Multifactor Receives Zcash Community Grant for Development of MFKDF2
2025-08-21
We're honored to share that Multifactor has been selected as a recipient of the Zcash Foundation's Community Grants program, in support of our work to advance the Next-Generation Multifactor Entropy Stack (MFKDF2, MFCHF2, & MFDPG2). As a public benefit company, we appreciate the support of grants like these to get innovative open-source technologies like MFKDF2 off the ground and into the hands of real users around the world.
![The [Zcash] Foundation + Multifactor](/assets/blog/posts/zcash-grant-2025/thumbnail.png)
The Zcash Foundation is generously supporting the development of MFKDF2.
About Multifactor and MFKDF2
If you're new here, at Multifactor, our mission is to redefine “zero-trust” identity security for the modern, agentic era by researching and developing innovative post-quantum cryptographic solutions. We're a registered Public Benefit Corporation, which means we are committed to advancing cybersecurity technologies for the benefit of society as a whole through innovative open-source research.
MFKDF2 is one such open-source project that we're building to make fast, flexible, secure, and user-friendly key derivation a reality based on multiple commonly-used authentication factors, including passwords, HOTP/TOTP, passkeys, biometrics, and more. The original MFKDF received strong academic validation, winning USENIX Security's “Distinguished Artifact” award in 2023, but was ultimately a research prototype that was, for many reasons, not ready for real-world use. MFKDF2 will be re-architected from scratch in Rust, building on the lessons learned from MFKDF, and is designed to be a production-ready post-quantum primitive that can be used in critical applications like Zcash wallets.
MFKDF2 for Zcash
Cryptocurrency wallets are a prime example of where MFKDF2 can make a significant impact on usable security today. In a 2023 publication in the IEEE International Conference on Blockchain and Cryptocurrency (ICBC), we designed a reference architecture for an MFKDF-based cryptocurrency wallet that inherited the friendly UI and UX of custodial wallets like Coinbase, while in fact being completely decentralized and self-custody. A follow up large-scale user study published in ACM Computer-Human Interaction (CHI) found that cryptocurrency wallet users of all levels of experience significantly preferred using MFKDF-based wallets existing custodial and self-custody wallets, according to a number of objective and subjective metrics.
Zcash is a particularly important use case for MFKDF2, as its focus on privacy make the use of custodial wallets particularly problematic for Zcash, even moreso than for other cryptocurrencies. MFKDF2's ability to make self-custody wallets just as easy to use as custodial wallets, while still providing the security and privacy guarantees that Zcash users expect, makes it uniquely beneficial for the Zcash ecosystem by helping moving more novice users away from custodial wallets. We're excited to be working with the Zingolabs team to integrate MFKDF2 into their Zcash wallet as an initial proof of concept, and in the near future, we'll also be exploring how MFKDF2 can be used to improve the usability of Zcash's FROST and Liberated Payments protocols.
Next Steps
Thanks in part to the generous support of the Zcash Foundation, we're excited to surge ahead and accelerate our work on MFKDF2. In the coming weeks and months, we'll be building out the new and improved MFKDF2 implementation, including:
- A rearchitected, Rust-based framework, cross-compiled to JavaScript/TypeScript, Python, and more.
- A suite of concrete security improvements that make MFKDF2 hardened for real-world use.
- Compatibility with brand new types of factors, including passkeys, biometrics, and others.
- A set of new features, like probabilistic factor hints, that make MFKDF2 more flexible and usable than ever before.
With the help of the Zcash Community, we'll also be focusing on integrating MFKDF2 into the Zcash ecosystem:
- We’ll attempt to implement MFKDF2 as a key management option in Zcash’s CLI tool, as an example to Zcash developers.
- We’ll investigate and report on MFKDF2’s compatibility with FROST (ZIP 312), as a complementary secure, usable, multi-user key management strategy.
- We’ll investigate and report on MFKDF2’s utility for Liberated Payments (ZIP 324), as a way to privately send Zcash to an unregistered “set of factors” (email, phone number, etc.) that can subsequently be easily accepted on-chain.
- We’ll work closely with Zingolabs, and other Zcash wallet providers who have indicated interest, to move MFKDF2 into production use across the ecosystem.
If you're a Zcash wallet developer or enthusiast, we'd love to hear from you! We're actively seeking feedback on MFKDF2 and how it can best serve the Zcash community. If you have ideas, use cases, or just want to chat about how MFKDF2 can help improve usable security for Zcash wallets, please do not hesitate to reach out. And as always, if you're interested in funding our mission to reinvent zero-trust for the modern web, we'd love to hear from you as well.
We're redefining zero-trust — so you can protect your application with confidence.
Identity is your first and last line of defense, and the root cause of most application security breaches. Multifactor's provably secure zero-trust solutions cryptographically guarantee that only authorized users can access sensitive data, turning identity into your greatest asset in the fight against cyber threats. Learn more about our research, or reach out to explore working together.
Related Posts
Multifactor Wins Hertz Foundation's Harold Newman and David Galas Entrepreneurial Initiative
2025-07-25
We are honored to receive this recognition, and are grateful to the Hertz Foundation for their belief in our mission to reinvent zero-trust for the modern web.
Why Multifactor is a Public Benefit Corporation
2025-05-19
Multifactor, Inc. is now officially a Public Benefit Corporation (PBC). Learn more about our commitment to improving computer security and privacy for all.
Introducing the AAA Threat: Secure Authentication, Authorization, and Auditing for Agentic Applications
2025-08-12
Enterprises are deploying agentic applications faster than cyber security measures can keep up, leading to major high-profile security incidents exploiting agentic vulnerabilities.