[ZIP TBD] Private Information Retrieval for Nullifier Exclusion Proofs by p0mvn · Pull Request #1198 · zcash/zips

p0mvn · 2026-03-03T05:50:48Z

ZIP specifying a private information retrieval (PIR) scheme for Zcash Nullifier Exclusion Proofs. Participants prove that nullifiers are unspent by retrieving nullifier exclusion proofs without revealing which nullifier is being checked.

The construction uses YPIR+SP (a single-server, hintless PIR protocol built on SimplePIR with RLWE packing), making it suitable for cold-start mobile wallets with no client-side preprocessing. The nullifier exclusion tree is partitioned into three tiers — a plaintext broadcast (192 KB), a small PIR database (24 MB), and a large PIR database (6 GB) — requiring two sequential PIR queries and approximately 3.3 MB total bandwidth.

The document also surveys the PIR design space, explains the choice of YPIR+SP over alternatives such as InsPIRe, and specifies row layouts, serialization formats, and client procedures for each tier.

Status: Draft
Category: Standards / Wallet

Still to come (before Proposed):

Full reference implementation of the governance-specific layers
Deployment section

Co-authored-by: Claude <noreply@anthropic.com>

…rsioning-v0

PIR versioning + v0 full download scheme

Co-authored-by: Claude <noreply@anthropic.com>

daira · 2026-03-29T23:01:11Z

+exclusion tree data (the Tier 0 plaintext, all Tier 1 rows, and all
+leaf records) and locally computes Tier 2 internal node hashes on


This still ties the "full download" option to the choices of Tier 1 and Tier 2 depths, which I think are unlikely to remain as currently specified.

For the parameters given at https://github.com/zcash/zips/pull/1198/changes/4dfe8d0b99e97ba20733781db3ac5df42367c6ad..2a9802bdafb24149f7a49b0072992b4908a38777#r3006956703, the download need not be any more than 2.0625 GiB ($32 \times (2^{26} + 2^{21})$ bytes) even if all of the intermediate nodes up to depth 20 inclusive are given. Actually it only has to include the number of depth-21 leaves corresponding to the real number of nullifiers (32 at each leaf), so that's ~1.52 GiB ($32 \times (50000000 + 2^{21})$ bytes) for 50 million nullifiers.

Replied to the tier amendment proposal here:
#1198 (comment)

This thread is contingent on that decision, so I am keeping it open for now

Co-authored-by: Claude <noreply@anthropic.com>

Co-authored-by: Czar <adam@osmosis.team> Co-authored-by: Claude <noreply@anthropic.com>

The packing-key security analysis previously used m=33 (ring-level sample count) with n=2048 (scalar dimension), producing an artificial ∞ result. This was inconsistent with the selector analysis, which correctly expands ring samples to scalar LWE via negacyclic extraction. Apply the same expansion to the packing key: 33 ring elements × 2048 coefficients = 67,584 scalar LWE samples. The lattice estimator now reports finite hardness (104.0 Core-SVP / 132.6 Matzov for uSVP), essentially identical to the Tier 2 selector — as expected when m >> n. Co-authored-by: Claude <noreply@anthropic.com> Made-with: Cursor

security analysis Co-authored-by: Claude <noreply@anthropic.com>

Update the nullifier exclusion tree specification to use K=2 punctured ranges with the 9+6+10 depth split (depth 25), replacing the earlier depth-26 layout. Key changes: - Rename "Interval Merkle tree" to "Punctured interval Merkle tree" and update terminology for punctured ranges throughout - Update tree construction for K=2: overlapping triples, odd-count enforcement, sentinel spacing (33 sentinels at 2^249 intervals) - Revise tier depths (0-9, 9-15, 15-25) and all derived constants (512 Tier 1 rows, 32,768 Tier 2 rows, 4,096 / 98,304 byte rows) - Add full download retrieval scheme with itemized bandwidth breakdown - Update PIR bandwidth summary for the new tier sizes - Add leaf encoding, authentication path, and tree padding sections - Add detailed row serialization formats for all three tiers Co-authored-by: Claude <noreply@anthropic.com> Made-with: Cursor

The security and correctness analysis sections contained stale values from an earlier tier layout. Update to match the depth-25 (9+6+10) parameters specified in the Nullifier Instantiation Values table. Security analysis: - Tier 2 selector samples: 262,144 → 32,768 (= m_pad from Database Shape) - Ring blocks: B = 128 → 16 (= ceil(32768/2048)) - Matrix dimensions: 2048×262,144 → 2048×32,768 - Instance Summary and Sensitivity Analysis tables updated accordingly - Lattice estimator rerun confirms all hardness numbers unchanged (once m >> n=2048, additional samples give no attacker advantage) Correctness analysis: - Scan noise: V_scan from 2^51.4 → 2^48.4 (fewer rows in product) - Total noise: 2^74.9 → 2^74.8 (key-switching still dominates) - Packing chunks: 7 → 28 (= ceil(56174/2048) = ceil(W_value/d)) - Total slots: 14,336 → 57,344 - Per-slot failure: 2^-80 → 2^-90 (improved margin) - Union bound: 2^-66 → 2^-74 (still well below 2^-40 target) Estimator script (nullifier_pir_analysis.py): - M_TIER2: 262_144 → 32_768 - Tier 2 label: "128 ring elems" → "16 ring elems" Co-authored-by: Claude <noreply@anthropic.com> Made-with: Cursor

