Hash-based signatures on hardware wallets are feasible: @blksresearch benchmarks show that SHRINCS & SLH-DSA take less than 2 minutes. Future wallets could be optimized & faster. Code is open-source. Thanks to @BlockstreamJade @Ledger @satoshilabs @BitBoxSwiss for the help!

LLMs are used very successfully to find vulnerabilities in Bitcoin software. Can they also help prove the security of a modern cryptographic library for Bitcoin? To explore this question, @remix7531 and I are publishing libshrincs. libshrincs is a handwritten C library implementing WOTS+C, the one-time signature used by SHRINCS. It is a proof of concept and should not be used in production. Its machine-checked proofs connect the C implementation to an unforgeability theorem. The current theorem does not yet give a full post-quantum security bound. The post and review tutorial describe its current limits. Code and proofs: Review tutorial for the security proof (no Rocq or SSProve background required): @remix7531 has written three excellent posts on the library and verification work: Towards libshrincs The grind was the only detector Choosing a verification toolchain

Thank you to my co-maintainers, all contributors, and everyone who provided feedback over the years. It was an honor to serve in this role, and I greatly enjoyed it. secp256k1 has a strong group of people reviewing and contributing code. I’m glad to see it in good hands.

A written version of my recent @OPNEXT2026 talk, with extra details and references. It covers SHRINCS/SHRIMPS, the design space of post-quantum signatures for Bitcoin (especially hash-based ones), and a toy proposal for OP_CHECKSPHINCS.

Today we announce: AADP WE Open Challenges. Recently we proposed a new witness encryption scheme based on Arithmetic Affine Determinant Programs which we intend to use in Bitcoin PIPEs v2, unlocking a wide range of applications and eliminating the need for trusted parties. Now we invite anyone to break small instances of our new scheme or to discover structural properties that were unknown before. Details here: Special thanks to @zeroknowledgefm @zkproof @IACReurocrypt for organizing the conference week in Rome that we're announcing these at in person.

BITCOIN RAILS #59#: Post-Quantum Bitcoin Signatures (+ their tradeoffs) | with BIP 360 co-author @Ethan_Heilman and @Blockstream Head of Research @n1ckler 🔗 YOUTUBE: 🌿 SPOTIFY: According to BIP 360 co-author Ethan Heilman, Bitcoin needs a minimum of two soft forks to become quantum resistant: P2MR (or an output type that can safely execute PQ signatures) + a post-quantum checksig (signature scheme). Ethan and the BIP 360 team (including myself and @cryptoquick) introduced the P2MR part via a BIP 360 update late last year—but the question remains, what’s the most appropriate PQ signature scheme for Bitcoin? They all have substantive tradeoffs, but hash-based signatures seem to be leading technical discourse—likely due to recent optimizations by @n1ckler and the broader @Blockstream research team. It was an honor to sit down with both of these men - arguably the two most influential and productive cryptographers in Bitcoin quantum mitigation right now - for an in-depth review of the leading PQ signature schemes and a temperature check on Bitcoin’s post-quantum planning process. TBH, if you want to skip the noise and jump straight to the signal on quantum, this is the interview to watch. In this episode, we discuss: - What needs to happen at the soft fork, infra, and mitigation levels to fully quantum-harden Bitcoin - Recent updates to BIP 360 + breakdown of the leading hash-based signatures schemes for Bitcoin (SHRINCS + SHRIMPS) - Why we may actually get consensus around a stateful scheme for Bitcoin - Comparisons of hash-based signatures vs Lattice and Isogeny-based schemes - Assessing the risks of both waiting too long and acting too fast (and why quantum is a better threat to be facing than a potential classical attack) This episode of Bitcoin Rails is brought to you by my NEW sponsors: - LayerTwo Labs @LayerTwoLabs — developing research, software, and technologies for scaling Bitcoin via the integration of Drivechains (BIP 300/301) - Hashi on @SuiNetwork — a primitive for executing Bitcoin Defi transactions, without having to trust a federated bridge or other centralized entity - BitBox @BitBoxSwiss — an open-source Bitcoin-only hardware wallet, with smooth UX and no compromises on security. Check out Bitbox [dot] swiss and use code BITCOINRAILS to get a discount TIMESTAMPS: 00:00 Intro 02:18 Ethan’s Quantum Wakeup 05:18 How Blockstream Enters Post Quantum 09:25 BIP 360 Explained 12:11 How Bitcoin Transitions to PQ 17:35 Choosing Post Quantum Signatures 23:20 How Blockstream Created SHRINCS 27:22 Signature Budgets Importance Explained 41:13 What are SHRIMPS? 44:51 SHRIMPS vs SHRINCS 47:48 Why SLH-DSA Alone Won’t Cut It 49:24 Is a SHRIMPS + SHRINCS BIP Coming? 51:51 Blockstream’s Big Plans for Liquid 59:04 Quantum Readiness Roadmap 01:02:22 Importance of a PQ Recovery Plan 01:05:35 How Long Would a PQ Migration Take 01:11:17 Quantum Watchlist Recommendations

Jonas Nick (@n1ckler) joined a technical panel on the open source stage at Bitcoin 2026 to discuss post-quantum signature schemes for Bitcoin, sharing why @blksresearch has been exploring hash-based signatures as the safer path forward.

Another year and another chance to get your paper awarded The Bitcoin Research Prize 🏆 Join previous winners like @n1ckler, @real_or_random, @robin_linus and @chelseakomlo in the the hall of fame. Be shameless, nominations are anonymous.

some new research for shielded csv from @gusgutoski applying ideas from zcash tachyon to improve scalability some background: a bottleneck with zerocash-based transaction protocols is the need for nullifiers - unlinkable revocation tokens used to detect double-spending. shielded csv is no different all nullifiers ever created must be stored and made available to clients. this number will always grow as the protocol processes more transactions cryptographer @gusgutoski has been thinking about this problem and has written up some ideas on applying tachyon, a scaling optimization for the zcash protocol, to shielded csv if you're interested in improving privacy and scalability for bitcoin payments, check it out!

Last week at @OPNEXT2026 I presented a toy proposal for hash-based sigs in Bitcoin (incl. SHRINCS). Open questions: • What are acceptable sign/verify costs? Higher → smaller sigs • How to design safe stateful setups? • Optimizations beyond SHRINCS? • L2s and stateful sigs?

This is a fantastic idea. 4.2× faster SLH-DSA compatible signing while reducing the signature budget to 2^48. No verifier changes required. Or, if you prefer: ~500× faster key generation. Way more than just a hack. And a great writeup.

Tagging major wallets: @TrustWallet @bitcoincom @Blockchain @exodus @BTCCexchange @GuardaWallet @edgewallet @CoinomiWallet 1. Will you support quantum-safe Bitcoin addresses if they are standardized? 2. How much would you like to participate in building PQ standards?

I've been working on a post-quantum cryptography registry/wiki and it's now live. If you're an engineer trying to evaluate PQC algorithms side by side, you have to piece together information from FIPS documents, ePrint papers, mailing list threads, and scattered READMEs. There are some existing resources out there for parameter sets but I wanted something that goes much further and includes everything; algorithm descriptions, use case and feature filtering, benchmarks, implementation references, and wiki-style prose all in one place with a consistent schema. So that's what this is. It covers nine algorithms today; the NIST standards (ML-KEM, ML-DSA, SLH-DSA), the NIST pipeline (FN-DSA, HQC), blockchain-specific schemes (SHRINCS, SHRIMPS, leanSig), and XMSS. There are a lot more I want to add and the registry is open source so contributions are welcome.