Hash-based signatures and Ethereum's post-quantum plans
Sample story. Why signatures built from nothing but a hash function are the conservative bet against quantum computers.
TL;DR
- ECDSA and similar elliptic-curve schemes are vulnerable to Shor's algorithm on a large quantum computer.
- Hash-based signatures only assume a secure hash function; NIST standardised SLH-DSA (from SPHINCS+) in FIPS 205.
- The cost is size: signatures are kilobytes rather than tens of bytes, which matters for blockchains.
Signing with one-time secrets#
The simplest hash-based signature is a one-time scheme: publish the hashes of a set of random secrets as your public key, then sign a message by revealing the secrets that correspond to its bits. Anyone can hash what you revealed and check it against your public key. Reveal too much and someone can forge, so each key signs once. Modern schemes stack many one-time keys into trees so one public key can sign many messages.
From one-time keys to a tree#
What this sample leaves out#
A full story would compare signature sizes and verification costs across SLH-DSA, ML-DSA and Falcon, explain how account abstraction could let Ethereum users switch schemes, and cover the emergency hard-fork proposals. This sample stops here.
You are reading the overview. Switch to “Full deep dive” in the top bar for the mechanics, maths and code.
Why this matters to you
Post-quantum migration is a live research area where a careful survey or benchmark could become a paper, and it is the kind of cryptography depth that makes your Web3 work stand out at GDG talks.
Sources
- FIPS 205: Stateless Hash-Based Digital Signature Standard · NIST · 13 Aug 2024
- Future-proofing Ethereum · ethereum.org