Designing a Post-Quantum Signature Fallback for Bitcoin

Summary

On August 26, 2026, the Isabel Foxen Duke podcast featured Conduition explaining SHRINCS, a proposed hash-based post-quantum signature design for Bitcoin that pairs a compact stateful signing path with a larger stateless fallback. The design seeks to reduce dependence on elliptic-curve cryptography while controlling signature size through tuned parameters, flexible XMSS structures, and a recovery path derived from standardized SPHINCS/SLH-DSA components. Its broader consequence is that post-quantum readiness becomes as much a wallet-engineering, migration, and governance problem as a cryptographic one.

Take-Home Messages

1. Fallback security: A hash-based signature option could diversify Bitcoin's cryptographic assumptions without requiring immediate abandonment of elliptic-curve signatures.
2. State management: Compact signing depends on precise wallet state, making backup, restore, migration, and implementation errors direct security concerns.
3. Resource tradeoffs: SHRINCS reduces the size penalty of hash-based signatures but still leaves material block-space and fee-design questions.
4. Functionality costs: Public-key derivation and conventional multisignature do not carry over cleanly, so privacy, custody, and watch-only workflows need replacement designs.
5. Migration strategy: Hybrid classical and post-quantum spending paths could support gradual preparation, but safe deployment depends on output design, address-use practices, and uncertain threat timing.

Overview

Bitcoin's current signature model concentrates security in elliptic-curve cryptography, creating a common dependency that a hash-based scheme could diversify. SHRINCS is described as a composite construction with a stateful path optimized for compact everyday signing and a stateless SPHINCS-derived path reserved for recovery or cases where signing state cannot be trusted. The architecture aims to make post-quantum readiness available as a fallback without forcing every transaction to carry the full cost of a large stateless signature.

The stateful path uses flexible XMSS built from Winternitz one-time signatures organized in Merkle trees, with tree shape chosen at key generation. Unbalanced XMSS favors very small early signatures but increases signature size with reuse, whereas balanced XMSS supports far more signatures at a constant size and is better suited to repeated-signing use cases. This flexibility lets implementations trade signing capacity, signature size, and address-reuse requirements rather than imposing one parameter set on all wallets.

The stateless path uses standardized SLH-DSA algorithms with modified parameters and functions as a recovery mechanism when wallet state is lost, stale, or uncertain. Its signatures are much larger than the stateful path, while the stateful path itself remains larger than current elliptic-curve signatures, although verification can be comparatively fast. Deployment therefore forces explicit choices among block-space consumption, long-term storage, verification work, possible witness discounts, and the degree of optimization that protocol designers are willing to encode.

Hash-based signatures also remove algebraic capabilities that current Bitcoin wallets use for public-key derivation and multisignature. Deterministic software wallets can still generate many keys from a seed, but xpub-style derivation by untrusted observers and conventional threshold-signature constructions do not transfer directly, creating pressure for hybrid schemes or multiparty computation. Post-quantum migration is therefore a system redesign problem spanning consensus rules, output types, wallet standards, custody architecture, privacy, and user behavior rather than a simple substitution of one signature algorithm for another.

Implications and Future Outlook

Protocol organizations and implementers must decide whether post-quantum signatures should first be deployed as an emergency-capable fallback or optimized immediately for routine use. A fallback-first approach limits the required consensus surface and preserves current functionality longer, but it risks leaving wallet tooling, education, and operational practice immature when rapid migration becomes necessary. The central preparation task is therefore to establish deployable primitives, safe output paths, and tested wallet procedures before an external deadline exists.

Wallet developers would assume substantially greater responsibility for cryptographic state integrity under the compact stateful path. Standards will need to specify key generation, state counters, backup semantics, import restrictions, recovery behavior, hardware-wallet constraints, and transitions between stateful and stateless signing. Without strong interoperability and conformance testing, implementation diversity could become a larger source of loss than the cryptographic primitive itself.

Custodians, Lightning-related systems, watch-only services, and users who depend on xpubs or multisignature will need explicit migration architectures rather than generic post-quantum support. Hybrid schemes may preserve classical functionality during a transition, while multiparty computation could replace some threshold functions at the cost of additional moving parts and security assumptions. Governance decisions should therefore evaluate post-quantum proposals against concrete operational use cases and failure modes, not only security bits and signature sizes.

Some Key Information Gaps

1. How much systemic risk is reduced by adding a hash-based signature family alongside elliptic-curve signatures rather than replacing the existing scheme outright? The answer would clarify whether cryptographic diversification justifies the added protocol and implementation complexity.
2. Which wallet-state failure modes are most likely to cause unsafe one-time signature reuse under real backup, restore, and device-migration practices? This evidence could shape wallet standards, test suites, recovery procedures, and certification priorities.
3. What wallet architecture can reproduce the privacy and delegation benefits of xpub-based public-key derivation when the post-quantum key itself cannot be rerandomized? Resolving this would determine whether post-quantum migration can preserve practical wallet privacy and monitoring functions.
4. What new attack surfaces and operational dependencies arise when multiparty computation substitutes for native threshold signatures in a post-quantum setting? This comparison is necessary for deciding whether institutional custody can migrate without materially weakening its security model.
5. What migration policy remains safe across a wide range of possible quantum-computing arrival dates, including scenarios with little or no warning? A robust answer would guide consensus sequencing, readiness investments, user migration, and emergency response design.

Broader Implications

Cryptographic diversification as infrastructure resilience

Long-lived digital infrastructure can become fragile when many critical functions depend on one family of mathematical assumptions. Maintaining an independently grounded fallback can reduce correlated failure risk even when the fallback is less efficient or less functional. This reframes cryptographic redundancy as resilience engineering rather than a forecast about when any particular threat will materialize.

Security shifts from primitives to implementation systems

A mathematically conservative signature scheme can still create new operational vulnerabilities when safe use depends on software-maintained state. As cryptographic designs move complexity into wallets, backups, recovery procedures, and multiparty protocols, assurance must extend beyond formal proofs to implementation and human operating practices. Security governance consequently becomes a joint problem of cryptography, software engineering, standards, and institutional controls.

Migration under deep technological uncertainty

Infrastructure transitions are hardest when the cost of early action is visible but the deadline for late action is unknowable (see my discussion of this issue in Chapter 6 of my draft book, When Evidence Falls Behind). Robust migration strategies therefore favor options that can be deployed before they are urgently needed, preserve current functionality during normal conditions, and still provide an emergency path if assumptions change abruptly. This logic applies broadly to technological systems facing low-probability but high-consequence breaks in foundational dependencies.

Resource pricing becomes part of security design

Post-quantum security can alter the relationship among computation, bandwidth, storage, and transaction fees because alternative signatures consume these resources in different proportions. Protocol rules that price data and verification work therefore influence which security technologies are economically usable, not merely how users pay for transactions. Future cryptographic transitions may require resource-accounting rules to evolve alongside the primitives they are intended to support.