Post-quantum signatures and what migration actually means

Xora Labs Research  ·  14 min read

Post-quantum discussion in this industry tends to oscillate between dismissal and alarm, and both skip the interesting part: the engineering. The cryptography has largely been standardised. What has not been solved is how a chain with live value migrates to it without breaking every account on it.

What actually breaks, and what does not

It is worth being precise, because the imprecision is where both the panic and the complacency come from.

• Elliptic-curve signatures break. A sufficiently large quantum computer running Shor's algorithm recovers a private key from a public key. This is the real exposure: ECDSA and EdDSA, which is to say essentially every account on essentially every chain.
• Hash functions weaken, but survive. Grover's algorithm gives a quadratic speedup on brute-force search, which effectively halves security margin. A 256-bit hash retains roughly 128 bits, which is fine. Proof-of-work and Merkle structures are not the emergency.
• Encryption is a different timeline. The “harvest now, decrypt later” concern applies to confidential data captured today. Public blockchains publish their data deliberately, so this is much less relevant here than in messaging or finance generally.

So the problem is narrow and specific: signatures. That is good news, because it means the migration is bounded.

Exposure is not uniform

A public key is only vulnerable once it is public. On chains where an address is a hash of the public key, the key is revealed when the account first spends. That gives a meaningful distinction between accounts that have never transacted and accounts that have. On account-based chains where the key is exposed from first use, essentially every active account is in the second category.

It also means a chain-wide migration cannot be voluntary and gradual for long. Once a credible attack exists, every account that has ever spent is exposed simultaneously.

The real engineering problem is size

The standardised post-quantum signature schemes are considerably larger than the elliptic-curve signatures they replace: lattice-based schemes by roughly an order of magnitude, hash-based schemes by substantially more. On a chain where every byte of calldata is paid for and every signature is verified by every node, that is not a detail.

The cryptography is settled. What is unsettled is who pays for the extra bytes, and how verification gets cheap enough to be mandatory rather than optional.

This is why we think the interesting work is in aggregation and in verification cost, not in scheme selection. A migration that makes ordinary transactions several times more expensive will not be adopted until it is an emergency, and emergencies are the worst conditions in which to roll out cryptography.

Why account abstraction is the most plausible path

Smart accounts already decouple “who may authorise this” from “which curve the protocol hardcodes”. An account whose validation logic is programmable can adopt a new signature scheme without the base layer changing its transaction format at all.

That gives a migration story that does not require a synchronised global upgrade: accounts move when they are ready, verification is paid for by the accounts that use it, and the base protocol adds a precompile to make it affordable rather than redefining what a transaction is. It also means the work is useful immediately, since the same mechanism supports multisig, passkeys and session keys today.

What we are actually researching

• Verification cost of standardised schemes in an EVM context, and what a precompile would need to provide to make them practical
• Signature aggregation, which matters far more when each signature is kilobytes rather than tens of bytes
• Hybrid schemes during transition, requiring both a classical and a post-quantum signature, so a break in either does not compromise the account
• Migration mechanics for accounts that cannot act, which is the genuinely hard governance problem underneath the cryptography

An honest position on timing

We do not know when a cryptographically relevant quantum computer arrives, and neither does anyone making confident claims in either direction. What we are confident about is that migration takes years, has to be designed before it is needed, and is far cheaper to build calmly than under pressure. That is a good enough reason to have a team on it now.

Working on something like this? Get in touch.