Developers can currently verify certain cryptographic statements through the Ethereum Virtual Machine (EVM). Ethereum also offers precompiles: built-in functions that perform particular calculations more efficiently than ordinary smart contract code, including checks involving signatures, hashes and zero-knowledge proofs.
Adding support for further cryptographic methods through precompiles can require protocol changes. Both approaches also operate on data that must enter the blockchain, which Buterin identified as a constraint when signatures and proofs become large.
Buterin and Ethereum researcher Thomas Coratger created EIP-8288 on June 3, 2026. Their design would let Ethereum verify that cryptographic operations were performed correctly without placing all the original verification material in a block.
How recursive STARK aggregation would work
EIP-8288 would begin combining proofs in the mempool, where transactions wait for block inclusion. Its recursive STARK proofs would establish the validity of multiple underlying proofs, reducing the calldata and execution costs associated with verifying them individually.
A STARK demonstrates that a computation was performed correctly without requiring each verifier to repeat the full calculation. Under the proposed system, users would generate signatures or proofs locally and submit them alongside their transactions.
Mempool participants would validate that evidence, combine proofs and pass the resulting packages onward. The specification describes an aggregation interval of 1,000 milliseconds. Block builders would collect transactions and aggregated proofs, with a final recursive STARK covering the dependencies of the selected transactions.
Under a proposed transaction frame mode, these dependencies would be declared through the verification scheme by pairing a hash of the relevant data with a hash tied to the verification key, while proof generation and verification would rely on Lean Ethereum tooling.
The Ethereum cryptography proposal would retain necessary transaction information and cryptographic commitments on-chain. Its intended change is to avoid publishing the original large signatures and proofs as ordinary calldata—not to eliminate verifiable transaction records.
To keep aggregation from being overloaded by excessive proof demands, the draft caps each transaction at 16 specified signature dependencies and one STARK dependency. It also addresses compatibility with FOCIL, a proposed transaction-inclusion mechanism intended to make censorship more difficult.
Quantum-resistant signatures bring larger data requirements
EIP-8288 includes support for hash-based and lattice-based signatures designed to resist future quantum-computer attacks. Aggregation would provide a common verification method rather than requiring separate precompiles for every signature type.
The specification estimates that hash-based signatures under consideration require roughly 2–3 kilobytes and 150,000–200,000 gas for direct verification. Its cost discussion identifies comparable challenges for lattice-based signatures.
STARK proofs on their own can surpass 128 kilobytes in size, and certain configurations tuned for faster generation can grow to roughly 512 kilobytes. Combining them recursively would avoid including and checking each original proof separately.
Buterin argued that users should be able to generate their preferred signatures locally and establish their validity through STARK aggregation.
Draft status and the network upgrade requirement
EIP-8288 remains a draft core standards-track proposal, without approval for mainnet deployment or an approved activation date. Implementation details are unfinished, including parameters for the aggregated verification key and dependency hashing; the reference implementation is listed as forthcoming.
The specification names EIP-2718 and EIP-8141 as dependencies. EIP-8141 supplies a framework for transactions with multiple execution and verification steps, which the proposed cryptographic dependency frames build upon.
Existing test cases cover individual signatures, multiple proof dependencies, invalid recursive proofs, mempool aggregation and transaction-inclusion-list compatibility. Ordinary transactions without the new verification frames would retain their existing behavior.
Nodes without the update would reject transactions using the new frame mode and blocks containing the recursive proof header. Introducing those rules therefore requires a coordinated Ethereum network upgrade.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
