Aegon
A self-auditable key transparency system that builds a transparent dictionary based on polynomial commitments, aiming to reduce the cost of key transparency auditing and resolve confusion between the bulletin board and auditing roles.
Timeline (last 90 days)
Aegon is a self-auditable key transparency system, a successor to IronDict, proposed by the team of University of Cambridge researcher Hossein Hafezi.
Aegon replaces the global index check with label-level consistency checking and also applies the randomization mechanism to the index mapping, with the client verifying that all positions along the resolution path remain unchanged over the entire interval, so that the server's computation scales only linearly with the number of updates.
Aegon uses dictionary sharding: a coordinator uses a verifiable random function (VRF) to deterministically route labels to independently running instances, and the coordinator cannot forge a VRF proof to redirect them.
Aegon's 45KB audit proof covers the entire key transparency history and can be verified within one second, so clients can check weekly or monthly without needing to be online every epoch; by contrast, WhatsApp's audit proof is about 80MB per epoch.
Aegon's construction is generic over polynomial commitment schemes; the concrete instantiation uses KZG, which is efficient but requires a powers of tau trusted setup and is only pre-quantum secure.
In the Q&A session, Hafezi stated that Aegon's privacy is defined in the zero-knowledge sense and does not leak extra information, making it superior to the Seamless family of schemes; but without access control, metadata privacy is of limited practical significance.
Hafezi revealed that the WhatsApp team is internally "trying out Aegon", and whether it will be deployed is unknown.
All Facts (7)
Aegon is a self-auditable key transparency system, a successor to IronDict, proposed by the team of University of Cambridge researcher Hossein Hafezi.
50%UnverifiedAegon replaces the global index check with label-level consistency checking and also applies the randomization mechanism to the index mapping, with the client verifying that all positions along the resolution path remain unchanged over the entire interval, so that the server's computation scales only linearly with the number of updates.
50%UnverifiedAegon uses dictionary sharding: a coordinator uses a verifiable random function (VRF) to deterministically route labels to independently running instances, and the coordinator cannot forge a VRF proof to redirect them.
50%UnverifiedAegon's 45KB audit proof covers the entire key transparency history and can be verified within one second, so clients can check weekly or monthly without needing to be online every epoch; by contrast, WhatsApp's audit proof is about 80MB per epoch.
50%UnverifiedAegon's construction is generic over polynomial commitment schemes; the concrete instantiation uses KZG, which is efficient but requires a powers of tau trusted setup and is only pre-quantum secure.
50%UnverifiedIn the Q&A session, Hafezi stated that Aegon's privacy is defined in the zero-knowledge sense and does not leak extra information, making it superior to the Seamless family of schemes; but without access control, metadata privacy is of limited practical significance.
50%UnverifiedHafezi revealed that the WhatsApp team is internally "trying out Aegon", and whether it will be deployed is unknown.
50%