Recent quantum hardware advances, including Google’s Willow processor, have shortened the timeline for when a quantum computer might become a real threat. That matters because most blockchain wallets rely on elliptic-curve key derivation standards such as BIP32, BIP44, and SLIP-10. A quantum computer running Shor’s algorithm could recover a private key from a public key, which puts nearly every wallet in production at risk.
Moving to post-quantum signature schemes would require changing the public key format and forcing address migration on a large scale. The new research takes a different path. It keeps the existing address format unchanged and replaces the classical signing step with a non-interactive zero-knowledge proof of knowledge of the seed behind the address. That removes the need for address migration and key registration.
A proof instead of migration
The paper, written by Vincenzo Botta, Michal Pospieszalski, Emanuele Ragnoli, and Justus Ranvier, builds on earlier work by Baldimtsi et al. That work showed that in EdDSA, the seed is a valid zero-knowledge witness for the public key because of deterministic seed-to-key mapping. The new paper extends this to hierarchical deterministic wallets. Starting from BIP32-Ed25519, it replaces the classical signing step with a proof that certifies knowledge of the root seed and the full derivation chain. The authors prove EUF-CMA security for the resulting scheme.
One derivation standard for all curves
Existing schemes derive a quantum-safe witness as a side effect of curve-specific key formats. None gives a single derivation standard that works across curves. The paper introduces QBIP32, built around a keyed function called HASH768, instantiated with KMAC256. It generates the signing scalar, an explicit quantum-safe witness, and the chain code in a single call. QBIP32 works with any prime-order elliptic curve group with a fixed generator, so the same architecture works for secp256k1, Ed25519, and future curves.
Making proof cost independent of depth
There is also an efficiency problem. A monolithic proof of the whole derivation chain gets slower as the chain gets deeper. ZKPoSP, or Zero-Knowledge Proof of Seed Provenance, separates the proof into a derivation proof generated once per key pair and a signing proof generated once per message. That reduces the cost per message to a constant that does not depend on depth. The derivation proof itself can be shortened to the final step under one condition: a private value must be bound to the seed by a one-way function and cannot be recovered from the public key. Hardened keys meet this condition; non-hardened keys do not. For BIP44 routes, one hardened step plus the non-hardened suffix can be proven together, which allows safe deletion of the root seed.
Before a practical quantum machine appears, separating the proofs already keeps transaction costs constant. After Q-day, the day such a machine arrives, the leaf scalar can be moved to the public statement once networks reject all non-post-quantum signatures. That removes all elliptic-curve scalar multiplications from the proof circuit and cuts derivation proof time. The authors instantiated HASH768 with KMAC256 and implemented the work in Rust using RISC Zero as the NIZK backend. Benchmarks show signing and proving around 12 to 13 seconds, with verification near 9 to 10 milliseconds, independent of depth.
