Blockstream researchers on Thursday published a draft specification for SHRINCS, a post-quantum signature scheme built specifically for Bitcoin. The design aims to withstand a quantum computer without sharply cutting the number of transactions that can fit inside a block, a trade-off that has complicated many post-quantum migration plans across crypto.
That block-space cost sits at the center of the proposal. Rather than only targeting post-quantum security, the draft focuses on doing so while keeping transaction throughput from collapsing.
Built on SHA-256 with a stateful path and a stateless fallback
SHRINCS, short for Shrunken SPHINCS, is built on SHA-256, the hash function already embedded in Bitcoin’s consensus rules and mining system.
The scheme combines a compact stateful signing path with a stateless fallback for cases where a wallet loses track of its signing state.
- The public key is 48 bytes.
- The smallest stateful signature is 548 bytes.
- The signature grows by roughly 16 bytes each time the key is reused.
- The stateless fallback is 5,776 bytes.
Each SHRINCS signature spends a one-time key. That means a wallet has to remember which keys have already been used and must never repeat one, across phones, hardware devices, and restored backups.
How Blockstream frames the throughput trade-off
In May, Blockstream estimated that Bitcoin could handle about 6.5 transactions per second if every transaction used Schnorr signatures. Under SLH-DSA, the hash-based scheme standardized by the National Institute of Standards and Technology, that figure would fall to roughly 0.36.
SHRINCS, according to Blockstream, recovers performance to close to three transactions per second.
The draft includes compatibility and fund-loss warnings
The specification warns that keys generated using hypertree pruning are incompatible with implementations that do not support it. Importing across those two implementation types may result in loss of funds.
The formal security proof is still listed as pending. The reference software is unaudited and is not intended for production use.
Described as a concrete Bitcoin proposal, not the final answer
Nick described SHRINCS as “the first concrete” post-quantum signature proposal designed for Bitcoin, while also saying it is not intended to be the network’s final scheme.
Blockstream demonstrated SHRINCS-signed transactions in March on Liquid, the sidechain it operates.
Debate over Bitcoin migration paths continues
Bitcoin developers have spent the past year split over migration paths. The discussion has ranged from BIP-361’s proposed five-year freeze deadline to wallet-based protections that do not touch the base layer. At the same time, research has pulled Q-Day closer.
On Wednesday, Ethereum researchers proposed a first step focused on validator deposit keys.
Any move to bring SHRINCS to Bitcoin would require a soft fork, along with enough support across the network to activate it.