[CFRG] Call for adoption: draft-google-cfrg-libzk-03 (Longfellow ZK)

[Nick Sullivan <[e-mail]>]

Dear CFRG,

This message starts a two-week call for adoption of
draft-google-cfrg-libzk-03, "Longfellow ZK", by Matteo Frigo and Abhi
Shelat. The call ends on Friday October 9, 2026.

https://www.ietf.org/archive/id/draft-google-cfrg-libzk-03.html

The document specifies a post-quantum zero-knowledge argument system built
to run on constrained devices while remaining expressive enough for
real-world statements: ECDSA, SHA-256 and ML-DSA signature verification,
string, integer and date comparisons, and basic parsing. Its Fiat-Shamir
layer builds on the transformation the research group has already adopted,
draft-irtf-cfrg-fiat-shamir-03.

The authors presented the work at IETF 122 through 125. The current
revision has taken feedback from a large number of external reviewers, at
least two independent groups have implemented it from the specification,
and the authors have a Lean 4 formalization of the protocol and of the
circuits for ECDSA verification and SHA-256, which they intend to release
for external audit once internal review is done.

On relevance: drafts inside the IETF intend to build on this protocol, and
outside the IETF it appears in eIDAS and EU age assurance documentation and
is deployed in Google Wallet for digital identities and in India's UIDAI
identity application.

Please reply on the list with whether you support adoption, and whether you
would review or implement the document if it is adopted. Objections should
name a specific problem with the document or with CFRG taking it on.
Adoption means change control passes to the research group; the authors
have indicated they are ready for that.

Thank you,
Nick, for the CFRG chairs