Why the Path to Quantum Resistance Runs Uphill for Bitcoin Wallet Makers

Bitcoin wallet manufacturers are preparing for a post-quantum future, where the cryptocurrency’s security will need to withstand the immense computational power of quantum computers. Trezor, a leading maker of hardware wallets designed to keep private keys secure offline, is actively addressing the challenges of this transition. The company’s CTO, Tomáš Sušánka, highlighted the specific difficulties that will arise when the community’s leading candidate for a post-quantum signature scheme, SHRINCS, is adopted.

SHRINCS, proposed by Blockstream Research Director Jonas Nick and cryptographer Mikhail Kudinov, offers a composite hash-based approach. It allows users to create transactions using either stateful or stateless signatures. The choice between these two has significant implications for security and efficiency. Stateless signatures are larger and slower but safe to reuse, while stateful signatures are smaller and more efficient but carry a serious security risk if used beyond a specific signing budget.

The core of the risk lies in the stateful component, which is built on a tree of one-time signatures. If a user accidentally reuses these keys more than once, enough cryptographic information is revealed for an attacker to forge their signature and steal their funds. This makes maintaining a meticulous count of the wallet’s state a critical responsibility for developers, introducing numerous potential edge-case security risks.

To mitigate this risk, Trezor is weighing options for how to support secure user experience in a post-quantum world. Sušánka suggested the company might make the heavier, slower stateless signatures the default setting for all users, hiding the riskier stateful option behind advanced settings. This would protect the majority of users from making a critical error, even if it means a slight reduction in transaction efficiency.

However, Sušánka expressed a complex view on the trade-offs involved. While he acknowledges that SHRINCS is a conservative choice because it relies on the same cryptographic assumptions as SHA-256, he is “kind of torn on the topic because maintaining the state is a burden.” He noted that even two Trezor devices with the same recovery seed cannot easily share the state, creating a significant logistical challenge.

Despite these concerns, Sušánka believes the benefits of the smaller stateful signatures—being ten times smaller than stateless ones—make them worth considering. He emphasized that the migration process will be complex, involving potentially millions of users, and that compromises will be necessary to move forward. He warned developers not to wait too long to provide users with migration options.

The challenges extend beyond the wallet software. Most signing devices currently use quantum-vulnerable cryptography for hardware-specific security functions, such as firmware and device authentication. For full quantum protection, users will need to use “quantum-ready” devices that employ post-quantum cryptography for these authentication processes. Trezor is already shipping products like the Trezor Safe 7 that support post-quantum cryptography for wallet authentication, though transactions will only be quantum-secure once Bitcoin itself upgrades its protocol.