Key Highlights
- SHRINCS would let Bitcoin users choose between larger stateless signatures and smaller stateful signatures with strict reuse limits.
- Trezor is considering making stateless signatures the default to reduce the security risks of wallet state-management errors.
- Hardware wallets will also need post-quantum device and firmware authentication as Bitcoin moves toward quantum-resistant security.
SHRINCS Creates a Wallet State-Management Challenge
Bitcoin’s potential transition to post-quantum cryptography could introduce a significant operational challenge for wallet developers. SHRINCS, proposed late last year by Blockstream Research Director Jonas Nick and cryptographer Mikhail Kudinov, uses a composite hash-based design that allows users to make transactions with either stateful or stateless signatures.
Stateless signatures can be reused safely, but they are considerably larger and could affect transaction fees, signing speed and other efficiency measures. Stateful signatures are smaller and more efficient, yet they carry serious security risks if they are reused beyond a defined signing budget.
The stateful part of SHRINCS consists of a tree of one-time signatures. If the same keys are accidentally used more than once, enough cryptographic information could be exposed for another party to forge the user’s signature and effectively steal funds. If Bitcoin adopts SHRINCS, wallets would therefore need to maintain a highly accurate record of their cryptographic state, including handling potentially dangerous edge cases.
“You’re giving them an option to mess up,” Sušánka said during a recent episode of MARA Foundation TV, in reference to state tracking. “It’s our job to make it in a secure way, right? It shouldn’t be the user’s job.”
Elon Musk Dismisses $120 Billion Anthropic Exit Talk as SpaceX Plans $74 Billion AI Expansion
Trezor Weighs Secure Defaults for Post-Quantum Wallets
Trezor is assessing how to provide a safer user experience as post-quantum wallet technology develops. Sušánka said the company is considering setting the larger and slower stateless signatures as the default for all users, while placing the riskier stateful option behind an advanced-settings menu.
Sušánka acknowledged that SHRINCS could be viewed as a conservative cryptographic choice because it relies on the same cryptographic assumptions as SHA-256. However, he said he is “kind of torn on the topic because maintaining the state is a burden.”
“For example, you can have two Trezors with the same recovery seed. How do you share the state between those two? You really don’t,” he added.
Using stateful signatures could nevertheless provide major efficiency benefits. “That being said, as it is with everything, this is about trade-offs,” Sušánka continued. “The [stateful] signatures are 10 times smaller … That makes a big difference. So, I just don’t want to throw it off the table completely.”
Hardware Wallets Must Also Become Quantum-Ready
The transition to quantum-resistant Bitcoin security will not be limited to blockchain addresses and transaction signatures. Sušánka said hardware wallet devices themselves will need physical updates because many signing devices still use cryptography vulnerable to quantum attacks for hardware-specific functions, including firmware security and device authentication.
Users seeking protection for their devices in a post-quantum environment will need “quantum-ready” products that use post-quantum cryptography for device and firmware authentication. Trezor is already shipping products such as Trezor Safe 7 that support post-quantum cryptography for wallet authentication processes.
However, transactions created on those devices will not be quantum-secure until Bitcoin itself adopts post-quantum security. Sušánka also warned developers against delaying migration tools, arguing that moving potentially millions of users to new addresses and signatures will require substantial time.
“People should be ready to make compromises,” Sušánka said. “If we’re all going to be very strict on what can and cannot be done, we’re not going to get anywhere.”
Why This Matters
Bitcoin’s post-quantum transition will involve more than selecting a new signature scheme. The choice between stateless and stateful signatures will affect transaction size, efficiency, wallet design and the risk profile presented to users. Stateful signatures may reduce data and performance costs, but their security depends on precise state tracking that can become difficult when users operate multiple devices with the same recovery seed.
The issue also extends to hardware security. Even after Bitcoin adopts quantum-resistant transaction cryptography, devices using quantum-vulnerable methods for firmware or authentication could remain exposed. Trezor’s plans and its existing Trezor Safe 7 products highlight the need for wallet manufacturers to prepare both their software and hardware before a broad migration begins.
Frequently Asked Questions
What is SHRINCS?
SHRINCS is a proposed composite hash-based signature approach for Bitcoin that would support both reusable stateless signatures and smaller stateful signatures with strict limits on reuse.
Why are stateful signatures risky?
Stateful signatures rely on one-time signature keys. Reusing those keys can reveal enough cryptographic information for an attacker to forge a signature and potentially steal funds, making accurate wallet state tracking essential.
Are Trezor devices already quantum-secure?
Trezor Safe 7 supports post-quantum cryptography for wallet authentication processes, but transactions made on the device will only be quantum-secure after Bitcoin itself upgrades to post-quantum security.
