leanXMSS, vote signatures that withstand quantum computers
Strawmap J* (2028~29) · leanXMSS PQ attestations
The signature validators attach when voting on a block is changed from today's BLS scheme to an XMSS-family signature built only from hash functions. The goal is to make votes impossible to forge even when quantum computers arrive.
Why it is needed
Each slot, Ethereum validators vote on which block is correct and send the vote with a signature attached. The signature in use today is BLS, an elliptic curve scheme. Its advantage is that a very large number of signatures can be merged into one, which keeps it light, but once a sufficiently large quantum computer exists, the elliptic curve math can be solved and votes can be forged in someone else's name. This is a problem that breaks consensus itself. XMSS (eXtended Merkle Signature Scheme) is a signature built only from hash functions. Hash functions are known to be hard to break even with quantum computers, which makes this a leading candidate for post-quantum signatures. leanXMSS is a variant tailored to Ethereum consensus voting, and it is one piece of the lean Ethereum research that aims to redesign the consensus layer more simply. Hash-based signatures have the weaknesses that they cannot be merged as easily as BLS and are also large, so they are being studied together with methods that bundle many signatures into a zero-knowledge proof (SNARK) to compress them. Inclusion in the J fork is only an estimate on the Strawmap and not confirmed. The work is still at the research stage, so the design may change or be dropped.
How it works
- Bundle one-time keys like a tree A validator generates many signing keys in advance, each usable only once, and bundles them into a Merkle tree built by hashing. The single root value of the tree becomes the public key.
- Sign with one key per slot For each vote, the validator signs with one unused one-time key and attaches the path showing that the key belongs to the tree. The receiver checks that the signature is genuine using only hash computation.
- Never reuse a spent key Using a one-time key twice leaks the secret, so the validator records which keys it has used up to now. This state management is both a defining feature and a burden of XMSS.
- Compress many signatures into a proof Hash-based signatures cannot be merged directly like BLS. So a method is being studied in which many signatures are collected, a proof that all of them are valid is created, and that proof is passed to the network.