I would like to see FIRO remain at the forefront of privacy and security innovation. With the advent of quantum computing, today’s encryption standards would be broken with relative ease. The implications of this is staggering. Projects like Tidecoin are utilizing a “post quantum” encryption algorithm in an attempt to mitigate this future threat. At what point should we start to consider the implementation of such algorithms? At what point would it be too late? Should FIRO start to consider the testing of post quantum algorithms?
1 Like
Hey FIDO,
Thank you for your question!
Quantum-resistant schemes are definitely on our radar.
The main concern is that while work can be done to implement ‘post quantum’ encryption schemes today there are many factors to be considered.
- Many such schemes are still experimental and there have been cases where previously thought secure quantum-resistant algorithms are shown to be insecure. While you are only POSSIBLY securing yourself against quantum computers of sufficient power which may or may not exist in the next couple of years, you could end up using an algorithm that is found to be broken today.
Here are some examples:
NIST finalist for post-quantum encryption was cracked. NIST Post-Quantum Algorithm Finalist Cracked Using a Classical PC - SecurityWeek. Similarly, the code and libraries of these algorithms have not stood the test of time.
NTRU Prime: NTRU Prime is a lattice-based cryptographic algorithm designed to be resistant to quantum attacks. In 2020, researchers Bai, Galbraith, and Li discovered an attack on NTRU Prime that was able to recover the private key in certain scenarios. This attack exploited the structure of the polynomial rings used in NTRU Prime, which led to the development of NTRU Prime variants with improved security properties. However, the attack did not completely break the security of NTRU Prime, and it remains a viable post-quantum cryptographic candidate. (Source: Reconstructing with Less: Leakage Abuse Attacks in Two-Dimensions)
SABER: SABER is another lattice-based post-quantum encryption scheme that was submitted to the NIST Post-Quantum Cryptography Standardization process. In 2020, researchers Albrecht, Bai, and Ducas showed that SABER was vulnerable to what is called a “reduction attack” that could potentially break the security of the scheme. The attack relied on a weakness in the “Learning With Errors” (LWE) problem used in SABER, but did not completely break the algorithm. The authors provided recommendations for improving the security of SABER, and it remains a promising candidate for post-quantum cryptography. (Source: WBCD: White-box Block Cipher Scheme Based on Dynamic Library)
As you can see, using post-quantum algorithms today poses risks today vs much more well established algorithms that have been battle-tested over years.
- Besides the potential security risks of using new PQ schemes, many of these schemes come with huge drawbacks in performance be it in size or time. For example, STARK proofs can be 20-100x larger than what we use.
So here we are suffering from known drawbacks of scalability and performance at the cost of only potentially protecting against PQ and also being open to potential vulnerabilities of these new schemes.
But we aren’t just twiddling our thumbs and are identifying potential areas of upgrade where quantum attacks are becoming more of a reality and what are candidates to use to replace. For e.g., we currently use Groth one out of many proofs, but there are already lattice-based versions of it which may be more PQ resistant.
I hope this answers your questions!
Note that there have been many other projects that make quantum resistance their entire selling point, but without naming them, they typically have not fared well and predictably so given the trade-offs.
3 Likes
Some post-quantum updates:
Signal messenger is now integrating the quantum resistant algorythm PQXDH in their service. Here is the article.
Monero is researching post quantum strategies.
1 Like
Yup we are tracking them closely 
This could be the indicator that modern encryption standards have been broken and quantum computers are being used to break it.
https://m.youtube.com/watch?v=HWu8cjDiNGU&pp=ygUZYml0b2luIHdhbGxldHMgZ2V0IGFjdGl2ZQ%3D%3D
# Microsoft: New Chip Means Quantum Computing Is ‘Years, Not Decades’ Away (One million qubits).
Quantum resistant encryption needs to be implemented soon.
Here are the coins with quantum-resistant encryption. These quantum-resistant cryptocurrencies are designed to withstand potential attacks from quantum computers, which could break traditional cryptographic algorithms like RSA and ECDSA used by many blockchains. Below is a concise overview of key cryptocurrencies with quantum-resistant encryption, based on current information:
-
Quantum Resistant Ledger (QRL)
- Overview: QRL is a blockchain specifically built to be quantum-resistant, using the eXtended Merkle Signature Scheme (XMSS), a hash-based digital signature scheme approved by NIST. It avoids elliptic curve cryptography, which is vulnerable to quantum attacks.
