Post-Quantum TOS

Make the signature replaceable before the signature breaks.

A quantum computer does not slow a chain down. It takes the keys. Account authority, validator authority and every proof a light client trusts rest on Ed25519 today. TOS is replacing both authorities in public source, one layer at a time.

Nothing on this page is active on a TOS network.

One signature slot, holding a 64-byte Ed25519 key today, sized for a 2,420-byte post-quantum key next. ED25519 · 64 B ML-DSA-44 · 2,420 B
Verification primitive
ML-DSA-44
Implemented · FIPS 204
Account authority
Opt-in per account
Implemented · locally validated
Validator authority
Profile v1
Design frozen
Active on a TOS network
None
Not activated

What actually breaks

Signatures break. Hashes bend.

Shor's algorithm recovers a private key from a public key. Grover's only halves a hash, which a 256-bit digest absorbs — so cell hashes, addresses and the state tree stay. What has to be replaced is authority.

  1. Account authority

    The largest value exposure, and the only layer that can migrate without a network-wide event. That is why TOS built it first.

  2. Governance authority

    A post-quantum requirement is worth nothing if the classical path that installed it can also remove it. Election, configuration and recovery are treated as a hard blocker, not a follow-up.

  3. Validator authority

    Consensus votes and the certificates that finalize them. Replacing these is one coordinated decision, and it is bounded by certificate size rather than by the cost of a single verification.

  4. History and light clients

    Finalized history is not retroactively readable, but a client that follows a forward chain of proofs is trusting old keys to authenticate an alternative past.

Migration strategy

Three layers, migrated in the order they can move.

How a layer is allowed to change decides when it changes.

Account layer Moves account by account, opt-in Implemented
Validator layer Moves once, by network decision Design frozen
Signer and key layer Moves per operator deployment Design frozen
Implemented · locally validated

Account layer

A general-purpose post-quantum verification instruction, and an authentication root any account can adopt on its own schedule.

  • One instruction, no wallet assumptions PQCHECKSIG_MLDSA44 verifies FIPS 204 Pure ML-DSA-44 over canonical cells. 1,312-byte key, 2,420-byte signature, fixed price: 50,000 gas plus one per decoded byte.
  • Three account modes Staged, module-only, or module and Ed25519 co-signature. Legacy authority may only stage a module; once strict, nothing restores the classical path.
  • An immutable verifier No administrator, no recovery key, no code setter. Rotation deploys a new module rather than mutating the old one.
Read the instruction specification
Design frozen · in implementation

Validator layer

The production validator stays Ed25519. What is being built is a boundary that can hold a second algorithm at all.

  • The suite selects the verifier A key record declares its algorithm, and admission dispatches on that declaration instead of assuming Ed25519. Suite 2 is ML-DSA-44 — reachable in code, deliberately unreachable on chain.
  • Identity outlives the algorithm Stake identity is authenticated independently of the signing scheme, so a rotation does not invalidate what old sessions proved.
  • Activation is chain state The policy in force is selected from authenticated state at session birth. An operator flag, a missing backend or a timeout cannot downgrade it.
Read the frozen profile
Design frozen · in implementation

Signer and key layer

The operational half of the migration, specified while the algorithm is still open — because it cannot be retrofitted after one is chosen.

  • Keys that refuse Protected validator keys refuse raw signing, decryption and export. No endpoint hands out a consensus private key.
  • Reserve before sign Signing capacity is reserved before the signature exists and committed before the result is released, so a crash cannot silently reissue an index.
  • Anti-rollback Append-only journal and witness. A restored backup is the failure mode that stateful schemes punish hardest.
Read the authentication inventory

Sequence

Four phases, and no fallback between them.

Each phase changes what counts as authority. No phase is entered by calendar: dates are not consensus coordinates.

Phase C0 counts classical authority only. C1 adds diagnostic post-quantum observation. C2 requires both. C3 counts post-quantum authority only. CURRENT WORK C0 classical only C1 observed, not counted C2 both required, AND C3 post-quantum only classical post-quantum observed only
An operator flag, a missing backend or a timeout can never move a signer one step to the left. C2 and C3 stay blocked until the governance paths cannot weaken their own gate.
  1. V16

    Verification in the virtual machine

    An ML-DSA-44 instruction in both engines, against pinned public vectors. A capable binary activates nothing; the gate is the configured global version.

