Blockstream's SHRINCS Shrinks Bitcoin's Post-Quantum Backup Signature

Every Bitcoin transaction is authorized by a digital signature built on elliptic-curve cryptography — the same category of math that secures most of the internet. That math has one theoretical weakness: a sufficiently powerful quantum computer could recover a private key from an exposed public key, then spend the coins it controls. No machine capable of that exists today, and nobody knows if or when one will. But migrating an entire monetary network to new cryptography is a multi-year undertaking, which is why researchers are building and testing replacements now rather than waiting for a working quantum computer to force the issue.

SHRINCS, proposed by Blockstream Research, is one candidate for that replacement. Its full name matters less than what it does: it's a hash-based signature scheme, meaning its security rests entirely on properties of the SHA-256 hash function — the same function bitcoin already relies on for mining and addresses — rather than on elliptic curves that a quantum computer could theoretically break.

SHRINCS gives each key two ways to sign. The everyday path is compact and fast, starting around 324 bytes and growing by about 16 bytes with each additional signature the same key produces — small by post-quantum standards, but the tradeoff is that this path needs the signer to keep track of internal state, similar to remembering which page of a one-time-use signature book you're on. The second path is a stateless fallback that works even if that internal state is ever lost, at the cost of a much larger signature.

That fallback is built on the same design as SPHINCS+, a hash-based scheme the U.S. National Institute of Standards and Technology (NIST) has already standardized as SLH-DSA. Blockstream's contribution wasn't a new cryptographic primitive — it was a more efficient way to configure the existing one for bitcoin's specific constraints: transaction bytes are expensive block space, every signature has to be checked by every node on the network, and keys often need to be generated on resource-constrained hardware wallets.

A SPHINCS+-style signature is built from layers of Merkle trees, and five parameters control the shape of that structure: how tall the tree is, how many layers it has, how many smaller "few-time" trees sit at the bottom, and a couple of settings that trade signature size against the computational cost of generating and verifying it. Every combination of those parameters is a different tradeoff between signature size, key generation speed, signing speed, and verification cost.

Blockstream tested 25,935 combinations, narrowed to 9,182 that met bitcoin's practical requirements (128-bit security, a large enough signature budget, and a size smaller than the existing standard), then ranked the survivors by how close they came to an ideal balance of all five metrics. The result: a candidate about 5.7 kilobytes — roughly 25% smaller than the current 7,856-byte NIST-standard signature — while also being cheaper to generate and verify, and a second option that trims a bit more size at a higher signing cost. Blockstream also released an open-source explorer so other researchers can run the same search with their own priorities and check the results themselves.

WHY IT MATTERS

Even after this optimization, hash-based signatures remain far larger than bitcoin's current 64-byte Schnorr signatures — the stateful path starts at 5x bigger, and the stateless fallback is roughly 90x bigger. That gap is exactly why post-quantum signatures aren't being deployed today: any future upgrade has to weigh real security benefits against real costs to block space and node performance. Work like this doesn't solve that tradeoff, but it makes the eventual upgrade less costly whenever the network decides it's needed.

SOURCES & DATA

Blockstream Research — SHRINCS parameter sweep and explorer ↗ Delving Bitcoin — SHRINCS proposal thread ↗ Blockstream — Quantum computing and Bitcoin ↗

Education, not financial advice. See our editorial process and corrections policy.

TERMS IN THIS STORY

Post-Quantum Cryptography Proof of Work

Derek Chu