MPC-in-the-Head: ZK Proofs & Post-Quantum Signatures

Updated 9 July 2026

MPC-in-the-Head is a proof design paradigm that uses secret sharing and simulated MPC to construct zero-knowledge proofs for NP-relations.
The methodology involves committing to simulated party views and selectively opening them to ensure soundness, completeness, and zero-knowledge.
Recent variants like TCitH and VOLEitH optimize share efficiency and signature size, offering practical benefits for post-quantum cryptography.

Searching arXiv for recent and foundational papers on MPC-in-the-Head, TCitH, VOLEitH, and representative applications. MPC-in-the-Head (MPCitH), also denoted MitH in some formal treatments, is a zero-knowledge proof design paradigm in which a prover secret-shares a witness among several simulated parties, executes a secure multiparty computation locally, commits to the simulated views, and later opens only a challenge-dependent subset of those views. The construction yields zero-knowledge proofs of knowledge for general NP-relations and, after the Fiat–Shamir transform, a broad class of post-quantum digital signatures. Introduced by Ishai, Kushilevitz, Ostrovsky, and Sahai, MPCitH has developed into a modular signature template with recent specializations such as Threshold-Computation-in-the-Head (TCitH) and VOLE-in-the-Head (VOLEitH), and it has influenced the design of real-world post-quantum cryptographic signatures (Almeida et al., 2021, Battagliola et al., 13 Oct 2025).

1. Conceptual basis and historical role

The classical MPCitH idea is to start from an $n$ -party MPC protocol $\Pi$ that computes a boolean function $f$ , and to use it to build a zero-knowledge proof for an NP relation $R(x,w)$ . The prover secret-shares the witness $w$ among the simulated parties, runs the MPC protocol “in its head,” commits to every party view, and opens only a verifier-chosen subset. In this template, completeness comes from correctness of the MPC protocol and commitment correctness, soundness comes from commitment binding together with the fact that inconsistent views are caught by random openings, and zero knowledge comes from MPC privacy for the opened views plus commitment hiding for the unopened views (Almeida et al., 2021).

Within signature design, the critical step is the Fiat–Shamir transform: the interactive proof becomes noninteractive by hashing the public transcript to derive challenges. The result is a signature that reveals only partial views of the simulated computation. The framework is useful because it turns many different hardness assumptions into signatures, is very modular in the sense that the witness relation can be changed while the proof template stays similar, and often yields compact post-quantum signatures, especially for code-based, multivariate, and lattice-like assumptions (Battagliola et al., 13 Oct 2025).

A recurring theme in recent work is that MPCitH is a method rather than a single assumption family. The same proof architecture has been adapted to MinRank, rank-metric syndrome decoding, restricted decoding, and equivalence-style problems. This suggests that the main scientific leverage of MPCitH lies in witness modeling and transcript compression rather than in any particular algebraic domain.

2. Canonical protocol mechanics and security structure

In its standard form, MPCitH has a commit–challenge–response structure. The prover secret-shares the witness, simulates the MPC execution, constructs each party’s view, and commits to all views. The verifier samples a random challenge selecting a small subset of views to open; the prover opens those views; and the verifier checks that the openings are valid, the opened views are mutually consistent, and the opened parties’ local outputs are accepting. In a verified 5-party instantiation, the verifier opens two views out of $n=5$ (Almeida et al., 2021).

A central technical property is pairwise consistency. In the formal treatment, the standard lemma is that all pairs of views are locally consistent iff there exists an honest execution of the protocol producing exactly those views. This is the bridge from local checks on opened views to a global claim about the emulated MPC run. The soundness argument then takes the usual form: if the statement is false, some pair of views must be inconsistent, and a random challenge catches such a bad pair with non-negligible probability (Almeida et al., 2021).

