Achieving quantum-secure Bitcoin via SHRINCS BIP: Benefits and tradeoffs

Blockstream CEO Adam Back may have long downplayed the urgency of quantum threats, but the company he leads has taken substantial steps in responding to quantum computing-how to upgrade Bitcoin if a sufficiently powerful quantum computer emerges in the future. This progress has just reached a new milestone: a Bitcoin Improvement Proposal (BIP) for the company's experimental post-quantum signature scheme SHRINCS has been released in the project's GitHub repository.

This development is important because the elliptic curve signature system currently used in Bitcoin (used to authorize transactions) is widely considered vulnerable to future quantum computer key recovery capabilities. Although the exact timetable remains controversial, cryptographers agree that in the worst-case scenario, attackers can derive private keys from public keys and steal funds, so migration planning has become an industry priority rather than a hasty response after the fact.

Key Points

Blockstream has released SHRINCS's BIP, positioning it as a viable candidate in the post-Bitcoin quantum signature upgrade path. SHRINCS is designed to be a "bitcoin-native" solution and is smaller than many post-quantum signature alternatives that comply with NIST standards, thus better adapting to Bitcoin's block and witness data limitations. The proposal's signature approach is closer to a "stateful" design, reducing the amount of data on the chain, but introducing wallet/device recovery and interoperability risks. Blockstream's ongoing research is also exploring complementary ideas-such as shrinking signature sizes and aggregation of potential zero-knowledge proofs-while handling governance and deployment decisions separately.

From Quantum Skepticism to BIP Level Implementation

Adam Back has always been cautious about quantum timescales, having suggested in early comments that the threat may not appear for decades. However, Blockstream's work shows that even "more distant" threats are worth starting engineering now: building, testing and logging cryptographic changes before the political and technical windows close. The Blockstream research team has previously demonstrated the operation of SHRINCS as an experimental post-quantum signature scheme in a production environment on Bitcoin sidechain Liquid. The new BIP, released in the SHRINCS repository earlier today, clearly puts this experimental work into the framework of Bitcoin improvement discussions.

Blockstream researcher Jonas Nick described the BIP as the "first specific proposal" to build a post-quantum signature scheme specifically for Bitcoin needs. He also cautioned that SHRINCS is not the "final" signature design for Bitcoin, nor is it optimal in all dimensions-an important distinction for investors and developers trying to assess how close the proposal is to consensus maturity.

Why signature size is a core constraint on Bitcoin

In most post-quantum signature designs, the public parameters and signature loads are much larger than Bitcoin's current elliptic curve signatures. According to relevant comparisons, the size of the post-quantum hash-base and lattice signature schemes recognized by NIST is 38 to 123 times that of Bitcoin ECDSA and Schnorr signatures. The practical consequences are straightforward: larger signatures mean more data is carried in each transaction, reducing throughput. The same report pointed out that deploying these larger NIST style signatures directly in Bitcoin could reduce performance to less than one transaction per second.

The Ethereum post-quantum team mentioned in the article once discussed solving the block space problem by using a small zero-knowledge proof per block to aggregate signatures-if feasible, this approach could reduce on-chain occupancy. But Bitcoin will face different social and technical obstacles: Adding zero-knowledge proof aggregation will mean major changes to the system's verification logic and activation politics. Blockstream's alternative is to directly reduce the signature payload itself. The method discussed here aims to reduce the bitcoin-related signature size by approximately 13.23 times compared to NIST aligned post-hash-based quantum signatures, while maintaining sufficient compatibility with Bitcoin operational constraints to bring upgrade discussions closer to reality.

SHRINCS Goals and Their Trade-offs

The SHRINCS design was announced by Blockstream researchers in December 2025, and the opcode proposal was released in May. It is a hash-based post-quantum signature scheme designed to adapt to the reality of Bitcoin's signature size. The minimum size of this scheme is 548 bytes plus 48 bytes of public key, and the maximum size can reach 4,619 bytes. A key selling point is the way "bitcoin-native" is built: an explanatory description calls it code that truly signs real transactions on the Liquid main network and attempts to solve the post-quantum migration problem without disrupting the Bitcoin block economy. However, it is still in the early stages of research. The article quoted a warning in the BIP text: the formal security certificate is in a "to-do" state, indicating that although the cryptographic solution has a promising future, it has not yet reached the full verification level typically required for Bitcoin upgrades.

Even with improvements in SHRINCS, the scheme is still described as much larger than current Bitcoin signatures-about 9 times the Schnorr signature (64 bytes). The report also emphasized that the impact is not simply a "nine-fold increase in block size" because Bitcoin's SegWit changes the way signature bytes are calculated in block weights. The more controversial part of SHRINCS's project selection is its status management. Traditional stateless designs can store all information needed to verify and update signatures in a public structure, but typically require large signature data. The description is that SHRINCS intentionally reduces this data by using one-time keys and tracking "used keys" on the device-which means the scheme operates in a "stateful" manner.

This will have a specific impact on users. Each time a signature is used, the signature size increases by approximately 16 bytes. More importantly, if the device is lost, the recovery mechanism may require a very large transaction (approximately 5,777 bytes quoted in the article) to complete the recovery. In addition, BIP warns that different SHRINCS implementations may not be able to securely interoperate if they use incompatible stateless component settings-increasing the risk of financial loss during the key import process. This trade-off of trading smaller signatures for operational vulnerability is likely to spark more controversy in governance discussions than mere cryptographic innovation. Bitcoin's consensus rules are permanent maintenance obligations, and assumptions on the wallet side can become a pattern for user failure.

Iteration for deployment: Hardware wallet, SHRIMPS, and aggregation options

Blockstream said it continues to optimize SHRINCS in 2026 and has recently demonstrated that SHRINCS and other post-quantum signature schemes can run on common hardware wallets. This is not a trivial detail: Even well-designed cryptography solutions can fall into adoption stagnation if they cannot adapt to the performance and memory constraints of real-world wallet environments. A supporting backup/derivation concept is also mentioned in the article. In March this year, Blockstream introduced "SHRIMPS" to support signing by backup devices initialized by the same seed and align with SHRINCS signing behavior. In the BIP update described this time, the SHRIMPS name was abandoned. The scheme incorporates the same 48-byte public key as a built-in stateless path, and uses non-standard parameter set optimization, reducing the size by approximately 26%.

In addition to hash-based signatures, Blockstream's research also experimented with lattice-based signature methods, which are generally smaller but are described in the current literature as less mature and reliable than hash-based designs. The article also mentioned that Blockstream is considering zero-knowledge proof aggregation. Based on its estimates, combining zero-knowledge aggregation with SHRINCS could double the speed of Bitcoin in this simulation scenario. It is worth noting that reports say that Blockstream has separated the selection of signature schemes from more controversial issues such as block expansion and zero-knowledge aggregation. The decision reflects a pragmatic understanding that bundling multiple disruptive changes together may make reaching consensus more difficult. If Bitcoin is to migrate to post-quantum security, the path is likely to require modular governance milestones rather than a one-time comprehensive reform.

As one point quoted in the article puts it,"hard constraints" may not be cryptography per se, but governance-how Bitcoin can choose among a growing menu of engineering options (including references to other proposals such as BIP-360, BIP-361, and STARKs) to keep the upgrade window from closing. The next signal for readers is whether SHRINCS BIP can gain attention in the broader Bitcoin development and review ecosystem-especially around its stateful design risks, key recovery/rollback behavior, and wallet implementations. Interoperability guarantees. The release of the proposal is an important step from experimentation to deployment planning, but the difficult part is convincing the network to accept these tradeoffs and ensuring that the security path is complete enough to reach consensus.