Post-quantum signatures
Why Ed25519 faces quantum risk, and why QLP uses hash-based LMS signatures for withdrawals.
Why Ed25519 faces quantum risk
Normal Solana wallets use Ed25519 signatures. Every Solana address is an Ed25519 public key. Shor's algorithm, run on a large enough quantum computer, could derive the private key from that public key.
- No such machine exists today, and timelines are uncertain.
- Public keys are already public. Accounts protected only by Ed25519 would be exposed the day such a machine exists.
How hash-based signatures work
Hash-based signatures rely only on a hash function such as SHA-256 being hard to invert. That assumption is believed to hold against quantum attacks: Grover's algorithm still leaves about 128 bits of security.
- They are standardized: LMS / XMSS (NIST SP 800-208) and SLH-DSA (FIPS 205).
- QLP uses
LMS_SHA256_M32_H10withLM-OTS W4(RFC 8554). Each chain step is one SHA-256 syscall on-chain. - Both the on-chain verifier and the browser signer pass the RFC 8554 test vectors.
QLP's key structure
QLP's LMS tree holds 1,024 one-time Winternitz keys grouped in a Merkle tree. You register a single 32-byte root; each withdrawal uses the next unused key, and the last one is reserved for rotating to a fresh tree.