Post-quantum cryptography

Post-quantum schemes rely on mathematical problems that no known quantum algorithm solves efficiently, such as lattice problems or the security of hash functions. In August 2024 the US standards agency NIST published its first post-quantum standards: ML-KEM for key exchange, and ML-DSA and SLH-DSA for digital signatures, with another signature scheme, FN-DSA, to follow. Governments and tech companies have started migrating.

For blockchains, the main concern is signatures. Bitcoin developers have proposed new output types that would let users move coins to quantum-resistant addresses, and Ethereum researchers include quantum resistance in the long-term roadmap, favouring hash-based schemes and STARK proofs. A few networks were designed around post-quantum signatures from the start.

Migration is costly. Post-quantum signatures are much larger than today's 64-byte Schnorr signatures, from a couple of kilobytes to tens of kilobytes, which means fewer transactions per block and higher fees. Every user would have to move funds, and the community would need to decide what to do with coins that are never moved, including possibly freezing vulnerable outputs, a highly controversial idea.