Switch full-download spec from pre-computed 96-byte leaf records to the sorted nullifier list (32 bytes per element) with client-side leaf triple reconstruction, reducing download from ~3.2 GB to ~1.48 GiB at 50M nullifiers. Co-Authored-By: Claude <noreply@anthropic.com> Made-with: Cursor Co-authored-by: Claude <noreply@anthropic.com>

Co-authored-by: Claude <noreply@anthropic.com>

Lowers the Claim circuit Merkle path depth from 29 to 26, reducing empty-subtree padding from 4 levels to 1. This saves ~990 circuit constraints while still supporting ~67M leaves (~134M nullifiers), roughly 2.7× the current ~50M nullifier count. Co-authored-by: Claude <noreply@anthropic.com> Made-with: Cursor

str4d · 2026-03-31T21:46:16Z

As I already noted in private to the authors of this set of ZIPs, any earlier commits in the PR that were created with AI assistance will need to have their commit messages amended (via a force-push to the branch) to declare that assistance, per the CONTRIBUTING for this repo. If fixing each individual commit is too difficult, then I recommend rebasing the PR to squash the commits down into a smaller set that can be correctly attributed.

Only comment left open is to be decided by Daira-Emma.

p0mvn · 2026-04-01T17:52:46Z

As I already noted in private to the authors of this set of ZIPs, any earlier commits in the PR that were created with AI assistance will need to have their commit messages amended (via a force-push to the branch) to declare that assistance, per the CONTRIBUTING for this repo. If fixing each individual commit is too difficult, then I recommend rebasing the PR to squash the commits down into a smaller set that can be correctly attributed.

Thanks for the reminder. Addressed

…ver in Validator The draft talked about a "nullifier service operator" in Privacy Implications and described a Nullifier Service in Deployment Architecture, but no role was defined to say who actually runs it. Add a Nullifier Service Operator role: a separate operator who runs the nf-server PIR binary from valargroup/vote-nullifier-pir, with its own ingest pipeline and HTTP query endpoint, distributed and deployed independently of the vote chain node. Submission server operation lives in svoted itself and is therefore the Validator's responsibility. Extend the Validator role section to make that explicit and cross-reference the submission server draft, so a reader doesn't have to infer the assignment. Also fix a stale filename: the [^draft-pir] reference pointed at draft-valargroup-gov-pir.md, but the canonical filename in zcash#1198 is draft-valargroup-nullifier-pir.md. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

