Proof-system Protocol Design

Independent research and contributions

October 2025 – present · Remote

Ongoing research and open-source contributions to WHIR — a multilinear polynomial commitment scheme based on an IOP of proximity for constrained Reed–Solomon codes — and its reference Rust implementation whir-p3 (originally tcoratger/whir-p3, now upstreaming into Plonky3/Plonky3). The first three months (October – December 2025) were paid contract work for the Ethereum Foundation, delivered through Lita. After Lita closed I continued voluntarily, including the protocol-design threads below and a pending WHIR-DAS grant proposal.

• Batch opening — selector variable construction. Designed a batch-opening extension proving evaluations of two (or more) multilinear polynomials at distinct points inside a single WHIR proof. The virtual polynomial uses a selector variable $X \in \{0,1\}$ to avoid the cross-terms that break the natural linear-combination approach when opening points differ.
• Alternative-to-padding for mixed-size polynomials. When the two polynomials have different variable counts $m_a \neq m_b$, run $m_a - m_b$ standard sumcheck rounds on the larger polynomial first to reduce the claim, then run the selector combination on equal footing — avoiding the wasted work of zero-padding.
• WhirProof data structure (PR carlo/whir-proof-strc). Designed the serialization-ready proof structure capturing the full WHIR transcript, generic over base/extension fields and MMCS, with an InitialPhase enum encoding the three first-phase shapes (statement+skip, statement-only, no-statement / pure proximity).
• HVZK-WHIR (Plonky3 issue #1586). Implementation of the sublinear-mask HVZK sumcheck (Section 6, Construction 6.3 of ePrint 2026/391), planned to mirror onto both prefix- and suffix-binding sumcheck layouts in whir-p3.
• WHIR-DAS grant proposal. 25,000 EUR / 4-month pitch to plug WHIR into the Foundations-of-DAS compiler (HSW, ePrint 2023/1079) via FRIDA's opening-consistency bridge, producing a transparent post-quantum DAS scheme for Ethereum's Lean Data Layer.
• Protocol exposition. Working write-ups of the WHIR protocol and its relationship to FRI/ZODA, used to onboard collaborators and to anchor the grant pitch.

Cryptography Engineer — Lita (Valida zkVM)

January 2025 – 2025 · Fully remote

Valida is a STARK-based zkVM with a custom ZK-friendly ISA, built on Plonky3 primitives over BabyBear and its quintic extension, with degree-3 AIR constraints and LogUp lookup arguments for cross-chip interactions.

• Continuations / multi-segment proving. Worked across the MultiSegmentBasicMachine coordination layer that splits long executions into bounded-height segments, proves each separately, and glues them via persistent memory-bus arguments.
• ISA and end-to-end IOP. Wrote the full prover/verifier 14-step flow (instance/preprocessed/public/main commitments → permutation challenges → per-segment quotient → opening) and documented the instruction encoding (6 field elements per opcode, Harvard-architecture ROM).
• LogUp lookups. Worked on the chunked-reciprocal LogUp implementation, including the ephemeral / persistent interaction distinction that threads memory state across segment boundaries.
• Keccak-f chip. Implemented the KeccakFChip with the degree-3-safe XOR3 expansion needed to keep three-input XOR within the constraint budget.
• Soundness analysis. Documented theoretical guarantees and practical capacity bounds — cumulative-sum overflow in $F_{p^5}$, per-segment LogUp limits, and operational recommendations.

VampIR — Heliax / Anoma Protocol

April 2022 – December 2024 · Berlin, Germany

Designed and implemented VampIR — an intermediate language for ZK polynomial circuits, framed as "LLVM for polynomial circuits". Halo2 user and contributor; Rust implementation and optimization of the PlonkUp protocol; worked on hiding properties of the KZG polynomial commitment scheme.