Quantum-Resistant Signatures Explained
What a signature does
A digital signature proves a message came from the owner of a private key. Every blockchain transaction relies on one. Today's signatures use elliptic curves, which a large quantum computer could break.
Main families
- Hash-based: built from hash functions, which are trusted to hold up. Examples include SLH-DSA, standardized by NIST, and one-time schemes such as Winternitz signatures. See hash functions and quantum.
- Lattice-based: built on hard problems about lattices. ML-DSA is the NIST standard in this family.
- Others: code-based and multivariate designs are studied, though some candidates have been broken by researchers.
The standards
In 2024 the US standards body NIST published its first post-quantum standards, including ML-DSA and SLH-DSA for signatures. More are in progress. Background is in post-quantum cryptography and crypto.
The trade-offs
The new signatures are generally larger than elliptic curve ones, sometimes by tens of times. Blockchains have limited space and fees per transaction, so bigger signatures mean heavier blocks, more bandwidth and possibly higher costs. Some are slower to verify or have usage rules, like never reusing a one-time key.
What blockchains can do
Options discussed in the community include new address types, optional quantum safe accounts and coordinated migrations. These need agreement among developers and users, and details differ per chain. For the Bitcoin and Solana picture, read this guide. QUANTUM (QNT) relies on whatever Solana adopts.
The standards in a table
| Standard | Based on | Family | Status |
|---|---|---|---|
| FIPS 204 (ML-DSA) | CRYSTALS-Dilithium | Lattice | Final, August 2024 |
| FIPS 205 (SLH-DSA) | SPHINCS+ | Hash-based | Final, August 2024 |
| FIPS 206 (FN-DSA) | Falcon | Lattice | Draft, as of sources we read |
NIST described ML-DSA as the main signature standard and SLH-DSA as a backup built on a different mathematical approach, so it would stay usable if ML-DSA were ever found weak. FN-DSA is smaller but needs careful floating point handling, which makes it trickier to implement safely. NIST also picked the HQC encryption method in March 2025 as a backup to ML-KEM, with a final standard expected in 2027. Check the NIST site for current status. See the status guide.
Size trade-offs
One source puts Bitcoin's Schnorr signatures at 64 bytes, while post-quantum options range from about 666 bytes for Falcon-512 to over 7,800 bytes for SPHINCS+. That is up to roughly a hundred times larger, which affects block space and fees. Details are in signature sizes and block space.
What is changing in 2026
- Bitcoin: BIP-360 (Pay-to-Merkle-Root) was merged as a draft in February 2026. It would be a soft fork, and a follow-up BIP-361 discusses migration. Neither is active.
- Solana: an optional hash-based Winternitz Vault has existed since January 2025. Only users who opt in are covered.
- Others: see Algorand, Sui, Aptos and QRL for chains moving earlier.
Common mistakes
- Reusing a one-time key. Winternitz style signatures are safe only once per key.
- Treating a new standard as bug free. Several candidates, such as SIKE and Rainbow, were broken by researchers during the NIST process, so crypto agility matters. See crypto agility.
- Using hype products. Beware of tokens claiming to be quantum proof without published designs.
How to check this yourself
Read the project's technical proposal and look for named NIST standards, audits and testnet results. Nothing here is financial advice.
Sources and further reading
- NIST: first three finalized post-quantum standards, 13 August 2024
- NIST: HQC selected as fifth post-quantum algorithm, March 2025
- Cointelegraph: BIP-360, what it changes and what it does not
- The Quantum Insider: Solana Winternitz Vault, January 2025
Checked 2026-10-09. Research and standards change often, so check the primary documents. Nothing here is financial advice. The QNT memecoin is independent of Quantinuum Ltd, the real company, and of every lab, company and standards body named on this page.
Frequently asked questions
Are quantum-resistant signatures available now?
Yes, standards exist and are being added to software. Adoption in blockchains is still being discussed.
Why not switch blockchains to them immediately?
They are larger and need changes to wallets, tools and consensus rules, which takes coordination.
What is SLH-DSA?
It is a NIST standardized hash-based signature scheme designed to resist quantum attacks.
What is ML-DSA?
It is a NIST standardized lattice-based signature scheme designed to resist quantum attacks.
Which is smaller, Falcon or ML-DSA?
Falcon signatures are smaller, about 666 bytes at the lowest level, while ML-DSA signatures are in the low thousands of bytes.
Is a hash-based signature safer?
It relies on fewer assumptions, which many experts like, but it has larger signatures and, for some schemes, state to manage.
What is a stateful signature?
It is a scheme where each key can sign only a limited number of times, so the signer must track usage to avoid reuse.
Has SIKE or Rainbow been broken?
Yes. Both were broken by researchers, which is why standards come from years of public review.
Keep reading
- Post-Quantum Cryptography and Crypto: What It Means
Why large quantum computers could threaten blockchain signatures, and what post-quantum cryptography is doing about it. - Elliptic Curve Cryptography Explained for Crypto Users
Elliptic curve cryptography secures Bitcoin and Solana wallets. Learn how it works in plain English and why a large quantum computer could threaten it. - Hash Functions and Quantum Computers: Are They Safe?
Are hash functions like SHA-256 safe from quantum computers? Learn how Grover's algorithm affects hashing, mining and blockchains in plain English. - Will Quantum Computers Break Bitcoin and Solana?
A calm, factual look at the quantum threat to Bitcoin, Solana and other blockchains, what is safe now, and what could change.
All Quantum computing guides | Back to top | Search the site
Main pages: Quantum computing explained | Quantum and crypto | Companies | Quantum news | Glossary