p0mvn and others added 30 commits March 2, 2026 22:35

gov PIR initial draft

f1a73c1

Co-authored-by: Claude <noreply@anthropic.com>

fix bandwidth summary

05e0915

Co-authored-by: Claude <noreply@anthropic.com>

format

b6b0a64

Co-authored-by: Claude <noreply@anthropic.com>

notation collision avoidance

de0e2c1

Co-authored-by: Claude <noreply@anthropic.com>

clarify LWE security assumption

fd756db

Co-authored-by: Claude <noreply@anthropic.com>

clarify circular security claim

daaba26

Co-authored-by: Claude <noreply@anthropic.com>

Specify field arithmetic for exclusion range check

99897c6

Co-authored-by: Claude <noreply@anthropic.com>

trivial formatting and clarity fixes

bea05dc

Co-authored-by: Claude <noreply@anthropic.com>

clarify tree rebuild and remove CDN concern

e670ee9

Co-authored-by: Claude <noreply@anthropic.com>

parameter tuning note

502e7a6

Co-authored-by: Claude <noreply@anthropic.com>

remove superfluous details

c2583de

Co-authored-by: Claude <noreply@anthropic.com>

mention both LWE and RLWE under privacy

f441c9c

Co-authored-by: Claude <noreply@anthropic.com>

double check params with the paper

812ad90

Co-authored-by: Claude <noreply@anthropic.com>

site sources for pir comparison

2b214fc

Co-authored-by: Claude <noreply@anthropic.com>

try fixing github math formatting issues

b50ed83

Co-authored-by: Claude <noreply@anthropic.com>

reference implementation

2099095

Co-authored-by: Claude <noreply@anthropic.com>

update value sizes and address utilization issue

17ecc3b

Co-authored-by: Claude <noreply@anthropic.com>

add terminology on hin and per-client server state to avoid confusion

0418670

Co-authored-by: Claude <noreply@anthropic.com>

tighten repetition

90988b7

Co-authored-by: Claude <noreply@anthropic.com>

update privacy implications around packing keys

3f1eeca

Co-authored-by: Claude <noreply@anthropic.com>

link Regev encryption paper

3e2b521

Co-authored-by: Claude <noreply@anthropic.com>

a note on correctness of Regev

bbbfd59

Co-authored-by: Claude <noreply@anthropic.com>

note on avx512 and communication

fd21860

Co-authored-by: Claude <noreply@anthropic.com>

avoid quantifying improvement without exact details (unimportant)

6695a1d

Co-authored-by: Claude <noreply@anthropic.com>

clarify Regev

35ccd02

Co-authored-by: Claude <noreply@anthropic.com>

minor clean ups

46fec61

Co-authored-by: Claude <noreply@anthropic.com>

clean ups

7104183

Co-authored-by: Claude <noreply@anthropic.com>

fix inspire source

6d02a86

Co-authored-by: Claude <noreply@anthropic.com>

cite pallas base field

7d96e81

Co-authored-by: Claude <noreply@anthropic.com>

remove open issues section

daccc77

Co-authored-by: Claude <noreply@anthropic.com>

p0mvn and others added 7 commits March 24, 2026 20:10

edits

5a15f9f

Co-authored-by: Claude <noreply@anthropic.com>

edits

a1a12fe

Co-authored-by: Claude <noreply@anthropic.com>

depth 26 vs 29

ad6c569

Co-authored-by: Claude <noreply@anthropic.com>

minor update

0ffe3a3

Merge remote-tracking branch 'origin/roman/gov-pir2' into adam/pir-ve…

8fa799c

…rsioning-v0

Merge pull request #15 from valargroup/adam/pir-versioning-v0

a511849

PIR versioning + v0 full download scheme

quantum estimates

54c3b29

Co-authored-by: Claude <noreply@anthropic.com>

daira reviewed Mar 29, 2026

View reviewed changes

p0mvn and others added 5 commits March 30, 2026 16:02

Merge branch 'roman/gov-pir2' into roman/gov-pir-security

454db29

Co-authored-by: Claude <noreply@anthropic.com>

resolve conflict

0e1a43d

Co-authored-by: Claude <noreply@anthropic.com>

Apply suggestion from @czarcas7ic

3bac4cb

Co-authored-by: Czar <adam@osmosis.team> Co-authored-by: Claude <noreply@anthropic.com>

Merge pull request #18 from valargroup/roman/gov-pir-security

452fdc3

security analysis Co-authored-by: Claude <noreply@anthropic.com>

daira reviewed Mar 30, 2026

View reviewed changes

Comment thread zips/draft-valargroup-nullifier-pir.md Outdated

daira reviewed Mar 30, 2026

View reviewed changes

Comment thread zips/draft-valargroup-nullifier-pir.md Outdated

p0mvn and others added 5 commits March 31, 2026 15:10

edits

342e8fc

Co-authored-by: Claude <noreply@anthropic.com>

str4d removed their request for review March 31, 2026 21:48

p0mvn force-pushed the roman/gov-pir2 branch from e82f833 to 8ac29b5 Compare April 1, 2026 17:51

p0mvn requested review from daira and str4d April 1, 2026 17:53

p0mvn marked this pull request as ready for review April 1, 2026 17:53

tonyZODL mentioned this pull request May 14, 2026

Retroactive Grant Application - ZODL Q1 2026 Core Protocol Development Financial-Privacy-Foundation/ZcashCoinholderGrantsProgram#33

Open

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[ZIP TBD] Private Information Retrieval for Nullifier Exclusion Proofs#1198

[ZIP TBD] Private Information Retrieval for Nullifier Exclusion Proofs#1198
p0mvn wants to merge 202 commits into
zcash:mainfrom
valargroup:roman/gov-pir2

p0mvn commented Mar 3, 2026 •

edited

Loading

Uh oh!

daira Mar 29, 2026

Uh oh!

daira Mar 30, 2026 •

edited

Loading

Uh oh!

p0mvn Mar 31, 2026

Uh oh!

Uh oh!

Uh oh!

str4d commented Mar 31, 2026

Uh oh!

p0mvn commented Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

		exclusion tree data (the Tier 0 plaintext, all Tier 1 rows, and all
		leaf records) and locally computes Tier 2 internal node hashes on

Uh oh!

Conversation

p0mvn commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

daira Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

daira Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

p0mvn Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

str4d commented Mar 31, 2026

Uh oh!

p0mvn commented Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

p0mvn commented Mar 3, 2026 •

edited

Loading

daira Mar 30, 2026 •

edited

Loading