Hassan Maishera
TL;DR
-
Sui is adding two NIST-approved post-quantum signature schemes to protect accounts and high-value assets.
-
ML-DSA-65 will support native quantum-resistant accounts, while SLH-DSA-SHA2-128s will secure vaults through Move smart contracts.
-
Users will be able to generate quantum-safe keys from their existing recovery phrases.
Sui is integrating two post-quantum signature schemes approved by the U.S. National Institute of Standards and Technology as it prepares its blockchain for future security risks posed by quantum computing.
The network will introduce ML-DSA-65 as a native signature scheme for everyday accounts. It will also support the hash-based SLH-DSA-SHA2-128s standard inside Move smart contracts for vaults holding high-value assets.
Both features will be optional, allowing users to adopt quantum-resistant security without affecting existing accounts or applications.
Quantum Computers Threaten Exposed Blockchain Keys
Most blockchain accounts rely on elliptic-curve cryptography, which is currently considered secure against conventional computers.
However, a sufficiently powerful quantum computer running Shor’s algorithm could theoretically derive private keys from publicly exposed information and forge valid transactions.
Sui argues that blockchains face a distinct risk because public keys can become permanently visible after an account completes a transaction. Attackers do not need to wait for functional quantum computers to begin preparing an attack.
Under a “harvest-now-forge-later” strategy, malicious actors could collect public keys today and store them until quantum hardware becomes capable of breaking the underlying cryptography.
This makes early adoption of quantum-resistant standards particularly important for accounts expected to remain valuable over extended periods.
Sui says its architecture was designed to support cryptographic agility, allowing the network to add new signature schemes without changing its consensus mechanism or existing blockchain state.
The feature means the post-quantum transition can be handled as a standard protocol update rather than a fundamental network rebuild.
Existing accounts, applications and assets will continue operating normally. Users who want additional protection will be able to adopt the new signature methods when they become available.
Sui compared the planned rollout with its previous introduction of zkLogin and passkeys, which were added as optional authentication methods.
ML-DSA-65 Will Protect Everyday Accounts
ML-DSA-65 will serve as the native post-quantum signature scheme for regular Sui accounts.
The algorithm corresponds to NIST’s FIPS 204 digital-signature standard and offers Level 3 security. Sui deliberately selected Level 3 instead of the less computationally demanding Level 1 option to provide a larger security margin.
The network cited a July incident in which an AI model reduced the effective key strength of another post-quantum cryptographic candidate by half.
Although that finding did not affect ML-DSA, Sui said the speed of the discovery demonstrated the importance of choosing more conservative security parameters.
For high-value assets, Sui will support SLH-DSA-SHA2-128s within smart contracts written in Move.
The algorithm corresponds to NIST’s FIPS 205 standard and derives its security from hash-based cryptography.
Keeping the signature verification process inside smart contracts gives Sui greater flexibility. The network can remain compatible with whichever post-quantum standards gain broader industry adoption without requiring another core protocol upgrade.
ML-DSA-65 and SLH-DSA-SHA2-128s also rely on different mathematical foundations. Sui said this diversification ensures that discovering a weakness in one scheme would not automatically compromise the other.
Users Can Retain Their Recovery Phrases
Sui users will not need to create new recovery phrases to adopt quantum-safe accounts.
Because account keys are generated deterministically from a seed, users will be able to derive new post-quantum keys from the recovery phrases they already hold.
Sui’s existing address-alias feature will also allow an account to replace its authorization key without transferring its assets to a different address.
Together, these capabilities could make the migration less disruptive by preserving existing account identities, balances and recovery processes.
Post-quantum security comes with technical trade-offs. The new signatures and public keys are considerably larger than the Ed25519 keys currently used by Sui. As a result, quantum-safe transactions will consume more data and potentially require additional network resources.
Sui described the increased transaction size as an unavoidable cost of adopting quantum-resistant cryptography—one that other blockchain networks and technology platforms will also face.
Sui Targets Full Rollout by Early 2027
Sui plans to deploy quantum-safe vaults on mainnet in 2026. Native accounts using ML-DSA-65 are scheduled to reach testnet by the end of 2026. Mainnet authentication for native post-quantum accounts is targeted for the first quarter of 2027.
The features will initially be additive and opt-in. Existing authentication methods will continue working, and applications do not need to make any immediate changes.
By introducing post-quantum protection before capable quantum machines emerge, Sui hopes to reduce the long-term risk facing public keys and high-value assets stored on its network.
