Why Post-Quantum? The Threat is Real

Blythex

Almost every blockchain in use today secures your coins with elliptic-curve signatures (ECDSA or EdDSA). They are fast, compact and safe against every computer we have today. Against a large quantum computer running Shor's algorithm, they are not safe at all.

AntiQua was designed from day one on the assumption that this threat is not hypothetical – it's a matter of when. Here is what that means in practice.

What a quantum computer actually breaks

Not everything in a blockchain is equally at risk. The real problem is signatures, not hashing:

Building block	Used for	Quantum attack	Impact
ECDSA / EdDSA	Signing transactions	Shor's algorithm	Broken – the private key can be computed from the public key
RSA, ECDH	Encryption, key exchange	Shor's algorithm	Broken
SHA-256, SHA-3	Hashing, addresses, mining	Grover's algorithm	Weakened – effective security roughly halved (256 → ~128 bit), still considered safe
AES-256	Symmetric encryption	Grover's algorithm	Weakened the same way, still considered safe

In plain words: whoever controls a large enough quantum computer can derive your private key from your public key – and sign transactions as if they were you.

Why "not yet" is not a good excuse

1. Public keys live on-chain forever.
On most blockchains, your public key becomes visible the moment you spend from an address – and it stays in the chain history permanently. Every coin behind an exposed public key is a target the day a capable quantum computer exists. That includes millions of coins already sitting in such addresses today.

2. Migrating a live blockchain takes years.
Switching the signature scheme of an existing network needs consensus, new wallets, exchange support – and every single holder moving their funds. Coins whose owners lost their keys or stopped paying attention can never be moved to safety.

3. The standards are already here.
In August 2024, NIST published the first post-quantum standards: FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA). NIST's transition plan proposes to deprecate quantum-vulnerable algorithms like RSA and elliptic-curve cryptography after 2030 and disallow them after 2035. The rest of the industry is starting its migration now.

4. Attackers can wait.
"Harvest now, decrypt later" is not science fiction: data and public keys collected today can be attacked the day the hardware is ready.

How AntiQua handles it

AntiQua doesn't bolt post-quantum cryptography onto an old design. It is the design:

Layer	AntiQua uses	Standard
Signatures	ML-DSA-87	FIPS 204 · NIST security category 5
Key encapsulation	ML-KEM-1024	FIPS 203 · NIST security category 5
Hashing	SHAKE-256	FIPS 202 (SHA-3 family)
Seed phrases	AIP-39	our own post-quantum mnemonic standard
Proof of Work	RandomX	CPU-friendly, ASIC-resistant mining

NIST security category 5 is the highest level NIST defines: breaking it must be at least as hard as brute-forcing a key for AES-256.

And because post-quantum signatures are there from the genesis block, there is no legacy signature scheme to migrate away from – no future hard fork just to become quantum-safe.

The honest part: where the cost is – and how we contain it

Post-quantum security isn't free. The keys and signatures are much larger than what Bitcoin or Ethereum use:

	Public key	Signature
ECDSA (secp256k1)	33 bytes	~72 bytes
ML-DSA-87	2,592 bytes	4,627 bytes
AntiQua combined key (ML-DSA-87 + ML-KEM-1024)	4,160 bytes	–

A naive design would store all of that forever, on every node. AntiQua doesn't. Signatures are expensive once – on the wire and when a block is first accepted. After that, the network works with hashes, compact commits and checkpoints.

Verify once, then commit compact

When a block is connected, every transaction is verified in full – including its ML-DSA signature. What gets written to the ledger afterwards is a compact record: the 32-byte transaction hash, inputs, outputs and amounts – without signature and public key. The Merkle root and the block header hash bind that record to the verified original. Full and light nodes therefore store the proof of validation, not the proof itself.

Commitments instead of bodies in gossip

Block announcements carry transaction commitments – again 32 bytes per transaction. The full block with all signatures only goes to a subset of verifying nodes, or to whoever explicitly requests it.

Checkpoints instead of re-checking history

UTXO snapshots every 5,000 blocks record the state hash, total coin supply and UTXO root. A starting node syncs from the latest snapshot – checking proof of work, Merkle roots and transaction hashes – instead of re-verifying every historical signature.
Finality checkpoints every 100 blocks are signed by miners and confirmed by a quorum. Once a height is finalized, reorganisations before it are locked. That's a handful of large signatures for finality – not millions of transaction signatures on disk.

Why this stays secure

The check always happens before anything is discarded: a compact record is only valid because the full transaction was accepted first. Archive nodes keep the complete bodies, so anyone who needs the original – for an initial sync or a wallet – can fetch it and verify it again against the committed hash.

In short: post-quantum signatures cost bandwidth and CPU once. Storage stays lean. And even if it didn't: storage gets cheaper every year – a stolen private key never gets un-stolen.

Let's talk

Questions, doubts, counter-arguments? That's exactly what this category is for. Happy to go deep on any part of the stack – ask away

Want more? Read how AIP-39 keeps your seed phrase quantum-resistant, or check our Security Audit History.

— Blythex