Title: ERC_7524__PLUME_Signature_in_Wallets
Category: ERCs

Author: yush
Date: 2023-09-24T20:45:46.309Z

Discussion thread for Add ERC: PLUME Signature in Wallets by Divide-By-0 · Pull Request #242 · ethereum/ERCs · GitHub
This ERC adds a signature scheme called PLUME to existing Ethereum keypairs that enables unique anonymous nullifiers for accounts in ZK. This enables ZK voting, anonymous proof of solvency, unlinked airdrops, and moderation on anonymous message boards – all directly with Ethereum keypairs.

Author: yush
Date: 2023-10-06T18:19:52.850Z

A good point was raised by @OrenYomtov that we should really call the V1/V2 as verifier-optimized vs prover-optimized.

Author: oren
Date: 2023-10-15T08:47:56.350Z

A PR to Taho Wallet implementing ERC-7524 has been created:

github.com/tahowallet/extension








Implement EIP-7524 (PLUME Signatures)


main ← orenyomtov:main



          opened 08:59PM - 06 Oct 23 UTC




            orenyomtov
          



+531
-6






## Explanation
We want Taho to be the first wallet to support private voting an…d private airdrops on Ethereum and other EVM chains.

This PR adds new `eth_getPlumeSignature` RPC method that implements a [novel ECDSA nullifier scheme](https://aayushg.com/thesis.pdf) as [described](https://blog.aayushg.com/posts/nullifier) in [EIP-7524](https://github.com/ethereum/EIPs/blob/53683e7716ff7c962e5a30a087ced51a4c60951b/EIPS/eip-7524.md).

The `eth_getPlumeSignature` method takes in two parameters, a **message** and an **address**, then generates a deterministic signature (PLUME) and several other inputs. The plume can be used as a nullifier to prevent double-spending in an anonymity set. This capability unlocks novel on-chain behavior, such as [private DAO voting](https://prop.house/nouns/private-voting-research-sprint), [fair, non-doxxing airdrops](https://github.com/stealthdrop/stealthdrop), and more.

## Screenshot
<img width="496" alt="plume confirmation window" src="https://github.com/tahowallet/extension/assets/168856/4bd555e2-a873-42d1-b138-39e77d7b3dc7">


## Manual Testing Steps

After building and running Taho locally, enter this into the browser console

```js
await window.ethereum.request({
  "method": "eth_requestAccounts",
  "params": []
});

accountAddress = (await window.ethereum.request({
  "method": "eth_accounts",
  "params": []
}))[0];

await window.ethereum.request({
  "method": "eth_getPlumeSignature",
  "params": [
    "this is a test message - hi aayush",
    accountAddress
  ]
});
```

A confirmation screen should open up. After clicking "Sign", you will see the plume and other signals outputted into the console.

## Discussion

[Discord thread](https://discord.com/channels/808358975287722045/1158018958251802634)

Author: aguzmant103
Date: 2023-11-06T17:11:31.846Z

Great to see this moving forward! Are there PRs for other wallets?

Author: gitarg
Date: 2023-11-06T20:37:28.665Z

So cool, working on something similar with orgs, identity and handshakes, I don’t think its a different direction just neat name

Author: gitarg
Date: 2023-11-06T20:49:43.912Z

code looks more like implementation than a standard, anyone working on the eip:


Ethereum Improvement Proposals


All | Ethereum Improvement Proposals
Ethereum Improvement Proposals (EIPs) describe standards for the Ethereum platform, including core protocol specifications, client APIs, and contract standards.





maybe a different standard already set?
I’ll take a crack at it but might need a different standard for what I’m working on, will review

Author: yush
Date: 2023-11-07T06:32:26.908Z

Yeah! For metamask, we have an open PR set (rpc, api, core), and folks are working on Ledger implementations right now! Mina has an implementation and Aztec is currently building one.

Author: yush
Date: 2023-11-07T06:34:12.513Z

Hey – this standard has nothing to do with handshakes, are you sure you’re commenting on the  right post?
We think it’s important to have a standard so that different wallets can interoperate with each other, as everyone in some anonymity set needs to have the same PLUME signature for the nullifiers to work.

Author: yush
Date: 2023-11-07T06:35:14.603Z

We have reference implementations, but we expect many wallets (such as Ledger) to require bespoke implementations. You’ve linked to a blank EIPs page, are you referring to anything concrete?

Author: zemse
Date: 2023-11-13T07:45:19.819Z

This is so needed, why this is not a thing already?! Some zk apps require nullifiers, which have to be derived using the user’s secret. Since wallets are not supposed to provide access to private keys, there should be a way to get something that only the user knows, but seems there’s no API for it.

Author: yush
Date: 2023-11-17T00:47:07.860Z

Hey! We think the reason it hasn’t been adopted is due to slow wallet adoption and time needed to finish and audit the halo2 circuits for fast in browser proving. We wre optimistic that this will get better within the next few months.

Author: shreyas-londhe
Date: 2023-12-12T14:47:24.305Z

Hey Ayush, would love to know the status on the Plume Halo2 circuit. And also if metamask supports creating Plume Nullifiers. Thanks!

Author: yush
Date: 2024-03-05T21:21:05.603Z

As an update on this, Shreyas has finished the PLUME Halo2 circuits! We expect an audit to occur in April. The circuits are here: Axiom V2 Halo2 implementation by Divide-By-0 · Pull Request #83 · plume-sig/zk-nullifier-sig · GitHub
Even given the reasoned advances in ZKVMs such as SP1, we still believe that Halo 2 is likely to be the fastest for browser side Halo 2 proving, due to upcoming results with Web GPU acceleration + the register optimization of small field Starks likely not being as fast within WASM.