Post-Quantum Cryptography (PQC)

What Is Post-Quantum Cryptography?

Post-quantum cryptography (PQC) is a branch of cryptography focused on developing algorithms that remain secure against both classical and quantum computers. Unlike quantum cryptography (which uses quantum mechanics to perform cryptographic tasks), PQC algorithms run on conventional hardware but are mathematically resistant to quantum attacks.

The urgency stems from a simple problem: the elliptic curve cryptography that secures Bitcoin, TLS connections, and most of the internet relies on the difficulty of the Elliptic Curve Discrete Logarithm Problem (ECDLP). Classical computers need roughly 2^128 operations to break a 256-bit elliptic curve key, making it effectively impossible. A quantum computer running Shor's algorithm solves the same problem in polynomial time, reducing it from a computational impossibility to something achievable in hours or minutes.

PQC replaces these vulnerable mathematical foundations with problems that quantum computers cannot efficiently solve: lattice problems, hash-based constructions, error-correcting codes, and multivariate polynomial systems.

Why Current Cryptography Is Vulnerable

Bitcoin uses two primary cryptographic primitives: secp256k1 elliptic curve operations for digital signatures (ECDSA and Schnorr), and SHA-256 for hashing. Each faces a different quantum threat.

Shor's Algorithm vs. Elliptic Curves

Shor's algorithm, discovered by Peter Shor in 1994, efficiently solves the discrete logarithm problem on quantum hardware. Applied to Bitcoin's secp256k1 curve, it can derive a private key from its corresponding public key in polynomial time. This breaks both ECDSA (used in legacy Bitcoin transactions) and Schnorr signatures (used in Taproot).

Current estimates suggest this requires approximately 2,330 logical qubits for a 256-bit curve, translating to between 500,000 and several million physical qubits depending on error correction overhead. As of 2026, the largest quantum computers have roughly 1,000 to 1,200 physical qubits: far below the threshold, but the gap is narrowing. DARPA has stated it considers a utility-scale quantum computer "more likely than not" by 2033.

Grover's Algorithm vs. SHA-256

Grover's algorithm provides a quadratic speedup for brute-force search, reducing SHA-256 preimage security from 2^256 to 2^128 operations. While significant in theory, 2^128 remains computationally infeasible. Unlike Shor's algorithm, Grover's cannot be efficiently parallelized, limiting its practical advantage. Bitcoin's proof-of-work mining and hash-based address commitments remain secure against known quantum attacks.

The asymmetry is stark: elliptic curve signatures face an existential threat from quantum computing, while hash functions require only modest parameter increases (doubling output size) to maintain equivalent security.

How It Works

PQC algorithms rely on mathematical problems that remain hard even for quantum computers. NIST evaluated dozens of candidates over eight years before finalizing its first standards on August 13, 2024. The selected algorithms fall into two main families.

Lattice-Based Cryptography

Lattice-based schemes build security on the difficulty of finding short vectors in high-dimensional lattices, specifically the Module Learning With Errors (MLWE) problem. Even quantum computers cannot efficiently solve MLWE. Two of NIST's three finalized standards use lattice constructions:

• ML-KEM (FIPS 203, formerly CRYSTALS-Kyber): a key encapsulation mechanism that replaces ECDH for establishing shared secrets. It offers three parameter sets at 128-bit, 192-bit, and 256-bit security levels.
• ML-DSA (FIPS 204, formerly CRYSTALS-Dilithium): a digital signature scheme that replaces ECDSA and Schnorr. It is the primary recommendation for general-purpose signing.

Hash-Based Signatures

Hash-based schemes derive their security entirely from the properties of hash functions like SHA-256 and SHAKE. Because hash functions are only quadratically weakened by quantum computers (via Grover's algorithm), they offer conservative, well-understood security guarantees:

• SLH-DSA (FIPS 205, formerly SPHINCS+): a stateless hash-based signature scheme. Its security rests on no lattice assumptions, making it a fallback if lattice problems turn out to be easier than expected. The tradeoff is significantly larger signatures.

A fourth standard, FN-DSA (FIPS 206, based on FALCON), was still in draft as of mid-2026. FN-DSA uses NTRU lattices and offers the smallest signatures among lattice-based schemes, but its reliance on floating-point arithmetic has complicated standardization.

Key and Signature Size Comparison

The most significant practical tradeoff of PQC is dramatically larger keys and signatures. The following table compares ECDSA (as used in Bitcoin today) with the NIST PQC signature schemes:

At equivalent 128-bit security, ML-DSA-44 signatures are roughly 38 times larger than ECDSA signatures. SLH-DSA signatures are even larger: 123 times ECDSA at the "small" setting, or 267 times at the "fast" setting. For blockchain systems where every byte of transaction data costs block space, this size increase represents a fundamental scalability constraint.

Bitcoin-Specific Concerns

Bitcoin's quantum vulnerability varies by address type. The critical factor is whether the public key has been exposed on-chain.

