Post-quantum accounts

Prototype checkpoint · October 2026

MakingMultiversXquantum-proof.

Keep the address. Change the key. An interactive reading of how MultiversX is taking steps to protect its accounts from quantum computers.

Scroll to begin

Today

One Ed25519 signature guards every MultiversX account.

The ring is alice’s address. It is also her public key, a point on this curve, drawn here over the real numbers.

Tomorrow

A large quantum computer could forge it.

Shor’s algorithm works back from the address to the secret key.

Underway

Swap the key. Keep the account.

Address
Kept
Shard
Kept
Assets
Kept
Signing key
Replaced

MultiversX is building on lattice-based signatures, whose hard problems no known quantum algorithm solves efficiently. The ring stays the same.

The specimen

Meet alice.

One real account, followed to the end. Her keys were published for testing, so every Ed25519 value on this page is hers, computed live.

Address · bech32

erd1qyu5wthldzr8wx5c9ucg8kjagg0jfs53s8nr3zpz3hypefsdd8ssycr6th

Role
SDK test wallet
Path
m/44'/508'/0'/0'/0'
Shard
1

ExposureToday · Ed25519

Your address is your public key.

No hash hides it. Decode alice's address and her key falls out.

Decode

erd1qyu5wthldzr8wx5c9ucg8kjagg0jfs53s8nr3zpz3hypefsdd8ssycr6th

NetworkKey, 5 bits a characterChecksum

32 bytes · Ed25519 public keyChecksum validShard 1 · last byte e1

Recover the secret

Classical computerPollard's rho

~2126 stepsabout 2.7 trillion years at 1018 a second

Quantum computerShor's algorithm

polynomial times = 00c4c745602f2f99427991f47ca667a76feb83f812274054cc0f47b4753ce34a

No such machine exists yet. MultiversX is moving now, so no one has to guess when one will.

SeparationSpecified

Swap the key. Keep everything else.

MultiversX is making the address permanent and the signing key replaceable.

alice's address

permanent

erd1qyu5wthldzr8wx5c9ucg8kjagg0jfs53s8nr3zpz3hypefsdd8ssycr6th

Shard 1, read from the addressEGLD · ESDT · NFTs

Signs for it

state stores no digest, the address is the key

Ed25519signing
ML-DSA-44
Falcon-512
Next scheme

Ed25519 signs everything. The address itself is the key.

Same pattern as MultiversX Guardians

GuardiansAdd a co-signer. Switch on per account, after a waiting period.
This upgradeReplaces the owner's key. Switches on network-wide.

The work starts with direct transactions from accounts without guardians. Guardian, relayer and custody setups come next, with their existing requirements intact.

The windowSpecified · activation order

The old key must vouch for the new one in time.

Each new key is approved with an Ed25519 signature, and that approval only counts while Ed25519 can't be forged. That is why the work is happening now. Drag Q to see what waiting would cost.

60 accounts · alice outlined

Registration opensRegister
Activation

Activation came first.

Forged Ed25519 signatures arrive too late to move anything.

0protected
0onboarded by proof
0receive-only
0lost
  • Ed25519 only
  • Registered
  • Protected
  • Seed proof
  • Receive-only
  • Lost
  • alice

Late accounts keep receiving funds. To spend, they need a new way to prove they own the account.

The twistEd25519 · RFC 8032

Your 24 words hold a secret no quantum computer can reach.

alice's key chain

precomputed
  1. Recovery phraseownermoral volcano peasant … tiger improvehidden from attackershidden
  2. BIP-39 · PBKDF2 × 2,048
  3. Master seed64 B•••• •••• hidden•••• hidden
  4. SLIP-0010 · m/44'/508'/0'/0'/0'
  5. Account seed32 Bowner only•••• •••• hidden•••• hidden
  6. SHA-512one-way hash
  7. Signing scalar sScalar s32 Bsecret
  8. A = s × B · Edwards curve
  9. Public key = addressAddresspublic

01 · Derive

Your 24 words grow every key, one step at a time.

Computed live in this browser from the public test phrase.

02 · The hash

Between seed and key, Ed25519 puts a hash.

SHA-512, chosen for deterministic signing, long before quantum mattered.

