Most digital money today is protected by elliptic-curve signatures. A large enough quantum computer running Shor's algorithm could derive a private key from its public key and spend the coins. Qanum uses only signatures standardized by NIST for that scenario, at the highest security level, from its first block.
Classical and post-quantum, side by side
| ECDSA (secp256k1) | Ed25519 | ML-DSA-87 (Qanum, everyday spends) | SLH-DSA-SHAKE-256s (Qanum, recovery) | |
|---|---|---|---|---|
| Based on | Elliptic curves | Elliptic curves | Lattices | Hash functions |
| Broken by Shor's algorithm | Yes | Yes | No efficient quantum attack known | No efficient quantum attack known |
| Standard | SEC 2 (curve) | RFC 8032 | NIST FIPS 204 | NIST FIPS 205 |
| NIST post-quantum security level | Not applicable | Not applicable | 5 (highest) | 5 (highest) |
| Public key | 33 bytes | 32 bytes | 2,592 bytes | 64 bytes |
| Signature | 64 to 72 bytes | 64 bytes | 4,627 bytes | 29,792 bytes |
| Verify one signature, x86-64 server | Not measured | Not measured | about 55 µs | about 1.2 ms |
| Verify one signature, ARM | Not measured | Not measured | about 167 µs | about 1.9 ms |
Sizes of the Qanum suites: whitepaper §6.2. Times: one core, medians from the published runs on x86-64 and ARM, with raw data. Classical signatures were not measured in Qanum.
What it costs
- A Qanum payment with one input and two outputs takes 7,368 bytes (measured). Almost all of it is the ML-DSA-87 public key and signature.
- That is why Qanum keeps signature data apart from the rest of the block, limits the cryptographic work per block, and lets nodes prune old signatures.
- SLH-DSA-SHAKE-256s is much larger and slower, but rests only on hash functions. Qanum keeps it for recovery keys, as a second, independent family.
- The connections between nodes use a hybrid X25519 + ML-KEM-1024 key exchange (NIST FIPS 203, level 5).
What it does not change: mining
Post-quantum signatures protect spending. They do not protect mining. Qanum's proof of work uses SHA3-256, and Grover's algorithm gives a quantum computer a quadratic speed-up on any hash-based proof of work, whatever the hash. Published estimates put that advantage far below current mining hardware for years, and the difficulty adjustment absorbs it. Qanum does not claim that its proof of work is quantum-resistant (whitepaper §9.9).
Learn more
- Transaction size calculator: how many bytes a transaction takes and its minimum fee.
- Research: the crypto agility experiment and the cost benchmarks with their data.
- FAQ: short answers about Qanum.
- Whitepaper: the full design.