Diamond iO Update
We are excited to share that we have introduced several new optimization techniques for Diamond iO, implemented the full end-to-end pipeline with realistic lattice parameters, and produced concrete performance estimates.
Latest paper:
eprint.iacr.org/2025/236
Latest implementation:
github.com/MachinaIO/mxx
Last year’s initial Diamond iO implementation deliberately left out one crucial component: FHE evaluation over BGG encodings. The reason was simple: the noise growth was too large to support realistic lattice parameters.
This component is not specific to Diamond iO. FHE evaluation over BGG encodings has been used as a theoretical building block in advanced lattice-based cryptography for more than a decade, but there has been very little work on making it actually implementable.
In the latest update, we make this component concrete. We introduce several techniques that substantially reduce noise growth, including native lookup-table evaluation, constant-depth arithmetic circuits, and specialized noise refreshing. The new implementation also runs all major lattice operations on GPUs.
Together, these optimizations allow us to instantiate the full Diamond iO pipeline with realistic lattice parameters: a modulus size of at most 1540 bits and lattice dimension 2^{16}, comparable to large parameter sets used in CKKS-style FHE implementations. The total running time is still far beyond practical use, but we can now estimate the end-to-end cost rather than leaving a major component abstract.
What improves?
Our estimates suggest that Diamond iO reduces the overhead of the main bottleneck in most modern iO schemes: the transformation from functional encryption (FE) to iO.
Compared with prior FE-to-iO transformations, Diamond iO reduces this overhead by at least a factor of 2^118, making the transformation almost as efficient as the underlying FE scheme itself. In other words, Diamond iO appears to largely remove the FE-to-iO transformation as the dominant cost.
What remains?
Diamond iO is still very far from practical.
Once the FE-to-iO overhead is reduced, the bottleneck shifts to the final FE decryption step, which requires FHE evaluation over BGG encodings. Our current estimate is that this step would still take about 10^36 hours.
As explained in Vitalik’s recent post, much of the inefficiency in modern iO comes from the need to stack a complicated tower of cryptographic primitives:
FHE Ă— ABE Ă— GC Ă— XiO Ă— ...
Diamond iO significantly simplifies this picture: the construction is essentially simple matrix operations plus an FHE Ă— ABE layer, where the ABE component is essentially BGG encodings.
In our view, this gives a much clearer roadmap toward practical iO: further simplify the remaining FHE Ă— ABE layer, and the gap to practicality could shrink dramatically.
