What exactly is at risk?
Public-key cryptography, and specifically the step where a public value is derived from a secret one by mathematics that cannot be run backwards. Shor's algorithm, published in 1994, is a method for running it backwards given a large enough quantum computer. Symmetric encryption and hash functions are far less affected, which is why hash-based constructions keep appearing in post-quantum designs.
The practical consequence is that anything already published under the old assumption stays published. A Zcash address carries a public key built from the wallet's viewing key through one-way elliptic-curve mathematics of the same kind that protects bitcoin and ether wallets. Today that address gives nothing away. It would give away the viewing key, and with it the payment history, to a machine that does not yet exist.
Why the deadline is earlier than the machine
Because exposure accumulates now and is spent later. Data captured today can be decrypted when the capability arrives, so long-lived secrets are already at risk. On public chains the position is starker, since the exposure is not captured but volunteered: the Quantum Alliance puts 6.4 million bitcoin, or 30.2 percent of supply, in addresses whose public keys are already on chain, among them about 1.1 million attributed to Satoshi Nakamoto.
The same logic reaches further than wallets. NEAR Intents posts one of a user's private Zcash addresses on NEAR's public chain as a refund address; it goes up as soon as the deposit lands and stays there even if the swap completes and no refund is needed. An address nobody needed is a permanent record, and the proposal from the team behind Zakura is to give every swap its own private key so that record links to nothing wider. Spending keys stay with users, and private information retrieval lets wallets find refunds without revealing which addresses they check.
| Layer | What changes | What it costs if skipped |
|---|---|---|
| Signature scheme | Replaced with a lattice- or hash-based construction | The obvious break, and the only part most plans cover |
| Hash choice | Determines proof size, recursion cost and bandwidth | A system that is secure and too expensive to run |
| Already-published keys | Cannot be unpublished; need moving or wrapping | Exposure that no future upgrade removes |
| Incidental addresses | Refund and change addresses posted to other chains | A single unused address links a whole history |
| Embedded targets | Need an implementation without floating-point arithmetic | The scheme works on servers and not on devices |
| Governance | Agreement on whether to freeze, move or wrap exposed funds | Property-rights and neutrality objections, unresolved |
Is the replacement cryptography practical yet?
On ordinary hardware, yes, and increasingly on small hardware too. Mitaka is a variant of Falcon, the lattice scheme standardised as FN-DSA, with a simpler signing procedure that can be parallelised. It offers two signing paths: a default one using floating-point arithmetic, and MitakaZ, which avoids floating point at the cost of more Gaussian samples and is the more portable of the two.
Until this month MitakaZ had not been implemented in practice. A fixed-point implementation now reports an average of 361 kilocycles for Mitaka-512 and 707 kilocycles for Mitaka-1024 on an Intel Core i7-1360P with AVX2, and 4.0 and 7.8 megacycles for the same operations on an ARM Cortex-M4F microcontroller. The authors also prove bounds on intermediate values and representation errors without empirical assumptions, which matters because in a signature scheme an implementation detail visible through the output distribution is a security problem rather than a performance one.
What the protocol work has learned
That the algorithm is the small part. A post-quantum proof-native protocol we covered set out three lessons for Ethereum's own migration: swapping signatures is not the same as securing a system end to end, the hash choice determines proof size, recursion cost and bandwidth, and recursive validity separates historical execution from what a new node must process to start.
The same work is a model for how to publish claims in this area. Its author separated 127 bits provable from 127 bits conjectured instead of rounding both to 128, and stated plainly that the claims rested on premises without external audit. A second participant then reproduced every published figure on different hardware and changed one parameter to see whether the conclusion moved.
Several lattice-based folding schemes now aim at plausible post-quantum security while trying not to give up small fields or low recursion overhead. Most publish no timings and no baseline, so they cannot be compared with each other on anything but asymptotics.
What cannot be solved with cryptography
What to do about the coins already exposed. Proposals to freeze them, move them or place them in a trust have drawn objections on property rights and network neutrality, and any upgrade would need broad coordination across the ecosystem. That is a governance problem, and it is the part no standards body settles on its own.
Questions
- What does a post-quantum migration actually change?
- More than the signature algorithm. The hash choice determines proof size, recursion cost and bandwidth; keys already published cannot be unpublished; incidental addresses posted to other chains stay as permanent records; and embedded targets need an implementation that avoids floating-point arithmetic.
- Why migrate before a quantum computer exists?
- Because exposure accumulates now and is spent later. Captured data can be decrypted when the capability arrives, and on public chains the keys are already visible: 6.4 million bitcoin, 30.2 percent of supply, by the Quantum Alliance's estimate.
- Can post-quantum signatures run on small devices?
- Increasingly. A fixed-point implementation of MitakaZ, which avoids floating-point arithmetic, signs in 4.0 megacycles for Mitaka-512 on an ARM Cortex-M4F microcontroller and 361 kilocycles on an Intel AVX2 part.
- What part of the problem is not cryptographic?
- What to do with coins whose keys are already exposed. Freezing, moving or wrapping them raises property-rights and network-neutrality objections, and any change needs broad coordination — a governance question rather than a technical one.