Sui Bakes In Post-Quantum Keys, Skips Forced Migration for Existing Wallets
Sui adds NIST-approved ML-DSA-65 and SLH-DSA signature schemes, letting accounts rotate to quantum-safe keys without moving funds or addresses.
Sui has begun integrating two NIST-standardized post-quantum signature schemes directly into its protocol and smart-contract layer, the network said on August 6. The move targets a specific structural weakness in blockchain cryptography: unlike a bank key that stays hidden until a breach, an onchain public key is exposed the moment an account first transacts, giving any future quantum attacker a permanent, harvestable target.
The two algorithms are ML-DSA-65 (FIPS 204), which becomes a native signature scheme for everyday account transactions, and SLH-DSA-SHA2-128s (FIPS 205), a hash-based scheme handled inside Move smart contracts to protect high-value vaults. Both are part of the NIST post-quantum standard set and align with the joint CISA/NSA/NIST quantum-readiness roadmap.
Why the threat model is different onchain
Shor’s algorithm, once run on sufficiently powerful quantum hardware, breaks the elliptic-curve cryptography underpinning most blockchain accounts today — the same math securing much of the banking system and general internet traffic. Because public keys are published onchain indefinitely, “harvest-now, forge-later” collection of exposed keys doesn’t require quantum hardware today, only patience.
Sui’s announcement cites a March 2026 estimate from Google Quantum AI suggesting a fault-tolerant machine with under half a million physical qubits could recover a private key from an exposed public key in minutes. That timeline is the underlying justification for moving now rather than waiting for a mature quantum-computing market.
Level 3, not Level 1 — and a live cautionary tale
Sui opted for the stronger NIST Level 3 security tier for ML-DSA-65 rather than the cheaper Level 1 variant. The decision follows a July 2026 incident in which an AI model reportedly halved the effective key strength of HAWK, a rival post-quantum signature candidate, in roughly 60 hours — after two years of expert human cryptanalysis had failed to find the same weakness.
Sui isn’t alone in converging on ML-DSA-65: AWS KMS now offers ML-DSA signing through its hardware-backed key service, and Android 17’s Keystore generates quantum-safe signatures in secure hardware starting at the same parameter set, bypassing the lighter Level 1 tier entirely.
No forced migration, but bigger transactions
Existing Sui wallets aren’t required to move funds to adopt the new keys. An ML-DSA-65 private key is a 32-byte seed — the same size wallets already store — derived from the same recovery phrase through a new derivation path, so backup and restore flows stay unchanged. Address aliases, already live on Sui, let an account swap its authorization key for a post-quantum one while keeping its existing address and assets untouched.
The trade-off is size: post-quantum signatures and public keys are substantially larger than the Ed25519 pairs currently used, pushing up transaction footprint. Sui says verification cost on the network stays close to Ed25519 levels, limiting the impact on per-signature throughput even as payload size rises. Keeping the hash-based SLH-DSA scheme inside Move contracts, rather than in the protocol core, also preserves flexibility for Sui’s cross-chain bridges as the wider industry’s post-quantum standards continue to evolve.
Read more: Chainlink Becomes Sole Cross-Chain Rail for BitGo’s $7.3B WBTC Book