Zcash proposal targets quantum links in shielded pools

It describes a post-quantum binary-field SNARK called Flock and a recovery protocol for Tornado Cash-style privacy pools.

The vulnerability is specific. Privacy pools rely on the hardness of the discrete logarithm problem. A powerful enough quantum computer breaks that assumption and, for Zcash, could compromise an incoming viewing key in ways that connect previously shielded payments tied to an account.

The proposal’s author, @winderica, wrote: “we port Tornado Cash to Flock, a post-quantum binary-field SNARK, proving a depth-32 withdrawal over SHA-256 in under 30 ms, and describe a simple recovery protocol, requiring only that wallets derive note secrets from a seed, that lets existing pools survive a discrete log break.”

Seed handling is the central requirement. Wallets would derive note secrets from a 256-bit seeds, specifically deriving(k, r) from it — and the recovery protocol only works for pools that adopt a recovery verifier.

The figures show the implementation tradeoff. A single withdrawal proves in 19.5 milliseconds and produces a 203.6 KiB proof. Aggregated, that grows to 343.9 KiB, with verification running between 46 and 64 milliseconds. The aggregator side is slower: folding each withdrawal takes roughly 0.68 seconds. Per-user proving is fast; the service combining withdrawals absorbs most of the compute.

The document compares two proving paths directly. The monolithic depth-32 prover takes 0.81 seconds; the stepwise path takes 28.6 milliseconds — a ratio of about 28.3x, which matches the proposal’s “28x faster” figure. These are proposal benchmarks, not confirmed production numbers.

For pool users, notes created with seed-derived secrets would have a recovery path if the discrete-log assumption eventually fails. Aggregators carry the roughly 0.68-second folding cost per withdrawal. The proposal gives no deployment date, and recovery works only for pools that adopt a recovery verifier.

@winderica’s stated direction is that “privacy pools should now start to transition their stack to battle-tested cryptographic primitives.”

Zakura developer Adam Tucker proposed “one-time” viewing keys for each address that must be posted publicly during NEAR Intents swaps, deriving a separate incoming viewing key for every published address while leaving the spending key untouched. Decrypt’s report covers the proposal in detail.

Tucker’s concern is reuse across swaps. Without the change, Decrypt reports he described the exposure as: “a single published shielded address lets a quantum attacker link every payment that address’s key has ever received.” One-time viewing keys mean breaking a posted swap address wouldn’t reach the account’s broader transaction history.

Zakura’s fix requires no network upgrade. Wallets would use private information retrieval to keep the extra keys from slowing seed-phrase restores. Wallets built on Zakura’s open-source libraries, including Vizor, are expected to add the feature within weeks; hardware wallet support would follow once firmware catches up.

The two proposals operate at different layers. Flock addresses recovery and proving for Tornado Cash-style pools. Zakura’s one-time viewing keys address shielded addresses posted for NEAR Intents swaps. Both are aimed at the same failure condition — a future quantum break turning one revealed key into a map of past payments.

Zcash’s broader roadmap includes post-quantum signature opcodes expected in January. Josh Swihart, CEO of Zcash Open Development Lab, said in May that Zcash was targeting full post-quantum status within 12 to 18 months. The two proposals add wallet and proving requirements to that timeline, though the full deployment schedule for the privacy-pool fix remains unspecified.

Zcash was trading at $1,165 on Monday morning, up 3.6% on the day, according to Decrypt.