Why the Path to Quantum Resistance Runs Uphill for Bitcoin Wallet Makers

Bitcoin custody has always involved some degree of risk, but wallet manufacturers like Trezor—which build physical devices designed to keep a user’s private keys secure offline—are preparing for a post-quantum world where new challenges arise.

That’s because SHRINCS, the community’s leading candidate for a post-quantum signature scheme, allows users to make transactions using stateful signatures that require rigid state tracking to prevent funds from being stolen, according to Trezor CTO Tomáš Sušánka.

Proposed late last year by Blockstream Research Director Jonas Nick and cryptographer Mikhail Kudinov, SHRINCS centers on a composite hash-based approach: users can make transactions using either stateful signatures or stateless signatures.

Stateless signatures are quite large—potentially affecting fees, signature speed, and other efficiency metrics—but are safe to reuse, while smaller, more efficient stateful signatures come with serious security risks when reused beyond a particular signing budget.

The stateful component of SHRINCS is made up of a tree of one-time signatures, and if these keys are accidentally used more than once, enough cryptographic information is revealed for someone else to forge that user’s signature and effectively steal funds.

If Bitcoin successfully adopts SHRINCS, maintaining a meticulous count of the wallet’s state will become a critical responsibility for wallet developers—with lots of potential edge-case security risks.

“You’re giving them an option to mess up,” Sušánka said during a recent episode of MARA Foundation TV, in reference to state tracking. “It’s our job to make it in a secure way, right? It shouldn't be the user’s job.”

To mitigate this risk, Trezor is weighing options for how to support secure UX in a post-quantum world. For instance, Sušánka said the company is considering making the heavier, slower stateless signatures the default setting for all users, tucking the riskier stateful option behind an advanced settings wall.

While Sušánka recognizes that SHRINCS may be the conservative cryptographic choice because it relies on the same cryptographic assumptions as SHA-256, he is “kind of torn on the topic because maintaining the state is a burden.”

“For example, you can have two Trezors with the same recovery seed. How do you share the state between those two? You really don’t,” he added.

“That being said, as it is with everything, this is about trade-offs,” Sušánka continued. “The [stateful] signatures are 10 times smaller ... That makes a big difference. So, I just don't want to throw it off the table completely.”

Sušánka went on to share that while many are focused on Bitcoin’s migration path to post-quantum addresses and signatures, hardware wallet devices will also need to be physically updated for full quantum protection. Most signing devices use quantum-vulnerable cryptography for hardware-specific security functions, like firmware and device authentication.

If users want to ensure their devices are secure in a post-quantum world, they will need to use “quantum-ready” devices—that is, devices that use post-quantum cryptography for device and firmware authentication as well.

In anticipation of these needs, the company is already shipping products like Trezor Safe 7 that support post-quantum cryptography for wallet authentication processes. Of course, transactions made on these devices will only be quantum-secure once Bitcoin itself upgrades to post-quantum security.

That said, Sušánka warned developers not to wait too long to give users migration options, as he believes the migration of potentially millions of users will take time.

“People should be ready to make compromises,” Sušánka said. “If we’re all going to be very strict on what can and cannot be done, we’re not going to get anywhere.”