Ethereum post-quantum protection costs just 7 cents per account
In brief
- SPHINCS- adapts NIST post-quantum standard to reduce Ethereum verification costs
- No hard fork required; offers bridge to future quantum-resistant solutions
- Ethereum accounts can be quantum-protected for approximately $0.07 each
The SPHINCS- approach
The proposal adapts SPHINCS+, a post-quantum signature standard developed by the US National Institute of Standards and Technology, to work more efficiently on Ethereum. The approach aims to reduce onchain verification costs without requiring a protocol change or precompile, making it deployable under current network rules.
Consigny described SPHINCS- as a bridge toward a future post-quantum signature system dubbed leanSPHINCS, which aims to further reduce verification costs through aggregation. This staged approach allows Ethereum to address quantum threats incrementally rather than waiting for a comprehensive hard fork that could take years to develop and deploy.
Why quantum threats matter now
The proposal seeks to address the long-term risk of a quantum threat to Ethereum's Elliptic Curve Digital Signature Algorithm with a cost-efficient solution that may be deployed before a dedicated hard fork is developed. Quantum computers theoretically pose an existential risk to current cryptography standards—a threat that's no longer purely theoretical.
In April, post-quantum startup Project Eleven awarded a prize to researcher Giancarlo Lelli for using a quantum computer to break a 15-bit elliptic-curve key. Lelli derived the private key from a public key using a variant of Shor's algorithm, a quantum computing technique that theoretically poses a threat to the type of cryptography used by Bitcoin.
The scale of exposure is substantial. According to Glassnode, approximately 1.92 million Bitcoin, representing nearly 10% of the total supply, are considered structurally unsafe in a future quantum attack scenario. Another 4.12 million BTC, or 20.6% of the supply, are classified as operationally unsafe due to key or address management practices.
