Trezor is weighing how to handle SHRINCS, the leading candidate post-quantum signature scheme for Bitcoin. Its CTO says the scheme's stateful signatures could let users lose funds if they are reused, so the company may make stateless signatures the default.
Trezor is considering making larger stateless signatures the default for all users in a post-quantum Bitcoin, and hiding the riskier stateful option behind an advanced settings wall. CTO Tomáš Sušánka outlined the plan as the maker of hardware wallet devices prepares for the shift.
Why stateful signatures create risk
SHRINCS, the community's leading candidate for a post-quantum signature scheme, was proposed late last year by Blockstream Research Director Jonas Nick and cryptographer Mikhail Kudinov. Users can make transactions with either stateful or stateless signatures.
Stateless signatures are large, which could affect fees and signing speed, but they are safe to reuse. Stateful signatures are smaller and more efficient, yet they carry serious security risks if used beyond a particular signing budget.
The stateful part is a tree of one-time signatures. If a key is accidentally used more than once, enough cryptographic information is revealed for someone else to forge the user's digital signature and effectively steal funds.
Trezor weighs trade-offs
Sušánka said state tracking leaves room for error. On MARA Foundation TV he put it this way: "You're giving them an option to mess up."
He is also torn on the topic because maintaining state is a burden. For example, two Trezors can share the same recovery seed, and he said sharing state between them is not really possible.
Still, he does not want to drop stateful signatures entirely. The stateful signatures are 10 times smaller, he said, and that makes a big difference.
Devices need upgrades too
Sušánka added that hardware wallets themselves need changes for full quantum protection. Most signing devices use quantum-vulnerable cryptography for firmware and device authentication.
Trezor already ships products such as Trezor Safe 7 that support post-quantum cryptography for wallet authentication. Transactions on these devices become quantum-secure only once Bitcoin itself upgrades.
Sušánka warned developers not to wait too long to offer users migration options, because he believes migrating potentially millions of users will take time.
Source: Decrypt
Trading involves risk.
Risk Disclaimer
