Bitcoin custody has always carried some risk, but wallet manufacturers such as Trezor are preparing for a post-quantum future with new challenges for users and developers. Trezor CTO Tomáš Sušánka said the company is working through the user-experience implications of SHRINCS, the community’s leading candidate for a post-quantum Bitcoin signature scheme.
SHRINCS was proposed late last year by Blockstream Research Director Jonas Nick and cryptographer Mikhail Kudinov. It uses a composite hash-based approach that lets users make transactions with either stateful signatures or stateless signatures.
Stateless signatures are quite large, which can affect fees, signature speed and other efficiency metrics, but they are safe to reuse. Smaller, more efficient stateful signatures carry serious security risks when reused beyond a particular signing budget. The stateful component of SHRINCS is made up of a tree of one-time signatures, and if those keys are accidentally used more than once, enough cryptographic information is revealed for someone else to forge the user’s signature and effectively steal funds.
If Bitcoin adopts SHRINCS, maintaining a meticulous count of a wallet’s state would become a critical responsibility for wallet developers, with many potential edge-case security risks. “You’re giving them an option to mess up,” Sušánka said during a recent episode of MARA Foundation TV, referring to state tracking. “It’s our job to make it in a secure way, right? It shouldn’t be the user’s job.”
Design choices and trade-offs
To reduce that risk, Trezor is weighing how to support secure user experience in a post-quantum world. Sušánka said the company is considering making the heavier, slower stateless signatures the default setting for all users and placing the riskier stateful option behind an advanced settings wall.
Sušánka recognizes that SHRINCS may be the conservative cryptographic choice because it relies on the same cryptographic assumptions as SHA-256, but he is “kind of torn on the topic because maintaining the state is a burden.” He noted that a user could have two Trezors with the same recovery seed, raising the question of how to share state between them. “You really don’t,” he added.
Still, he described the issue as a matter of trade-offs. The stateful signatures are 10 times smaller, he said, which makes a big difference. “I just don’t want to throw it off the table completely,” Sušánka said.
Hardware devices also need upgrades
Sušánka also said that while much attention is focused on Bitcoin’s migration path to post-quantum addresses and signatures, hardware wallet devices will need to be physically updated for full quantum protection. Most signing devices use quantum-vulnerable cryptography for hardware-specific security functions such as firmware and device authentication.
Users who want their devices to be secure in a post-quantum world will need “quantum-ready” devices that use post-quantum cryptography for device and firmware authentication. Trezor is already shipping products such as Trezor Safe 7 that support post-quantum cryptography for wallet authentication processes. Transactions made on those devices will only be quantum-secure once Bitcoin itself upgrades to post-quantum security.
Sušánka warned developers not to wait too long to give users migration options, saying the migration of potentially millions of users will take time. “People should be ready to make compromises,” he said. “If we’re all going to be very strict on what can and cannot be done, we’re not going to get anywhere.”
