Blockstream releases post-SHRINCS quantum signature proposal for Bitcoin

Blockstream releases SHRINCS post-quantum signature scheme to pave the way for Bitcoin quantum security

Blockstream, a leading Bitcoin infrastructure company, has officially put its post-quantum signature scheme called SHRINCS on the agenda by releasing a new Bitcoin Improvement Proposal (BIP), further promoting discussions on Bitcoin's quantum-resistant capabilities. Although the company's CEO Adam Back believes that practical quantum attacks may not materialize for decades, the move highlights Blockstream's active role in preparing the network for potential threats to future quantum computers.

SHRINCS： A new approach to anti-quantum signatures

Blockstream's SHRINCS (full name of State Hardenized Random Incredible Chain Signature) aims to address concerns that quantum computing may eventually crack current cryptographic schemes and threaten Bitcoin security. The company tested SHRINCS in a production environment for Liquid sidechains in March this year, and researchers Jonas Nick and Mikhail Kudinov officially proposed the opcode in May.

Jonas Nick described SHRINCS as "the first concrete proposal for a post-quantum signature scheme specifically designed for Bitcoin." But he also cautioned that this is not the ultimate signature solution, but a strong candidate among the currently available options. Jonas Nick of Blockstream Research believes that while SHRINCS is not optimal in all respects,"it's a very good trade-off among the options we have now."

Marin Ivezic, founder of Applied Quantum and an authority on post-quantum cryptography, commented that SHRINCS is "the most bitcoin-native post-quantum signature design proposed by everyone so far." He pointed out that SHRINCS is compatible with BIP-39 seed recovery and relies on SHA-256, an indispensable hash function in Bitcoin mining.

However, Ivezic also admitted that SHRINCS is still in its early stages. Although it has shown experimental results, it has not yet undergone a comprehensive cryptographic audit or been subject to extensive public review like the National Institute of Standards and Technology's signature scheme.

Efficiency, implementation and technical trade-offs

The SHRINCS signature size is much smaller than most post-quantum signature schemes, starting at 548 bytes, plus a 48-byte public key, but still about 9 times the size of Bitcoin's current Schnorr signature (64 bytes) or ECDSA signature (70 bytes). In comparison, the post-quantum signature scheme recognized by NIST may be as large as 123 times. Efficient signature sizes are critical to maintaining Bitcoin's network throughput and decentralization.

An increase in signature size may significantly reduce transaction throughput. With NIST's trellis cipher-based ML-DSA scheme, throughput may drop to 0.5 transactions per second (TPS), while the SPHINCS+ scheme only supports 0.36 TPS. In contrast, researchers estimate that if SHRINCS is widely implemented, Bitcoin can still achieve approximately 3 TPS, close to current transaction rates.

Comparison of signature schemes: The Schnorr signature size is 64 bytes, with an estimated TPS of 6.5; the ML-DSA (NIST Lattice Based) signature size is approximately 123 times larger than the current scheme, with an estimated TPS of 0.5; the SPHINCS+(NIST Hash-Based) signature size is approximately 123 times larger than the current scheme, with an estimated TPS of 0.36; the SHRINCS signature size ranges from 548 to 4619 bytes, with an estimated TPS of 3.

The design of SHRINCS also leverages Bitcoin's SegWit, a technology that allows signature data to be allocated to separate areas, taking up less block space, further alleviating the impact of increasing signature size.

SHRINCS differs from SPHINCS+ in that it uses a stateful approach, which stores used keys locally, rather than including multiple layers of hash trees to remain stateless. Each time the key is used, the generated signature increases by 16 bytes. However, if the device is lost, the spare stateless transaction used for key recovery may reach 5777 bytes.

BOLTS Technologies founder Yoon Auh pointed out that SHRINCS contains "statelessness, compact signature paths, alternative schemes, assumptions about the number of seed initializations, and rules for when a device must switch to a larger stateless signature." Marin Ivezic emphasized: "The constraining factor in Bitcoin's quantum migration is not cryptography, but governance issues." He pointed out the challenge of gaining community consensus for any quantum upgrade.

Other research directions and future prospects

Blockstream is also experimenting with lattice cipher-based signature schemes, which some researchers believe are less reliable, and exploring the possibility of using zero-knowledge proof (ZK) to aggregate signatures. With ZK proof aggregation, if used in conjunction with SHRINCS, Bitcoin throughput could reach 6.7 transactions per second. However, introducing ZK proof would be a fundamental protocol change that is likely to spark extensive community discussions before activation.

The latest BIP is only the first step, and formal security certification for SHRINCS still needs to be completed. Its ultimate adoption depends not only on technical performance, but also on whether the Bitcoin community can reach a consensus on security upgrades.

Blockstream's ongoing research includes continuing optimization of the SHRINCS protocol and support on its mainstream hardware wallet. In March, the company also released SHRIMPS, which is designed to work with SHRINCS to achieve device backup and signature flexibility, but has since integrated it into a stateless path under the same public key.

In Bitcoin, any upgrades related to quantum security are likely to spark heated discussions because they touch the heart of network design and operation. Researchers caution that the challenge lies not only in cryptography, but also at the political level, as any upgrade requires broad support and prudent governance.