Post-quantum security

Institutions hold assets on multi-decade horizons, and their questions about cryptographic longevity are specific. This page sets out exactly what SQRL commits to, and what it does not, because a vague claim would be worse than silence.

#Integrity rests on hashes

The ledger's authority rests on hash-based commitments: the contract commitment, the per-block Merkle state root, the protocol stamp, and the Bitcoin chain that orders them. Hash functions are the primitive least affected by quantum computing. Grover's algorithm gives only a quadratic speedup, which a 256-bit hash absorbs with a wide margin, whereas Shor's algorithm breaks the signature schemes in use today outright.

Even under a cryptographically relevant quantum computer, a party who recorded the Bitcoin chain and the network's data can re-derive and verify the entire history of the ledger, because verification is replay against hash commitments, not signature checking.

The exposed surface is narrow: the signatures that authorise new actions. SQRL treats it in two parts, drawn along the line it actually controls.

#The NIST standards adopted

SQRL's post-quantum profile uses only the algorithms NIST standardised in 2024:

Where post-quantum schemes protect transport or wrap a classical signature, they run in hybrid mode with a classical primitive such as X25519 or Ed25519, so a channel is secure if either holds. Hybrid deployment cannot be weaker than the classical scheme alone, and it defends against an adversary who records traffic today to decrypt later.

#The endpoints SQRL controls

• Validator attestations and checkpoint signatures. Co-signed state roots and subnet checkpoints are SQRL-protocol signatures, independent of Bitcoin consensus. Carried with ML-DSA, the accountability record stays unforgeable against a quantum adversary without any change to Bitcoin, and a scheme can be rotated without rewriting history.
• Inter-node and observer transport. Gossip, inter-validator RPC and the supervisor's observer feed use hybrid ML-KEM key establishment.
• The signing wallet. Custody is client-side, and the wallet is where post-quantum authorisation is offered to users who need it, over the Bitcoin path below.

These are profile capabilities operators adopt as part of standard onboarding, not a flag-day cutover. Classical verification stays valid through the hybrid transition.

#The Bitcoin authorisation path

Authorisation verified by Bitcoin consensus cannot be upgraded by SQRL alone.

• Single-use keys, today. A public key is not revealed on-chain until its output is spent. Wallets derive a fresh key for each authorisation, so each key is exposed once and briefly. Under Shor's algorithm the risk follows key revelation, and address reuse is the amplifier; a key used once gives a quantum adversary no reusable target.
• A post-quantum Taproot path. SQRL-compatible wallets can create Taproot outputs that commit to a script path requiring a post-quantum signature, such as ML-DSA or SLH-DSA, over a defined authorisation message. The larger witness is paid only if that path is used, and verification stays deterministic under Bitcoin's existing rules. As Bitcoin's own post-quantum roadmap matures, the execution model allows post-quantum-verified authorisation to become a first-class predicate inside SCL contracts.