The timeline for practical quantum computers keeps moving up. Recent hardware advances, including Google’s Willow processor, have made the threat to blockchain wallets feel more immediate. Most wallets rely on elliptic curve keys. A quantum machine running Shor’s algorithm could recover private keys from public keys. That would put nearly every active wallet at risk.
A Migration Problem
Moving to post-quantum signatures sounds straightforward, but it is not. The public key format must change. Every network would need to force address migration. That is a heavy burden for users and developers.
Researchers have been looking for a way around this. A new paper by Vincenzo Botta, Michal Pospieszalski, Emanuele Ragnoli, and Justus Ranvier proposes something different. Instead of changing the address format, they replace the signing step with a zero-knowledge proof. The wallet keeps its existing address. The proof shows knowledge of the seed behind that address without revealing it.
How It Works
The idea builds on earlier work by Baldimtsi and others. With EdDSA, the seed acts as a valid zero-knowledge witness for the public key. The new paper extends this to hierarchical deterministic wallets. Starting from BIP32-Ed25519, the classical signing step is replaced by a proof that covers the root seed and the entire derivation chain. The scheme is then shown to be EUF-CMA secure.
There is also a new key derivation method called QBIP32. It uses a keyed function HASH768, instantiated with KMAC256, to produce the signing scalar, an explicit quantum-safe witness, and the chain code in one call. Unlike current curve-specific systems, QBIP32 works across secp256k1, Ed25519, and future curves without structural changes.
Efficiency Gains
The bigger problem is cost. A monolithic proof of the whole derivation chain grows linearly with depth. The paper’s main contribution is ZKPoSP, which stands for Zero-Knowledge Proof of Seed Provenance. It splits the proof into two parts. A derivation proof is generated once for each key pair. A signing proof is generated once per message. That keeps per-message cost constant, independent of derivation depth.
The authors also identify when a proof can be shortened to cover only the final derivation step. Hardened keys meet the required condition, while non-hardened keys do not. For BIP44 routes, a single proof can cover one hardened step plus the non-hardened suffix. That means the root seed can be safely deleted.
After Q-day, once networks reject non-post-quantum signatures, the leaf scalar can be moved to the public statement. That removes all elliptic-curve scalar multiplications from the proof circuit. The authors implemented everything in Rust with RISC Zero as the NIZK backend. Benchmarks show signing and proving times around 12 to 13 seconds. Verification takes about 9 to 10 milliseconds across different depths and variants.
That said, this is early work. The security argument depends on the quantum hardness of hash functions and the soundness of NIZK against quantum adversaries. Still, it offers a practical path that avoids forced migration. That alone makes it worth watching.
