Ethereum co-founder Vitalik Buterin is advancing EIP-8288, a proposal designed to make post-quantum signatures and advanced privacy proofs substantially cheaper through recursive STARK aggregation. The proposal would move much of the heavy cryptographic verification outside Ethereum’s normal execution path, potentially lowering the cost of security mechanisms that are currently prohibitively expensive on-chain.
The draft EIP-8288 specification, co-authored by Buterin and Thomas Coratger, introduces dependency verification frames that declare cryptographic claims without executing them directly inside the EVM. Those dependencies can instead be aggregated into recursive STARK proofs, allowing Ethereum to verify many cryptographic operations through a much smaller proof footprint.
Recursive STARKs Reduce Cryptographic Overhead
The proposal builds directly on EIP-8141, or Frame Transactions, which separates transaction validation, execution and gas payment into programmable frames. EIP-8288 extends that architecture with a new frame mode specifically for cryptographic dependencies, creating a path for signatures and proofs to be verified without placing their full data and computation on-chain.
At the mempool layer, nodes can bundle transactions and recursively aggregate their associated proofs before forwarding them. A block would ultimately include a recursive STARK proving the validity of the cryptographic dependencies it contains. Aggregation is intended to keep proof-related bandwidth from scaling linearly with the number of advanced cryptographic operations being submitted.
The potential savings are substantial. Buterin has estimated that quantum-safe private transactions requiring around 10 million gas under current approaches could fall into the low tens of thousands under the proposed design. EIP-8288 currently specifies 3,000 gas for LeanSPHINCS verification and 30,000 gas for LeanSTARK verification, although those parameters remain subject to change while the proposal is developed.
The model could also make Ethereum more flexible when adopting new cryptographic schemes. Signatures such as Falcon or ML-DSA could potentially be wrapped in STARK proofs rather than requiring dedicated EVM modifications each time. That “plug-and-play” approach could reduce the protocol changes needed to introduce future signature and proof systems.
EIP-8288 Remains a Draft
Buterin has described EIP-8288 as a potential next step after Frame Transactions and said he hopes it can be considered for I-star, the planned upgrade after Hegotá. Neither EIP-8288 nor its placement in I-star is currently a finalized Ethereum roadmap commitment, making further research and client evaluation necessary before deployment.
Several technical questions also remain open, including proof-generation requirements, node resource consumption and the instruction set used for recursive verification. The proposal therefore represents a direction for Ethereum’s post-quantum and privacy infrastructure rather than an imminent mainnet feature.
If the design proves practical, its significance could extend beyond cheaper signatures. EIP-8288 would give Ethereum a general-purpose cryptographic aggregation layer capable of supporting privacy, account abstraction and quantum-resistant authentication more efficiently, placing recursive proofs deeper into the network’s transaction-processing architecture.