    Implemented · activation pending
  2. A1

    Post-quantum account authority

    Executed end to end on a local chain: a tampered proof refused without consuming a nonce, a real authorization delivered, a replay refused. Both negative controls were falsified first.

    Implemented · locally validated
  3. C0

    New format, classical authority

    The format changes; the cryptography does not. This is what makes every later phase a policy decision instead of a wire rewrite.

    Library complete · integration partial
  4. C1 – C3

    Shadow, hybrid, then post-quantum only

    Each step needs a selected suite, complete 400-member operation within the profile's bounds, production-hardware cost, a multi-node rehearsal and named approvals.

    Proposed

Measured, not estimated

What it costs, with the conditions attached.

A number without its conditions is a claim about someone else's hardware.

Question Measured Condition
One post-quantum verification in the VM 50,000 gas + 1/byte Fixed protocol data. Ed25519's paid tariff is 4,000.
CPU cost against that price ratio < 1.0 Full-VM median against Ed25519 at its own tariff. A failure is a review signal, never a price change.
The new validator authentication path 32.0 ms 400-member certificate, against 31.3 ms historical. Local macOS/ARM, verification alone.
Registry storage for post-quantum keys 3.3 – 6.3 MB 400 members, five role keys each, against 485 KB today. Storage is not where this breaks.
Evidence behind the validator work 830 mutations Each must compile, then fail a named assertion. 27 of 28 library boundaries; no operational acceptance.

The hard part

Post-quantum signatures do not pack.

Verification cost turned out to be affordable. Certificate size did not. A quorum of 267 signers already exceeds the profile's frozen bound.

Ed25519 today267 × 64 B of signatures
17,088 B ML-DSA-44 certificate267-member quorum
668,078 B over ML-DSA-87 certificate267-member quorum
1,257,347 B over
Bytes, one axis. The bound was chosen when a signature was 64 bytes. One ML-DSA-87 signature is 5,017 bytes against a 4,096-byte envelope bound, so the limit is reached before a committee is even assembled.

Unsolved

What we have not solved.

A migration page that lists only progress is a marketing document.

Aggregation

Raising the bounds, compressing the quorum, or verifying an aggregate proof are three different protocols with three different costs. None is selected, and this sits earlier in the chain than choosing an algorithm.

No consensus suite selected

A registered verifier is not a selection. Stateless lattice and stateful hash-based schemes impose different operational obligations, and the choice belongs to a protocol review with published cost evidence.

Retained state

Retaining history is what keeps old sessions verifiable. Five retained quantities are bounded by policy but have no measured growth curve, and correctness tests cannot answer an operational question.

Contract-level authority

The elector and configuration contracts still verify classical signatures and sit inside the frozen production boundary, so any change must arrive as a declared insertion rather than an ordinary edit.

The wallet surface

A post-quantum account today is reachable through a funded relay and command-line tooling, not through a phone. Mobile and hardware custody for these accounts is unbuilt.

Independent review

Passing pinned public vectors in two engines across two architectures is strong implementation evidence. It is not certification, and it is not an audit. Neither has been done.

Verify

Read the source, not the summary.

Where this page and the repository disagree, the repository is correct.

Account layer The ML-DSA-44 instruction ↗ Validation and gas calibration ↗ Replaceable account authentication ↗ Authentication module, end to end ↗ Readiness, relaying and activation ↗
Validator layer Authentication inventory ↗ Frozen wire and API profile ↗ Activation and phases ↗ Implementation branch ↗ Progress and remaining work ↗
External references FIPS 204 — ML-DSA ↗ RFC 8391 — XMSS ↗ mldsa-native, the pinned backend ↗ TOS Core source ↗

What this page does not claim

  • No TOS network has activated post-quantum verification.
  • TOS consensus is Ed25519 today, including stored proofs and the elector and configuration contracts.
  • No post-quantum algorithm has been selected for consensus.
  • Public-vector success is not certification, not an audit, and not whole-chain quantum safety.
  • Local and CI measurements are not production-hardware results.
  • Wallets, mobile clients and hardware custody do not yet expose post-quantum accounts.

Every gate on this page belongs to the same delivery discipline.

See the full roadmap