For signatures, papers in the MPCitH family typically use a two-challenge Fiat–Shamir flow. In MiRitH, for example, the signer simulates $N$ parties over $\tau$ rounds, hashes the message, a salt, and random shares to derive a first challenge, simulates the MPC computation, derives a second challenge specifying which party information remains hidden, and assembles a signature from the challenged shares and authentication data (Schöffel et al., 2024). In RYDE and MIRA, the signature includes repeated MPCitH transcripts together with salts and challenge hashes, because the raw proof is only sound with non-negligible single-round error (Bidoux et al., 2023, Aragon et al., 2023).

Security decomposes into at least two layers. One layer is proof-system security: commitment correctness and binding, challenge randomness, privacy of the simulated MPC, and repetition or soundness amplification. Another layer is the underlying hard problem embodied in the witness relation. Several papers explicitly separate these two layers, emphasizing that the signature security comes from the MPCitH proof system plus Fiat–Shamir and grinding, while the cryptographic hardness assumption comes from the specific decoding, MinRank, or equivalence problem being embedded (Battagliola et al., 13 Oct 2025, Bardet et al., 21 Jul 2025).

Much of the evolution of MPCitH has come from changes in how the witness is shared and how consistency is checked. The following variants recur across the literature.

Variant	Core mechanism	Effect or trade-off
Classical MPCitH	Simulate parties, commit to views, open a subset	Generic and modular
Additive + hypercube	$N=2^D$ leaves aggregated into $D$ main executions	Lower communication cost; roughly $\Pi$ 0 effective computations
Low-threshold LSSS	$\Pi$ 1-threshold sharing, open only $\Pi$ 2 parties	Faster proof generation or verification; larger signatures
TCitH	$\Pi$ 3-out-of- $\Pi$ 4 threshold sharing with polynomial shares and random-point opening	Simpler recent specialization
VOLEitH	VOLE-based sharing and an additional consistency-check component	Smaller soundness error per repetition; structurally more involved

The additive-sharing and low-threshold branches are explicit in MIRA and RYDE. In the additive approach, a secret is shared among $\Pi$ 5 parties and privacy comes from leaving one share hidden; the hypercube technique organizes $\Pi$ 6 leaves into $\Pi$ 7 dimensions, so the prover emulates only $\Pi$ 8 main computations rather than all $\Pi$ 9. In the threshold approach, a $f$ 0-threshold linear secret sharing scheme, typically Shamir sharing, lets the verifier open only $f$ 1 parties, while the prover simulates a public subset $f$ 2 of size $f$ 3 (Aragon et al., 2023, Bidoux et al., 2023).

TCitH and VOLEitH are more recent specializations. TCitH instantiates MPCitH using an $f$ 4-out-of- $f$ 5 threshold sharing style. In the PIOP formulation described for restricted decoding, the prover commits to polynomial shares of the witness, masks the target relation with random polynomial shares, and the verifier checks the opened evaluation at a random point. The signature size is summarized by

$f$ 6

$f$ 7

VOLEitH is structurally similar but has a different soundness mechanism. The main distinction highlighted in the literature is that VOLEitH achieves smaller soundness error per repetition, so it often needs fewer repetitions or shorter proof parameters, but at the cost of a more complex protocol, including an additional consistency-check component (Battagliola et al., 13 Oct 2025).

A related optimization appears in the matrix-subcode-equivalence setting, where TCitH is described as using Shamir secret sharing with degree $f$ 8, and VOLEitH is treated as a black-box optimization of the same general proof style. That paper also notes the GGM-tree optimization from $f$ 9, which reduces the opening cost of revealed shares and contributes to shorter signatures (Bardet et al., 21 Jul 2025).

Commitments remain a structural dependency. In the formal EasyCrypt development, the final MitH security depends heavily on the commitment scheme: if commitments are statistically hiding and binding, one gets standard soundness; with only computational binding, the construction yields a zero-knowledge argument rather than a proof in the strongest sense (Almeida et al., 2021).

4. Witness relations and cryptographic instantiations

A defining feature of MPCitH is that the same proof template can host very different witness relations.