Exposed Public Keys

Early Bitcoin transactions used Pay-to-Public-Key (P2PK) outputs, where the public key is stored directly on the blockchain. A quantum attacker can take this public key, derive the private key via Shor's algorithm, and steal the funds with no time pressure. Approximately 1.7 million BTC sit in P2PK coinbase outputs from Bitcoin's early days, including an estimated 1.1 million BTC attributed to Satoshi Nakamoto.

Address reuse creates additional exposure. When a P2PKH or P2WPKH address spends a transaction, its public key is revealed in the input script. If the address receives more funds after that spend, those funds are now quantum-vulnerable because the public key is known. Analysis suggests approximately 6 million BTC (over 30% of issued supply) have structurally or operationally exposed public keys.

The Harvest Now, Decrypt Later Threat

Even before a CRQC exists, adversaries can execute "harvest now, decrypt later" (HNDL) attacks: recording encrypted communications and blockchain data today, then decrypting them once quantum hardware matures. For Bitcoin, this means every public key ever broadcast in a transaction is permanently recorded and available for future quantum attack. For a deeper analysis, see Harvest Now, Decrypt Later: Bitcoin's Quantum Timeline.

BIP-360: Pay-to-Quantum-Resistant-Hash (P2QRH)

BIP-360 (also called QuBit) proposes a new output type, P2QRH, that works similarly to Taproot but removes the quantum-vulnerable key-spend path. Instead of committing to an elliptic curve public key, P2QRH commits to a hash of a post-quantum public key (ML-DSA or SLH-DSA). The actual PQC public key and signature are only revealed when spending, keeping on-chain data compact until the spend occurs.

A companion proposal, BIP-361, outlines a more aggressive migration path: first prohibiting sends to quantum-vulnerable address types, then eventually invalidating all ECDSA and Schnorr transactions. This would effectively freeze any unmigrated funds, including Satoshi's coins: a deeply contentious prospect. For a comprehensive analysis of Bitcoin's quantum threat landscape, see Post-Quantum Cryptography: The Bitcoin Threat.

PQC Algorithm Categories

Beyond the NIST-standardized lattice and hash-based schemes, two other families of PQC algorithms are under active research:

• Code-based cryptography: built on the difficulty of decoding random linear error-correcting codes, a problem studied since the 1970s. The McEliece cryptosystem is the most established example. Code-based schemes have very large public keys (hundreds of kilobytes) but fast operations.
• Multivariate polynomial cryptography: based on the difficulty of solving systems of multivariate quadratic equations over finite fields. These schemes offer small signatures but have seen several candidates broken during the NIST evaluation, raising confidence concerns.

NIST's selection of lattice-based and hash-based algorithms reflects the broader consensus that these two families offer the best balance of security confidence, performance, and key/signature sizes.

Use Cases

Protecting Long-Lived Keys

Systems that generate keys expected to remain secure for decades: certificate authorities, cold storage wallets, and government infrastructure: are the most urgent candidates for PQC migration. A cold storage Bitcoin wallet created today with ECDSA may need to remain secure for 20+ years, well within the window where quantum computers could become operational.

Hybrid Cryptographic Schemes

During the transition period, many systems are adopting hybrid approaches: combining a classical algorithm (ECDSA or ECDH) with a PQC algorithm (ML-DSA or ML-KEM) so that security holds as long as either algorithm remains unbroken. This hedges against both quantum threats and the possibility that a newly standardized PQC algorithm contains an undiscovered weakness.

Layer 2 and Off-Chain Protocols

Layer 2 protocols face unique PQC challenges. On-chain transactions can theoretically be migrated through soft forks, but off-chain protocols must independently upgrade their signature schemes. For systems like Spark and Lightning, the signature size explosion from PQC directly impacts channel state management, routing efficiency, and storage requirements.

Risks and Considerations

Size and Performance Tradeoffs

The most immediate challenge for PQC adoption in blockchain systems is the dramatic increase in data sizes. An ML-DSA-44 signature (2,420 bytes) versus an ECDSA signature (64 bytes) means each transaction consumes roughly 38 times more block space. For a network already constrained by block size limits, this could severely reduce transaction throughput unless accompanied by structural changes to how signatures are stored and verified.

Migration Complexity

Transitioning a live blockchain with trillions of dollars in value to new cryptographic primitives is unprecedented. Users must actively migrate funds to new address types. Lost keys, abandoned wallets, and Satoshi's dormant coins present hard policy questions: should unmigrated funds be frozen, left vulnerable, or handled through some other mechanism?

Algorithm Maturity

ECDSA has been studied extensively for over 30 years. The NIST PQC standards, while thoroughly vetted, have far less real-world deployment history. Lattice-based cryptography in particular relies on hardness assumptions (MLWE) that lack the decades of cryptanalytic scrutiny that elliptic curves have undergone. SLH-DSA mitigates this concern by relying only on hash function security, but at the cost of even larger signatures.

Timeline Uncertainty

No one knows exactly when a CRQC will exist. Estimates range from 2033 to beyond 2050. Migrating too early imposes unnecessary performance costs. Migrating too late risks catastrophic loss. The harvest-now-decrypt-later threat means that for data with long confidentiality requirements, the migration deadline is effectively now, regardless of when quantum hardware arrives.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.