Applied Post-quantum Cryptography

Building Post-quantum Cryptography for applications, especially for Blockchain industry

[Applied Post-quantum Cryptography @AppliedPQC]

This is deliberately narrower and focuses on three things: implementation (code, test vectors, conformance), industry deployment (what is actually shipping in TLS, SSH, browsers, and hardware), and migration (inventory, hybrid rollout, and timelines).

https://t.co/1bGS6gimB2

[Applied Post-quantum Cryptography @AppliedPQC]

@BitcoinMagazine When PQ safe?

[Applied Post-quantum Cryptography @AppliedPQC]

The solution of post-quantum safe BitVM is coming soon!

[GOAT Network @GOATNetwork]

Of the two families in the comparison, the lattice side is where we're headed: ML-DSA is the scheme GOAT Network's validator consensus keys are migrating to.

With the @AppliedPQC playground, anyone can run it in browser and see what that means.

The post-quantum work continues.

[GOAT Network @GOATNetwork]

This report by @AppliedPQC is the most detailed public post-quantum analysis of any Bitcoin L2: https://t.co/4ArrgtRpHm

Every surface read at the source, run against our own stack, exposures included.

Five findings that matter most for GOAT Network ⬇

[GOAT Network @GOATNetwork]

GOAT Research has published a full explainer of SHRINCS, the draft signature scheme proposed for Bitcoin's post-quantum migration.

SHRINCS was published as a BIP in August. It is built from hash-based cryptography older than Bitcoin, runs entirely on SHA-256, and asks the network to trust nothing it does not already trust. The open question is its statefulness: a SHRINCS key signs through a compact path that must track how many signatures it has produced, because reusing a slot makes forgeries possible, and when state is lost a stateless path takes over at a larger signature size. Compact signatures in exchange for new wallet complexity is the trade the proposal makes, and it is the substance of the discussion around it.

The explainer covers the mechanisms behind that trade: the two signing paths, the state rules, the signature budget, and how the August draft differs from the April specification.

https://t.co/EjYoCSEwM4

[Applied Post-quantum Cryptography @AppliedPQC]

Curious about how long, and what’s the prompt you use to get here

[penlu @penlume]

4397328654844826923795068102505872571721883526553349659561256924505973939597593482272505698004801207988043088656411102133523080581 divides RSA-260

[ZKM @ProjectZKM]

https://t.co/dat5DqX3mg

[Applied Post-quantum Cryptography @AppliedPQC]

Rust implementation of SHRINCS: https://t.co/A7BY8O9VC0

The measurement on an Intel Xeon Platinum, 4 vCPU with 2 threads per core, 14 GB of memory:

[Applied Post-quantum Cryptography @AppliedPQC]

Explain the construction of SHRINCS:
https://t.co/TGzLTo0KcH

[Applied Post-quantum Cryptography @AppliedPQC]

Explain the construction of SHRINCS:
https://t.co/TGzLTo0KcH

[Jonas Nick @n1ckler]

Today, we're publishing BIP SHRINCS, the first concrete proposal for a post-quantum signature scheme designed specifically for Bitcoin.

The BIP draft turns what began as a rough idea into exact algorithms with an executable reference implementation.
This is an important milestone: the discussion can now focus on analyzing, criticizing, and improving a concrete proposal.

The BIP makes choices ranging from major design questions, such as whether to support flexible XMSS and how to balance signature size against verification time, to the many smaller decisions involved in saving a byte here or there.
All of these choices are up for debate.

Big thanks to Mike Casey, @conduition, @Ethan_Heilman, @kudinov_mikhail, @olkurbatov, Boris Nagaev, and @remix7531 for their contributions to the BIP.

A lot more work lies ahead:

- The draft BIP specifies only the cryptography. Using SHRINCS in Bitcoin Script will require a separate BIP.
- We are working on a security proof for the exact construction and parameters.
- Wallet integration and user experience, for example around backups and recovery after state loss, are still at an early stage. The design space remains wide open.

SHRINCS is not intended to be Bitcoin's "final" signature scheme, and it is not optimal along every axis.
I do think it is a very good trade-off among the options we have now.

bitcoin-dev post:
https://t.co/BHYMfQ5c97

Draft BIP:
https://t.co/rl3X7VdbRy

[Applied Post-quantum Cryptography @AppliedPQC]

The most important thing is the deployment now.

[a16z Frontier @a16zfrontier]

Can a sufficiently powerful quantum computer forge the signatures used to authorize Bitcoin and Ethereum transactions? What would it take to upgrade both networks before that happens?

In this new lecture, Stanford cryptographer @danboneh explores why blockchains may turn to signatures built from hash functions. He also presents new research on threshold signing.

The talk ends with the questions Bitcoin still has to answer, including whether post-quantum signatures will require larger blocks, what happens to abandoned coins, and how someone such as Satoshi could prove ownership after Bitcoin’s current signatures have been retired.

00:00 Why blockchains need to prepare for quantum computers
03:05 Why Bitcoin may bet on hash-based signatures
06:25 The “big footgun” in stateful signatures
08:58 A quantum-safe signature that takes one billion hashes
14:13 Inside SLH-DSA’s virtual tree
20:30 How Bitcoin and Ethereum could make the switch
23:48 What happens when a wallet loses its state?
32:47 Can threshold signing survive the quantum transition?
36:39 How to hide lattice cryptography from the blockchain
38:49 Why threshold one-time signatures seem impossible
45:36 How context prevents forged signatures
49:37 The forgotten idea behind Winternitz signatures
54:50 Turning one-time signatures into threshold signatures
1:04:27 Will quantum-safe signatures require bigger Bitcoin blocks?
1:06:26 Abandoned bitcoin and Satoshi’s recovery problem

[Applied Post-quantum Cryptography @AppliedPQC]

Google Cloud's PQC roadmap prioritizes protection across three key domains:

> Mitigating Store Now, Decrypt Later (SNDL) risks
> Ensuring integrity against forgery
> Enhancing foundational capabilities for cryptographic agility

Details: https://t.co/iRQIKFoZBK

#PQC

[Lukasz Olejnik @lukOlejnik]

A major result in post-quantum cryptography. A key security assumption behind Classic McEliece, a public-key encryption system considered to resist quantum computers, has been undermined. Researchers found a provable quasipolynomial-time method for detecting the hidden mathematical structure in its public keys. The attack is still astronomically expensive and cannot yet decrypt messages, but this is a serious weakening of one of the oldest post-quantum cryptosystems. McEliece is not broken practically today, but an important assumption underlying its theoretical security has been broken. For the Classic McEliece parameter sets, the estimated cost of the best known structural distinguisher drops from roughly 2^298-2^691 operations to about 2^114-2^124. That is huge. https://t.co/b5RMDiaCcM