Hi DFINITY cryptography team and community,
I would like to better understand ICP’s concrete post-quantum migration strategy.
As I understand it, threshold BLS is deeply embedded in the protocol and is used for at least:
- subnet signatures involved in consensus and finality;
- certified state and query-response certificates;
- authentication of cross-subnet (XNet) messages;
- the random beacon / random tape and verifiable randomness;
- the chain-key trust hierarchy that allows clients to verify subnet responses through the Internet Computer root key.
BLS12-381 is based on pairing-friendly elliptic curves and the discrete logarithm problem. A sufficiently powerful fault-tolerant quantum computer running Shor’s algorithm would break this assumption. Threshold secret sharing and periodic resharing protect against node compromise, but they do not appear to protect against an attacker deriving a private key directly from a public key.
I found Jan Camenisch’s December 2024 response explaining that ICP was designed with crypto agility, that DFINITY is monitoring the situation, that replacement algorithms would be proposed to the NNS at the appropriate time, and that the Internet Computer’s public key would need to change:
That is reassuring at the architectural level, but I would appreciate more detail about the technical and operational plan:
- Is there any public research or candidate design for a post-quantum threshold signature scheme that could replace BLS while preserving the properties ICP depends on, such as non-interactive share combination, unique signatures, compact certificates, and low verification latency?
- How could the BLS-based random beacon / VRF be replaced while preserving unpredictability and unbiasability?
- Would the migration use a hybrid or dual-signature period in which classical BLS and a post-quantum scheme coexist?
- How would ICP rotate the root and subnet public keys without a hard fork, loss of canister state, or a gap in certificate verifiability?
- How would agents, HTTP gateways, wallets, boundary infrastructure, and other clients transition their trust anchors and verification code? Would old certificates remain verifiable?
- Are there defined milestones or objective triggers for beginning this migration, even if there is no fixed date yet?
- Is the post-quantum scope expected to include threshold ECDSA, threshold Schnorr, Ed25519, and Chain Fusion as well? I understand that external networks such as Bitcoin and Ethereum would also need to adopt post-quantum transaction authentication before ICP could produce quantum-resistant signatures for those networks.
I am not suggesting that a cryptographically relevant quantum computer exists today. My concern is whether the migration path is being designed and tested early enough, given how many protocol layers depend on BLS and how many independent clients would need to update.
Any pointers to current research, design documents, roadmap items, or implementation work would be greatly appreciated. Thank you.