In MinRank-based constructions, the witness is a secret vector $R(x,w)$ 0 such that

$R(x,w)$ 1

has rank at most $R(x,w)$ 2. MIRA and MiRitH reduce the rank condition to a batched annihilator- $R(x,w)$ 3-polynomial check, compute intermediate quantities such as $R(x,w)$ 4, $R(x,w)$ 5, $R(x,w)$ 6, and $R(x,w)$ 7, and accept iff $R(x,w)$ 8 (Aragon et al., 2023, Schöffel et al., 2024).

In rank-metric syndrome decoding, RYDE starts from

$R(x,w)$ 9

with a secret $w$ 0 satisfying $w$ 1 and $w$ 2. Because $w$ 3 is in systematic form, the witness is effectively $w$ 4, and the nontrivial part of the proof is the rank bound, again encoded through an annihilator polynomial and an MPC multiplication-style check (Bidoux et al., 2023).

In the matrix-code setting, the Matrix Subcode Equivalence problem and the Matrix Code Permuted Kernel Problem (MCPKP) provide a witness relation in which the signer knows invertible matrices $w$ 5 and $w$ 6 satisfying

$w$ 7

That work explicitly moves from the homogeneous MSE formulation to the inhomogeneous MCPKP formulation because the witness then becomes just the pair $w$ 8. The paper stresses that this reduction in witness size is crucial for MPCitH, since signature size is heavily driven by the size of the hidden witness and the number of revealed shares (Bardet et al., 21 Jul 2025).

Restricted decoding gives an especially clear example of “new witness modeling.” There the public data are a parity-check matrix $w$ 9, a syndrome $n=5$ 0, and a restriction set $n=5$ 1; the goal is to find $n=5$ 2 such that

$n=5$ 3

By writing $n=5$ 4, reducing the witness to $n=5$ 5, and defining

$n=5$ 6

the coordinate restriction becomes a polynomial vanishing condition. The modeled relation has degree $n=5$ 7, with linear constraints handling the syndrome equation and one low-degree polynomial per coordinate enforcing membership in the restricted alphabet $n=5$ 8. This is precisely the structural trick that embeds restricted syndrome decoding into TCitH and VOLEitH (Battagliola et al., 13 Oct 2025).

Two concrete restricted-decoding instantiations are singled out. CROSS-SDP uses

$n=5$ 9

so the modeling degree is $N$ 0. Ternary-SDP uses

$N$ 1

so the error is full-weight ternary and the modeling degree is $N$ 2. The paper explicitly notes that ternary full-weight decoding is a restricted decoding problem and is closely related to the hardness assumption underlying WAVE (Battagliola et al., 13 Oct 2025).

5. Efficiency, concrete sizes, and implementation evidence

The efficiency profile of MPCitH schemes is driven by witness size, relation degree, soundness amplification, and the cost of opening simulated views. Several papers make this dependency explicit: witness size directly affects signature size, and systematic-form reductions or inhomogeneous reformulations are used precisely to shrink the witness (Battagliola et al., 13 Oct 2025, Bardet et al., 21 Jul 2025).

Representative concrete figures reported in the literature are as follows.

Construction	Reported figure	Context
CROSS-SDP + VOLEitH	about 4.4 kB	“short” parameter tradeoff
CROSS	about 12.4 kB	NIST submission comparison
Ternary-SDP + TCitH	around 3.1 kB	NIST category 1
MCPKP + VOLEitH	about 4,788 B signature	level-I short tradeoff
MCPKP + VOLEitH	about 255 B public key	level-I short tradeoff
MIRA-Additive	about 5.640 kB	level 1
MIRA-Threshold	about 8.318 kB	level 1

For restricted decoding, the paper states that using the same hardness assumption underlying CROSS but embedding it into TCitH or VOLEitH reduces signature sizes by more than a factor of two compared to the CROSS NIST submission, and that ternary full-weight decoding yields signature sizes comparable to the smallest MPCitH-based candidates in the NIST competition (Battagliola et al., 13 Oct 2025).

