leanSPHINCS, transaction signatures that are safe against quantum computers
Strawmap I* (2028) · leanSPHINCS PQ transactions
This lets Ethereum transactions use a quantum-resistant signature (leanSPHINCS) built only from hash functions, instead of today's elliptic curve signature. It is preparation to protect account assets even when quantum computers arrive.
Why it is needed
Today Ethereum transactions prove that the sender is who they claim to be with the elliptic curve digital signature (ECDSA). This method relies on the assumption that a certain math problem is hard to solve, but once a sufficiently large quantum computer exists, Shor's algorithm can derive the private key from the public key. Sending a transaction once reveals the public key, so the account is at risk from then on. Hash-based signatures rely only on the property that a hash function can be computed in one direction only. Quantum computers are known to have no large advantage in inverting hash functions, so this is regarded as the most conservative quantum-resistant approach. SPHINCS+ is a hash-based signature adopted as a standard by the U.S. National Institute of Standards and Technology (NIST). It is a stateless method, where the signer does not need to record which key was used, which makes it well suited to wallets. However, the signatures are much larger than today's, so using it as is takes up a lot of block space. leanSPHINCS is an item that proposes slimming this method down to fit Ethereum so it can be used as a transaction signature. The "lean" in the name comes from the same context as the lean Ethereum effort pushed by the Foundation. In Strawmap it sits in the execution layer I* fork (2028) slot, but that is only an estimate, not a commitment.
How it works
- Make the keys Several secret values are drawn and each is hashed to make a public key. Going from a secret value to the public key is easy, but there is no way back. SPHINCS bundles many of these one-time keys in a tree so that one public key can sign many times.
- Sign The hash of the transaction contents determines which of the secret values to reveal, and those values are attached as the signature. If the transaction contents change, the values that must be revealed change too.
- Verify A node hashes the values in the signature again and only checks that they match the public key. Because it uses only hash computation instead of a hard math problem, it is hard to break even with a quantum computer.