- Key Features:
- Status: Fully quantum-resistant and operational since 2018.
-
- Overview: A third-generation blockchain designed with quantum safety in mind, using post-quantum cryptographic algorithms like NIST-approved Kyber 512 and Dilithium.
- Key Features:
- Status: Actively developed, with a focus on quantum-secure applications.
-
- Overview: IOTA’s Tangle technology previously used Winternitz One-Time Signatures (W-OTS), which were considered quantum-resistant. However, after its Chrysalis update (IOTA 1.5) in 2021, it shifted away from prioritizing quantum resistance due to practical issues with W-OTS, such as address reuse vulnerabilities.
- Key Features:
- Status: Not fully quantum-resistant post-Chrysalis, but exploring future upgrades.
-
- Overview: Algorand uses Falcon, a post-quantum digital signature scheme, to sign its blockchain history every 256 blocks, securing past transactions against quantum threats.
- Key Features:
- Status: Partially quantum-resistant, with ongoing development for future-proofing.
-
- Overview: Claims to be an upgrade of Bitcoin’s algorithm, incorporating the Falcon-512 algorithm, which is NIST-selected for post-quantum security.
- Key Features:
- Transitions Bitcoin’s framework to quantum-resistant cryptography.
- Limited information on adoption and network maturity.
- Status: Emerging project, less established than QRL or Cellframe.
Additional Notes:
- Why Quantum Resistance Matters: Quantum computers, using algorithms like Shor’s, could break elliptic curve cryptography (used by Bitcoin and Ethereum) by deriving private keys from public keys. Grover’s algorithm could also weaken hash-based systems, though less severely.
- Challenges: Quantum-resistant algorithms often require more computational power, impacting scalability and transaction speed. Transitioning existing blockchains (e.g., Bitcoin, Ethereum) to quantum-safe systems may involve hard forks or social consensus, which can be contentious.
- Future Outlook: The National Institute of Standards and Technology (NIST) has standardized post-quantum algorithms like CRYSTALS-Kyber, CRYSTALS-Dilithium, and SPHINCS+ (August 2024), which are being adopted by quantum-resistant projects.
- Other Projects:
- Investment Consideration: Quantum-resistant coins like QRL and Cellframe are seen as safer long-term bets due to their proactive security measures, but their market adoption and utility remain critical factors.
Recommendations:
- For Security: QRL and Cellframe are leading in implemented quantum-resistant cryptography.
- For Monitoring: Keep an eye on Algorand and emerging projects like TideCoin for future developments.
- For Legacy Coins: Bitcoin and Ethereum may adopt quantum-safe algorithms via forks, but this is not guaranteed in the near term.
FIRO needs to be on this list!
Asking GROK how long would it take for a quantum computer with one million qubits to break the encryption currently used in Bitcoin and FIRO:
Conclusion
A 1,000,000-qubit quantum computer could theoretically break Bitcoin’s ECDSA encryption for a single exposed public key in ~1–2 seconds using Shor’s algorithm, assuming optimal conditions. However, breaking unspent addresses (protected by hashes) or the entire network would take significantly longer and is currently impractical. Bitcoin’s long-term security depends on adopting quantum-resistant cryptography before such quantum computers become reality.
Firo is not currently quantum-resistant due to its reliance on 256-bit ECC, which a 1,000,000-qubit quantum computer could break in ~1–2 seconds per exposed private key using Shor’s algorithm. However, Firo’s roadmap includes plans to explore quantum-resistant upgrades for Lelantus Spark, indicating proactive awareness. Compared to fully quantum-resistant cryptocurrencies like QRL or Cellframe, Firo is behind but could catch up through future protocol upgrades. For now, its privacy features (Lelantus, Dandelion++) remain its core strength, but quantum vulnerabilities mirror those of Bitcoin and other ECC-based blockchains.
2 Likes
# 8 Dormant Bitcoin Wallets Awaken After 14 Years on July 4th —$8.69 Billion Withdrawn
What is your take on this? Brute Force Key exploit? Quantum broke it? Someone out of jail finally can sell? Or maybe lost key by someone found finally?
1 Like
This raises the q about will it increase the blockchain size?
I know nothing about QRL, but implementing a Post Quantum design should take in mind or account for not bloating the chain.
Assuming quantum computers have not yet reached the scale required to run Shor’s algorithm against ECDSA using secp256k1—making it possible to derive private keys from public keys—wallets with exposed public keys are likely not being compromised through brute-force attacks or known exploits.