For matrix subcode equivalence, the main reported outcome is a signature size of approximately 4 800 Bytes with a public key of approximately 275 Bytes, and the best reported level-I result is about $N$ 3 B with VOLEitH and the short tradeoff. That paper also reports that the resulting signature is almost half the size of the CROSS signature scheme (Bardet et al., 21 Jul 2025).

MIRA reports two distinct trade-offs. MIRA-Additive uses the hypercube technique and gives a signature size around 5.6kB, while MIRA-Threshold uses low-threshold secret sharings and gives 8.3kB, with the threshold version described as faster at the price of larger signatures (Aragon et al., 2023). RYDE is presented as giving a practical signature family around and below the 6 kB range, with one variant prioritizing lower communication and the other faster verification (Bidoux et al., 2023).

Implementation work shows that protocol-level compactness does not eliminate computational cost. In MiRitH on embedded platforms, profiling identifies matrix arithmetic and Keccak as dominant bottlenecks: in the software reference implementation, Sign totals 243.82 ms, of which matrix arithmetic accounts for 193.71 ms and Keccak for 46.94 ms; Open totals 224.87 ms, of which matrix arithmetic accounts for 182.68 ms and Keccak for 39.24 ms. Hardware/software partitioning on a Xilinx ZYNQ 7000 then reduces these costs substantially: for example, Cut 1 lowers Sign to 69.62 ms and Open to 61.85 ms, while Cut 8 reaches Sign 11.75 ms and Open 11.62 ms. The broader implication given there is that MPCitH algorithms should not be judged solely by software benchmarks, because their performance profile is highly sensitive to hardware/software partitioning and to actual PKI usage patterns (Schöffel et al., 2024).

6. Formal verification, limits, and quantum generalization

MPCitH has also become a subject of formal methods. An EasyCrypt development gives the first machine-checked implementation of the MitH transformation, formalizing abstract interfaces for zero-knowledge protocols, MPC, secret sharing, and commitments, and proving completeness, soundness, and zero knowledge for a concrete instantiation. The same work extracts a verified OCaml implementation and reports that the overhead introduced by the formalization and extraction is not prohibitive (Almeida et al., 2021).

The formal perspective clarifies several limits. First, the security notion depends materially on the commitment primitive, so “MPCitH security” is not independent of the commitment layer. Second, papers repeatedly emphasize that many improvements marketed as new signature schemes are in fact improvements in witness modeling or in the proof layer: the restricted-decoding note explicitly describes itself as a “new witness modeling” result rather than a new proof system, and the matrix-subcode-equivalence construction deliberately chooses MCPKP rather than MSE because direct proof of MSE would enlarge the witness and therefore the signature (Battagliola et al., 13 Oct 2025, Bardet et al., 21 Jul 2025).

The most far-reaching extension is “MPC in the Quantum Head,” which generalizes the classical template to settings where the simulated MPC performs a quantum computation. For NP, the resulting protocol remains close to classical MPCitH but is adapted to security against a verifier that can query the prover’s opening function in superposition. For QMA, there is no literal transcript to open, so the protocol replaces transcript checking with a history-state and local-Hamiltonian verification of a quantum MPC execution. Under LWE and in the CRS model, the paper gives two three-round protocols: a zero-knowledge argument for NP and a zero-knowledge argument for QMA, both secure against superposition attacks (Coladangelo et al., 28 Jun 2025).

This quantum extension leaves the high-level template intact—secret-sharing the witness, running a multi-party computation among simulated parties, committing to a randomized encoding of the “head” computation, and opening only a challenge-dependent subset—while changing the representation of views and the verification mechanism. A plausible implication is that the defining abstraction of MPCitH is robust: it survives changes in hardness assumptions, proof compilers, sharing representations, and even the transition from classical to quantum computation.