03 · The attack

Shor's algorithm climbs from the address to the scalar.

That alone is enough to forge Ed25519 signatures.

04 · The wall

Then it hits the hash.

Grover's search only halves the exponent there. About 2125 steps.

05 · The key insight

The seed stays out of reach. Only the owner can show it.

MultiversX is building its seed proof on exactly this.

Try it

Same words, new branches. MultiversX is designing derivation so supported wallets grow post-quantum keys from this same phrase, on separate paths that track the emerging ecosystem standards.

Every wallet must agree. NIST notes FN-DSA key generation can give different keys from one seed in different implementations. So the work includes agreed paths, fixed key-generation versions and restore tests across wallets.

Why 2125? Clamping fixes 5 bits of the scalar, so about 32 different seeds lead to each key, and a search can stop at any of them.

The proofPrototyped in Rust

Prove you hold the seed. Reveal nothing.

For owners who arrive late, MultiversX is building a zero-knowledge proof. It shows that one hidden seed makes this account's key, and binds it to one exact registration.

Seed-proof registration

Owner. alice’s wallet rebuilds the seed from her words and proves, on her device, that it makes her key.

Intent the node rebuilds from the transaction

Account
erd1qyu5wthldz…ycr6th
Network
mainnet
New key
ML-DSA-44
Nonce
7

Proof π · target under 100 KB

Bound to alice's intent. The seed stays on her device.

proof bound to… = node rebuilt…
  1. π verifies for alice's key and the rebuilt intent
  2. The new key signs, proving possession

KnowledgeOnly someone who knows a valid seed can pass, and only for this registration.
PrivacyThe whole transcript, retries included, reveals nothing about the seed.
Post-quantumHash-based challenges, held to a 128-bit quantum reference that is still under review.

Used once, at onboarding. Proofs stay on chain, so their privacy has to hold for years.

The weightFIPS 204 · Falcon

Quantum safety costs bytes.

Today a transfer carries a 64-byte signature. A post-quantum transfer also carries its public key.

Authentication bytes per transaction

1 tile = 64 bytes

3,732bytes

58× today's 64

NIST category 2 · key 1,312 + signature 2,420 · leads the selection

Public keySignature

For 1,000 transfers: 3.7 MB, against 64 KB today. The account itself stores only a 32-byte digest of the key.

ML-DSA, finalized as FIPS 204, leads as the first integration candidate. Falcon is less than half the size and still under evaluation, because its signing needs careful review on every device that will run it.

The roadStatus · October 2026

The work is underway.

  • Complete seed relationBuiltPlonky3 prototype. Recomputes the account key from a private seed and binds it to a registration.
  • Alternative constructionsExploringSpartan/WHIR and VEIL, running component and synthetic workloads.
  • Size and verificationMeasuringCompact encodings and reused verification work, each change re-checked for security.
  • Security analysisIn progressConditional arguments in place. The full-application analysis is next, then independent review.

Goal

< 100 KBa complete proof

Target

msto verify on a node

Target

On deviceproving for owners
  1. Now
    Specs drafted, prototypes runningThe October 2026 checkpoint. Legacy keystore support is being assessed in parallel.
  2. 1
    Devnet: account authorizationRegister, activate, replace keys.
  3. 2
    Devnet: a post-quantum signatureML-DSA is the first candidate.
  4. 3
    Devnet: the seed-proof routeAfter security and feasibility review.
  5. 4
    Independent review and device testsWallet recovery and migration guidance in parallel.
  6. !
    The gate
    “Production activation requires a reviewed, usable seed-proof route or an explicitly revised onboarding policy.”The draft, section 6
  7. 5
    Production activationEd25519 stops authorizing spending, everywhere at once.
Separate tracksValidator consensusRandomnessBridgesApp signature checksProof aggregation, later

Your moveToday

What it asks of you.

Accounts work as they do today until activation. Here is what you can do now.

Keep your 24 words safe, and any passphrase.

MultiversX is designing supported wallets to grow your new keys from them. When registration opens, your current key approves the new one, and your address stays the same.

The address you hold today is meant to be the address you keep.

erd1qyu5…ycr6thkept