1 Like
Quantum Attack on ECDSA (Bitcoin and Firo)
Overview
Bitcoin and Firo are using ECDSA with curve secp256k1. ECDSA is considered weak against quantum processing (Boneh 2025). A Quantum Computer utilizing shor’s algorithm would be able to derive private keys from the public keys (National Academies of Sciences 2019. p.102). Therefore, wallets with public keys displayed will be vulnerable to attack.
Likely Attack Vector:
-
Identify Targets: Adversaries will look for public keys displayed on the blockchain. Looking for Bitcoin P2PKH, Firo transparent transactions, or any other reused addresses.
-
Quantum Computation: Adversaries will execute shors algorithm with the public keys to retrieve the private keys. This will take a quantum computer with at least 2500 logical qubits.
-
Steal Funds: Transfer retrieved private keys and sign the transactions to transfer the funds to the perpetrators wallet.
Coin-Specific Notes:
• Bitcoin: P2SH, P2WPKH, and Taproot reduce exposure. ~10M addresses vulnerable.
• Firo: Lelantus Spark hides public keys in private transactions, but transparent transactions are vulnerable.
Bitcoin users are at risk of getting exposed to P2SH, P2WPKH, using Taproot would reduce exposure, yet still not fully protected. Approximately 10 Million addresses are vulnerable.
Firo users are vulnerable as well. Lelantus Spark hides public keys in private transactions, but transparent transactions are vulnerable, masternodes using transparent addresses are vulnerable.
For public key and address attack vectors, users can protect themselves by using non-sequential addresses. For bitcoin users, they should take advantage of taproot. For Firo Users, they should take advantage of Lelantus Spark.
Possible Mitigation:
• Avoid address reuse.
• Bitcoin: Use Taproot.
• Firo: Use Lelantus Spark.
• Adopt theoretical quantum-resistant cryptography (e.g., Dilithium, FALCON).
SOURCES
Boneh, Dan. Quantum Computing and Shor’s Algorithm. Stanford University. Accessed July 31, 2025.
National Academies of Sciences, Engineering, and Medicine. Quantum Computing: Progress and Prospects. Washington, DC: The National Academies Press, 2019.
Please don’t use ChatGPT /LLMs to do these things.
Spark doesn’t protect against a quantum computer. Taproot also doesn’t protect against quantum adversaries.
Consider these points which encompass the most important aspects of public-key exposure.
-
Quantum attacks on ECDSA can only occur if the public key is available, as opposed to just the address hash.
-
Taproot (P2TR) and Spark delay or obfuscate the exposure of the public key until the spend.
-
These significantly lower the number of public keys that are on-chain and are brazenly attacked.
Public key exposure isn’t a trivial concern with reused P2PKH addresses, transparent Firo transactions, or masternode addresses, as they can all expose public keys indefinitely, which can be trivially target once quantum capabilities are achieved.
For the record, the phrasing of the subsequent points is as follows:
-
Taproot and Spark are not quantum-safe.
-
They significantly lower the attack surface and the time a public key is exposed.
-
They are reasonable pre-quantum or early-quantum measures, but not a conclusive answer.
Until the adoption of post-quantum signature techniques (Dilithium, FALCON), public-key exposure and address reuse will be the most effective options defensively available, but they can only do so much.
The current direction of research is to adopt a hybrid approach whereby we can do some modifications that can be done at a relatively low barrier to entry to provide some security to the chain against a PQ adversary. Think of it more as a lifeboat or bridge to secure the chain against inflation.
Of course while we do this, we are exploring full PQ secure privacy protocols which would likely require an overhaul of the entire Spark system. No privacy cryptocurrency today is ready for this as while they are theoretically possible, they come with very high trade-offs either be it in performance or size or untested cryptography that has immediate negative impacts today.
An easier way to understand this approach are the serious doomsday preppers. They spend a huge amount of time, money and effort to protect against an eventuality that they aren’t sure when it comes or the exact nature of the doomsday and often make wrong assumptions. They suffer today, for an undetermined and uncertain threat. It’s much like building and living in a bunker today and then when the shit comes, realizing you can’t sustain independent power long enough to keep your air filters working.
Better PQ schemes are still being researched and optimized especially since it’s a very active field of research so to develop a new privacy system today (that even with the current state of the art PQ schemes) would be both a huge investment of resources with uncertain benefits and still have a lot of drawbacks (be it performance, exotic crypto or otherwise). For example would you accept transaction sizes that are 20x larger for PQ security today? It would kill scalability and adoption today to protect against a PQ future which we aren’t sure when it would come.
