Faster and Smaller Anonymous Credentials from Standardized Signatures

What it is

GordieHowe is a language, a certifying compiler and a zero-knowledge proof protocol from Chad Sharp and Paul Grubbs (University of Michigan). It targets anonymous credentials built on standardized signatures: ECDSA, RSA and ML-DSA. The paper is an IACR ePrint preprint (2026/2615), received 23 October 2026 and not yet peer reviewed. The authors claim it is the first system to combine three properties: provable security against quantum attackers, efficient statements spanning multiple fields (with proving and verifying in parallel), and automatic batching of structured computations.

Benchmarks

All proving times are in parallel on four cores. The paper does not state the hardware.

The baseline is Google's Longfellow. The mobile driving license proof is 10.1x faster and 22% smaller. The ML-DSA-44 proof is 70.2x faster and 29% smaller than an optimized Longfellow circuit. The ML-DSA comparison is against an optimized circuit, so it is not a stock-versus-stock figure.

Assurance design

• The language is built for static checking of bounds safety, which prevents integer overflows.
• The compiler emits a Lean certificate that its optimizations preserve the semantics of the input program.
• The proof system's security theorems are machine-checked in Lean.

Theory contributions

The paper defines series-parallel IOPs, interactive oracle proofs whose messages are partially ordered. It extends the BCS transformation to them, with knowledge soundness and zero-knowledge proofs in the quantum random oracle model (QROM). The authors also show a form of simulation extractability for the extended BCS in the QROM, and say they believe this is the first such result of any kind for BCS in the QROM.

Caveats

The quantum-secure figure (116 bits) applies only to the ML-DSA result. The classical rows are at least 101 bits in the random oracle model. The page does not mention a code release, the benchmark hardware, verifier-side timings or memory use, so an engineer evaluating adoption would need the full paper for those.