Vitalik's obfuscation part II walks through diamond iO — 'planetary,' not 'galactic'

Vitalik Buterin published the second instalment of his obfuscation series on July 28, 2026, walking through diamond iO — the indistinguishability-obfuscation scheme proposed by Sora Suegami and collaborators, first presented at the Simons Institute in June 2025. Diamond iO is the first iO construction whose runtime cost sits in a "planetary" range — millions of years for a typical program — rather than the "galactic" universe-lifetime overhead of prior candidates.

The post is Part II of a series; Part I from June 29, 2026 set up the primitive itself and argued why iO is cryptography's "final boss." Coverage from The Block and CoinDesk tracked that Part I; Part II is where the shape of a usable scheme starts to show.

What indistinguishability obfuscation is, briefly

Indistinguishability obfuscation (iO) is the primitive that lets you take a program P and produce an obfuscated version Obf(P) such that:

• Obf(P) and P produce the same output on the same input.
• Any two functionally equivalent programs, when obfuscated, are computationally indistinguishable.

If iO exists and is efficient, virtually every cryptographic primitive can be built on top of it — functional encryption, witness encryption, deniable encryption, and (relevant to blockchain) private smart contracts, private voting, and DAO signing where the signing rule is hidden but its correctness is provable. That is why Buterin calls it the "final boss": everything else falls out for free.

The catch has always been the overhead. Historical iO constructions had per-gate cost proportional to enormous polynomials in the security parameter — the running joke was that evaluating one obfuscated AND gate could take longer than the age of the universe.

What diamond iO changes

Diamond iO is described in Vitalik's post as trading theoretical conservatism for practical feasibility. Two shifts do the work:

1. BGG+14 attribute-based encryption as the base. Rather than layering an iO construction on multilinear maps, diamond iO modifies the BGG+14 ABE scheme — a lattice-based attribute-based encryption scheme whose per-operation costs are known and orders of magnitude cheaper than multilinear-map primitives.
2. FHE inside the ABE evaluation. The scheme runs Fully Homomorphic Encryption (FHE) inside the modified BGG+14 wrapper, so the ABE structure is what carries the iO security while FHE handles the arithmetic on the encrypted circuit.

The bet is that ABE + FHE, both of which have seen a decade of optimisation, produce an iO construction that is impractical today but not impractical forever.

The "planetary vs galactic" claim

Vitalik uses two informal scales to frame the improvement:

- "Galactic" runtimes  — earlier iO constructions
                         evaluation overhead ~10^24 operations per gate
                         a small program takes longer than the age of the universe
- "Planetary" runtimes — diamond iO
                         evaluation overhead down to a range measured in years,
                         millions of years for a non-trivial program
                         still infeasible today
                         within reach of continued optimisation on ABE and FHE

The exact concrete parameters are in the Suegami paper and Vitalik's post; the takeaway from Vitalik's own framing is that the scheme is the first iO construction where the roadmap to practicality is a matter of engineering optimisation, not of finding a fundamentally different mathematical route.

Security assumptions — the caveat

Diamond iO is not a conservative construction. It relies on:

• Lattice-based assumptions (Learning With Errors and its variants), which the cryptographic community broadly trusts.
• Newer, less-tested assumptions layered on top — Vitalik uses the phrase "braver and more untested cryptographic assumptions" to describe what the FHE-inside-ABE composition requires.

The distinction matters. A break in a lattice assumption would rewrite most of post-quantum cryptography; a break in the newer diamond iO composition would kill diamond iO specifically without touching LWE. Practitioners weighing the scheme need to look at both.

Blockchain applications Vitalik cites

The essay closes on the applications side. The three that stand out for on-chain use:

1. Private DAO signing. A DAO signs a transaction according to a policy — but the policy itself (who has signing rights, under what conditions) stays hidden. Verifiers only see a valid signature under the DAO's public key.
2. Private voting. A vote is tallied by an obfuscated program that publishes only the aggregate result; individual ballots are never revealed, and the tally rule is auditably correct without revealing the vote weights.
3. Timelocked NFTs and content. A program that releases a payload only after a specific on-chain condition (block height, oracle input) is met — the payload and the condition are hidden from anyone inspecting the program, but the release is verifiable.

None of these are new problem statements. What is new is a candidate scheme where the primitive underlying them is on a path — even a slow one — to practicality.

Attribution — read carefully

• The planetary / galactic framing is Vitalik's own; it is a communication shorthand, not a formal complexity class. Readers should treat it as a rough order-of-magnitude description.
• The Suegami paper's concrete parameters are what matter for any deployment estimate. Vitalik links to the paper in his post; the parameter table in the paper is the source of truth.
• The scheme is a theoretical construction with published parameters — there is no production implementation, and none should be inferred from the post.

What to watch

1. A reference implementation. The scheme's real-world viability depends on someone landing a Rust or C++ implementation on public benchmarks. Watch zkResearch and Simons Institute mailing lists for the first serious pass.
2. Concrete parameter tables. The Suegami paper's parameter sizes for reasonable-security instances (128-bit) are the number to track. Diamond iO becomes worth prototyping when those numbers stop being astronomical.
3. FHE bootstrapping cost. The FHE inside diamond iO carries the arithmetic; every FHE bootstrapping improvement compounds into a diamond iO improvement. Watch the OpenFHE release cadence.
4. Ethereum-side experiments. If a research team at PSE, EF or 0xPARC picks diamond iO for a proof-of-concept private-voting or private-DAO demo, that is where blockchain-facing engineering meets the scheme.

Context — where this sits in the obfuscation arc

Indistinguishability obfuscation has been an active research programme since Garg, Gentry, Halevi, Raykova, Sahai and Waters put out the first candidate construction in 2013. Every subsequent generation has either broken the previous scheme or reduced the security assumptions it depends on. Diamond iO is the first candidate in that arc where a working cryptographer can look at the cost and honestly say "an implementation is on the table" — even if it is not on the table this year.

For readers who followed Vitalik's Part I from late June and asked "why does any of this matter for Ethereum" — Part II is where the answer starts to have a shape. The primitives Ethereum research has been chasing for private on-chain computation (FHE-based rollups, MPC governance, zkVM privacy layers) all become substantially easier if iO is available. Diamond iO is not the delivery, but it is the first credible sign that the road exists.

Sources:

• Vitalik Buterin — Obfuscation (Part II): Diamond iO (primary; the essay itself).
• The Block — Vitalik calls obfuscation cryptography's 'final boss' (Part I context).
• CoinDesk — Vitalik Buterin says crypto's most powerful idea is still nowhere near ready (Part I context).
• Coinpedia — Vitalik Introduces Diamond iO (Part II secondary confirmation).