Hence the preferred approach is to build PQ safeguards while we don’t rush into building PQ privacy protocols too early.
For the hybrid approach we are looking into Elgamal switch commitments and exploring quantum resistant public keys. Some of the research has been done for e.g. Tevador’s proposal which applies to Seraphis (which is based off our work) and can be adapted for Spark though there remains to be some Spark specific research.
2 Likes
Just an update on this. Work is being done. You can read a WIP draft here:
1 Like
Just thought I’ll drop a quick preliminary update here. Remember this is all work in progress and nothing is final.
Research Direction for a Post-Quantum Successor to Lelantus Spark
Representatives from Firo, HashCloak, and CypherStack discussed possible foundations for a post-quantum successor to Lelantus Spark. No final protocol has been selected; the immediate goal is to identify and test the most promising building block before designing the complete system.
Leading direction: BLOOM
The leading candidate is BLOOM, a lattice-based one-out-of-many proof system that can produce relatively compact ring signatures and public keys.
BLOOM does not currently provide every property required by a Spark successor. In particular, the system needs linkability: the ability to recognize repeated use of the same secret without revealing which ring member owns it. This is essential for preventing double-spending in a privacy-preserving cryptocurrency.
The central research question is therefore whether BLOOM can be extended with a secure linking tag using techniques similar to those in Calamari and Falafl. The construction appears plausible because the schemes share similar one-out-of-many proof components, but its security and compatibility still need to be established formally.
Why implementation and benchmarking are necessary
Academic results alone do not establish that a construction is practical for Firo. Compact signatures and keys may come at the cost of slow proof generation or verification, and published benchmarks may use unrealistic parameters or high-end hardware.
A first implementation should measure:
-
Signature and public-key sizes
-
Signing and proof-generation time
-
Verification time
-
Bandwidth and storage requirements
-
Scaling as the anonymity set grows
-
Performance on ordinary consumer hardware
Testing should emphasize realistic anonymity sets rather than extremely large rings that are unlikely to be used in practice. The group also identified linear growth, limited batching, and slow verification as potential concerns.
Alternatives considered
Several related constructions were discussed, including Calamari and Falafl, SMILE, MatRiCT, Lattice RingCT, PURSE, and newer work on many-time linkable ring signatures.
These provide useful techniques, but none was immediately identified as a complete replacement for Spark. Potential limitations include large signatures, linear scaling, slow computation, one-time-key restrictions, and insufficient or unclear real-world benchmarks. PURSE’s lattice-based verifiable random function may still be useful as a component, while newer many-time constructions warrant further study.
The preferred strategy is to begin with BLOOM and reuse established linkability techniques where possible, rather than designing an entirely new construction from scratch.
Migration should follow protocol design
The group agreed that a detailed migration mechanism cannot be designed responsibly until the successor protocol is better defined. Migration will need to prove ownership of funds between the existing and new systems while preventing supply inflation, theft, or accidental loss.
Generic proof systems such as STARKs could potentially support migration, but their proof sizes and performance may conflict with Firo’s design and throughput requirements. The appropriate mechanism depends on the final destination protocol.
The group was also skeptical that narrow “harvest now, decrypt later” mitigations would meaningfully protect existing on-chain data. Hybrid post-quantum measures may help at the networking layer, but they do not solve weaknesses elsewhere in the transaction system. Any interim protection should therefore be evaluated against a complete and clearly quantified threat model.
Proposed first milestone
The proposed first phase is deliberately narrow:
-
Determine whether BLOOM can be securely extended into a linkable ring-signature construction.
-
Build a practical implementation and benchmark it under realistic parameters.
-
Evaluate its suitability as the foundational privacy component of a post-quantum Spark successor.
-
Document any failure clearly and identify which implementation work can be reused for the next candidate.
-
Use the results to scope the remaining components and eventual migration strategy.
The theoretical analysis and implementation work can proceed in parallel. Much of the underlying lattice arithmetic and supporting infrastructure should remain reusable even if BLOOM proves unsuitable.
The result of this milestone should be a concrete, evidence-based decision: either BLOOM provides a viable foundation for the successor protocol, or the project moves to the next candidate with a clearer understanding of the practical constraints.
4 Likes
Also uhm…this is a rap about BLOOM.
