Hardware wallet and branching hash lattice illustrating the Bitcoin SHRINCS post-quantum signature draft

Bitcoin Gets Its First Concrete Post-Quantum Signature Draft—and SHRINCS Comes With a Catch

By Isaac • August 26, 2026 11:08 pm • Comments

Bitcoin now has its first concrete draft for a post-quantum signature system built specifically around the network’s constraints. The proposal is called SHRINCS, and its biggest achievement may be that it turns a distant security debate into exact algorithms that developers can inspect, test and challenge.

SHRINCS remains a draft rather than a finished Bitcoin upgrade. It tries to make hash-based signatures practical enough for Bitcoin by combining two very different signing paths.

One path is compact but stateful, meaning a wallet has to remember which one-time signing keys it has already used. The other is stateless and safer to recover, but it produces much larger signatures.

Trending: Solana Supply Vote Could Cut $1.5 Billion in Issuance and Send SOL Burns Soaring

That tradeoff is the real story.

The new SHRINCS draft specification describes a hash-based signature scheme for Bitcoin transaction authorization. It uses SHA-256—the same hash function already deeply embedded in Bitcoin—and targets NIST security category 1, which the authors describe as roughly 128 bits of classical security and 64 bits of quantum security.

The draft’s public key is 48 bytes. Its compact stateful signatures range from 548 bytes to 4,619 bytes, depending on the key structure and use.

The stateless fallback is fixed at 5,777 bytes. Those figures are dramatically larger than today’s 64-byte Schnorr signatures, but the authors are addressing the possibility that a sufficiently capable quantum computer could eventually threaten the elliptic-curve assumptions behind Bitcoin’s current signatures.

Jonas Nick, one of the proposal’s authors, said the draft converts earlier research into exact algorithms backed by an executable reference implementation.

The compact path uses a flexible form of XMSS, a hash-based system built from one-time signatures arranged in a Merkle tree. That can keep signatures relatively small, but every signing device must prevent the same state counter from being reused.

If a wallet signs twice with the same one-time key, the draft warns that an observer may be able to forge signatures.

That requirement is manageable on one carefully controlled device. It becomes harder when the same wallet seed is restored, cloned across devices or used in a multisignature setup.

A lost or uncertain counter cannot simply be guessed. Under the proposal, the wallet would have to refuse the compact path and use the stateless fallback instead.

The fallback is what preserves recoverability. It lets a holder reconstruct a wallet from a seed without trusting that the old state survived.

The price is block space: a 5,777-byte signature is roughly ninety times the size of a current Schnorr signature before any possible witness discount.

Cointelegraph reports that the proposal grew from earlier Blockstream Research work into a full algorithmic draft and reference implementation. Its account focuses on the central wallet tradeoff: compact stateful signatures can make normal use more practical, while the stateless fallback protects recovery at a much higher block-space cost.

The report also puts the publication in the correct procedural context. The draft gives Bitcoin developers a concrete design to review, benchmark and attack, but it has no assigned BIP number and does not represent network adoption or consensus.

That distinction keeps the near-term significance grounded. Wallet teams can now test key generation, signing, verification and recovery behavior against explicit parameters, while protocol reviewers can examine whether the state rules and signature costs are acceptable for Bitcoin.

One practical question is whether existing signing devices can handle hash-based cryptography at all. Recent work from Blockstream Research suggests that computation may be less prohibitive than feared.

Blockstream said four popular hardware devices were able to sign with tested hash-based schemes. The standardized SLH-DSA route took about two minutes in the slowest case.

The research matters because it shifts one part of the debate from assumption to measurement. Existing devices may be able to perform the necessary hashing, even if wallet software, secure recovery and safe state coordination remain much harder problems for production systems.

That result leaves major engineering questions open. Signing speed, battery use, secure state storage, recovery behavior, wallet coordination and on-chain cost all matter.

The draft says its implementation is for demonstration and testing, not production. It also notes that a full security proof and comprehensive test vectors remain unfinished.

SHRINCS currently has no assigned BIP number, no activation proposal and no claim of network consensus. Bitcoin Improvement Proposals can formalize an idea for review, but publication alone does not mean Bitcoin Core developers, miners, node operators, exchanges or users have accepted it.

The proposal moves the discussion forward in an important way. Bitcoin’s quantum risk has often been framed as a binary choice between doing nothing and rushing into a disruptive migration.

SHRINCS offers a concrete third step: define a Bitcoin-specific design, expose its compromises and let researchers attack the details long before the threat becomes urgent.

The draft does not pretend post-quantum protection is simple. It shows exactly where the costs land—in larger signatures, slower recovery and far more demanding wallet state.

That candor gives the Bitcoin community something real to evaluate.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.

 

Search ProCoinNews