Post-Quantum Cryptography
TL;DR
Valdium uses ML-DSA-65 (Dilithium3), a NIST-standardized post-quantum digital signature scheme, for all transaction and consensus signatures. Every signature ever written to the chain is quantum-safe from genesis. There is no migration period, no legacy classical signatures, and no planned cryptographic upgrade for the foreseeable future.
Why post-quantum matters
The threat
Modern blockchains rely on elliptic curve digital signatures — ECDSA, EdDSA, BLS. The security of all of these schemes depends on a single mathematical problem: the discrete logarithm problem in elliptic curve groups.
In 1994, Peter Shor proved that a sufficiently large quantum computer can solve the discrete logarithm problem in polynomial time. A quantum computer running Shor's algorithm doesn't weaken ECDSA — it breaks it completely. Every blockchain account whose public key is publicly visible becomes vulnerable.
Harvest now, decrypt later
Every signature ever written to a blockchain is publicly recorded forever. An adversary can copy the entire chain history today and wait for quantum hardware to mature. The day a sufficiently large quantum computer exists, every classical signature becomes a potential attack vector — retroactively. Funds can be stolen from dormant accounts. The integrity of the chain's history is broken, not just its future.
Valdium's position: the cost of building PQC in from day one is small. The cost of retrofitting it later — or being wrong about the timeline — is enormous.
What we picked: ML-DSA-65 (Dilithium3)
In August 2024, NIST published FIPS 204, standardizing the Module-Lattice-Based Digital Signature Algorithm (ML-DSA), derived from CRYSTALS-Dilithium. We use ML-DSA-65 — NIST security level 3, roughly equivalent to AES-192.
| Variant | NIST Level | Sig size | Public key |
|---|---|---|---|
| ML-DSA-44 (Dilithium2) | Level 2 | ~2.4 KB | ~1.3 KB |
| ML-DSA-65 (Dilithium3) ← | Level 3 | ~3.3 KB | ~1.9 KB |
| ML-DSA-87 (Dilithium5) | Level 5 | ~4.6 KB | ~2.6 KB |
Dilithium is a lattice-based signature scheme. Instead of relying on the discrete logarithm problem, it relies on the hardness of Module Learning With Errors (MLWE) and Module Short Integer Solution (MSIS) on high-dimensional lattices — both believed hard for quantum computers.
Alternatives we rejected
Falcon-512 — signatures are ~666 bytes (5× smaller than Dilithium3), but signing requires constant-time floating-point arithmetic that is extremely difficult to implement correctly and deterministically across platforms. Not worth the implementation risk for a JS-first chain.
SLH-DSA (SPHINCS+) — purely hash-based, the most conservative option. But signatures are 8–17 KB. With a 100-validator committee, that's ~1 MB of signatures per finalized block. Too expensive.
Hybrid schemes — we commit to PQC-only from genesis. Hybrid doubles signature size and complexity for marginal benefit.
What it costs us
| Resource | ECDSA | Dilithium3 | Ratio |
|---|---|---|---|
| Signature size | 64 bytes | ~3,300 bytes | ~52× |
| Public key size | 32 bytes | ~1,900 bytes | ~59× |
| Signing time (Pi 4) | ~0.1 ms | ~5 ms | ~50× |
| Verification time (Pi 4) | ~0.3 ms | ~1.5 ms | ~5× ✓ |
Mitigation: bounded ~100-validator committee (~330 KB sigs/block), public-key reuse optimization (repeat-sender txs skip re-including the 1.9 KB pubkey), and verification-first design (validators verify far more than they sign, and verification is only 5× slower).
How we use it
Addresses are derived as BLAKE3(pubkey)[0:20] — 20-byte hex with EIP-55-style checksum. Familiar wallet UX, post-quantum key material underneath. Each signed transaction carries the Dilithium3 pubkey (~1.9 KB) and signature (~3.3 KB). Validators sign consensus messages with their Dilithium3 keys; ~100 sigs accumulate per finalized block (~330 KB total).
Implementation
Reference library: PQClean — the canonical C implementation of NIST PQ standards, Dilithium3 variant. WASM bindings compiled with Emscripten. The exact PQClean commit hash is part of the Valdium protocol spec; bumping it requires a hard fork. All PQ operations are integer-only and deterministic across all supported platforms, verified by cross-platform test vectors in CI.