Trezor is preparing for post-quantum Bitcoin security challenges as the cryptocurrency community evaluates SHRINCS, the leading candidate signature scheme that introduces complex user experience trade-offs, according to CTO Tomáš Sušánka. During a recent episode of MARA Foundation TV, Sušánka explained that SHRINCS allows users to choose between efficient stateful signatures that can expose funds to theft if reused beyond a signing budget, and larger stateless signatures that are safe to reuse. The hardware wallet manufacturer is considering making the safer stateless signatures the default option while hiding the riskier stateful alternative behind advanced settings to protect users from accidental fund loss. This preparation reflects the broader challenge facing Bitcoin custody providers as quantum computing advances threaten existing cryptographic security assumptions.
SHRINCS Introduces Stateful and Stateless Signature Options
Proposed late last year by Blockstream Research Director Jonas Nick and cryptographer Mikhail Kudinov, SHRINCS centers on a composite hash-based approach that offers users two transaction signature methods. Stateless signatures are large in size, potentially affecting transaction fees, signature speed, and other efficiency metrics, but remain safe to reuse. Stateful signatures are approximately 10 times smaller and more efficient, but come with serious security risks when reused beyond a particular signing budget.
The stateful component of SHRINCS consists of a tree of one-time signatures. If these keys are accidentally used more than once, enough cryptographic information is revealed for someone else to forge that user's signature and steal funds. This creates a critical responsibility for wallet developers to maintain meticulous tracking of the wallet's state, with numerous potential edge-case security risks.
"You're giving them an option to mess up," Sušánka said in reference to state tracking. "It's our job to make it in a secure way, right? It shouldn't be the user's job."
Trezor Plans Default Stateless Signatures to Reduce User Risk
To mitigate the security risks associated with stateful signatures, Trezor is weighing options for how to support secure user experience in a post-quantum world. The company is considering making the heavier, slower stateless signatures the default setting for all users, with the riskier stateful option accessible only through advanced settings.
Sušánka acknowledged the complexity of maintaining state across multiple devices. "For example, you can have two Trezors with the same recovery seed. How do you share the state between those two? You really don't," he said. Despite these challenges, he remains reluctant to completely dismiss stateful signatures due to their efficiency advantages.
"That being said, as it is with everything, this is about trade-offs," Sušánka continued. "The [stateful] signatures are 10 times smaller ... That makes a big difference. So, I just don't want to throw it off the table completely."
While Sušánka recognizes that SHRINCS relies on the same cryptographic assumptions as SHA-256, making it a conservative cryptographic choice, he stated he is "kind of torn on the topic because maintaining the state is a burden."
Hardware Devices Require Post-Quantum Firmware and Authentication Upgrades
Beyond Bitcoin's migration to post-quantum addresses and signatures, hardware wallet devices themselves require physical updates for full quantum protection. Most signing devices currently use quantum-vulnerable cryptography for hardware-specific security functions, including firmware and device authentication.
Users seeking to ensure their devices are secure in a post-quantum world will need to use "quantum-ready" devices that employ post-quantum cryptography for device and firmware authentication. Trezor is already shipping products like Trezor Safe 7 that support post-quantum cryptography for wallet authentication processes. Transactions made on these devices will only achieve quantum security once Bitcoin itself upgrades to post-quantum security.
Sušánka Warns Bitcoin Migration Will Take Time for Millions of Users
Sušánka warned developers not to delay providing users with migration options, as he believes the migration of potentially millions of users will require significant time. "People should be ready to make compromises," Sušánka said. "If we're all going to be very strict on what can and cannot be done, we're not going to get anywhere."
FAQ
What is SHRINCS and why is Trezor preparing for it?
SHRINCS is the leading candidate for a post-quantum signature scheme for Bitcoin, proposed late last year by Jonas Nick and Mikhail Kudinov. Trezor is preparing for SHRINCS because it introduces complex security trade-offs between efficient stateful signatures that risk fund theft if reused, and larger stateless signatures that are safe to reuse. The company is considering making stateless signatures the default to protect users.
What security risk do stateful signatures in SHRINCS pose?
Stateful signatures in SHRINCS use a tree of one-time signatures. If these keys are accidentally used more than once, enough cryptographic information is revealed for someone else to forge that user's signature and steal funds. This requires wallet developers to maintain meticulous state tracking to prevent accidental reuse beyond a signing budget.
Does Trezor hardware need upgrades for post-quantum security?
Yes. Most signing devices use quantum-vulnerable cryptography for firmware and device authentication. Trezor is already shipping products like Trezor Safe 7 that support post-quantum cryptography for wallet authentication processes, though transactions will only be quantum-secure once Bitcoin itself upgrades to post-quantum security.
