high performance on large circuits, making it practical for real-world deployment in constrained environments.
Who should watch: Applied cryptographers and protocol engineers evaluating post-quantum signature schemes or building privacy-preserving identity systems who need to understand the concrete performance and security tradeoffs of VOLE-in-the-head constructions.
Why This Matters
VOLE-in-the-head represents a pragmatic turn in post-quantum ZK design: instead of chasing asymptotic elegance with exotic assumptions, it wrings public verifiability out of fast symmetric primitives. This talk is a blueprint for how the next generation of real-world signature schemes will be built.
