Trezor weighs safer defaults for Bitcoin’s post-quantum migration

Stateful SHRINCS signatures for Bitcoin are 10 times smaller than the scheme’s stateless signatures, but reuse beyond a signing budget could expose funds to theft, Trezor CTO Tomáš Sušánka said.

On a recent episode of MARA Foundation TV, Sušánka laid out a design problem facing hardware wallet makers. The devices keep private keys offline. Their next job may be managing cryptographic state without pushing that burden onto users.

The state-tracking problem

Proposed late last year by Blockstream Research Director Jonas Nick and cryptographer Mikhail Kudinov, SHRINCS is the community’s leading candidate for Bitcoin’s post-quantum signature scheme. It uses a composite hash-based approach with two signature types:

• Stateless signatures are larger and slower, but safe to reuse.
• Stateful signatures are smaller and more efficient, but require strict state tracking and become risky when reused beyond the allowed signing budget.

The stateful system contains a tree of one-time signatures. If those one-time keys are used more than once, enough cryptographic information may emerge for another party to forge the user’s signature and steal funds. Exact state counting becomes a critical job for wallet developers, alongside a wide set of security edge cases.

Sušánka sees that burden as a poor fit for consumers. His position is straightforward: wallet makers should make state handling secure rather than ask users to manage it themselves.

“For example, you can have two Trezors with the same recovery seed. How do you share the state between those two? You really don’t,” he added.

The example shows why a seed cannot be treated as a complete transfer of signing state. Developers must decide how that state moves between devices without opening another path to lost funds.

Trezor’s proposed defaults

Trezor is considering making the heavier stateless signatures the default for everyone. The riskier stateful option would sit behind advanced settings. This approach would favor reuse and remove the most exposed state-tracking choice from the default path, at the cost of larger transactions, potentially higher fees and slower signature performance.

Sušánka called SHRINCS a potentially conservative cryptographic choice because it relies on the same assumptions as SHA-256. He remains divided over state maintenance and does not want to discard stateful signatures. Their 10-times-smaller size makes a meaningful difference for transactions, even if the implementation carries more operational complexity.

The wider lesson is that quantum resistance will not arrive as a single protocol switch. It will require product decisions about defaults, device compatibility and migration paths. Those choices can expose more risk than the cryptography itself if wallet makers treat them as implementation details.

The hardware migration

A quantum-resistant Bitcoin address and signature system would not by itself secure every part of a hardware wallet. The devices themselves will need updates. Most signing devices still use quantum-vulnerable cryptography for hardware-specific security functions, including firmware and device authentication. A fully quantum-ready device must add post-quantum protection to those functions as well.

Trezor has begun that work. The company is already shipping the Trezor Safe 7, which supports post-quantum cryptography for wallet authentication. Those devices still cannot make Bitcoin transactions quantum-secure until Bitcoin itself upgrades to post-quantum security.

Sušánka warned developers not to wait for a finished migration before giving users options. Moving potentially millions of users will take time, and strict rules that allow no compromises could stall the process.

“People should be ready to make compromises,” Sušánka said. “If we’re all going to be very strict on what can and cannot be done, we’re not going to get anywhere.”

What does this change for Bitcoin users?

For users, the immediate change is operational. Quantum-ready wallet authentication does not protect a legacy Bitcoin signature. If Bitcoin adopts SHRINCS, users may face a choice between safer, reusable stateless signatures and smaller stateful signatures that demand careful state management.

Trezor’s proposed design would answer that choice by making the safer path default and the more technical path opt-in. It would not remove the tradeoff. It would relocate responsibility for secure state handling from the user to the wallet developer, which is the central product requirement Sušánka described.

The practical deadline comes before mass migration begins: developers need workable options early enough to move potentially millions of Bitcoin users. The next protocol-level change must come first, though. Until Bitcoin adopts post-quantum addresses and signatures, quantum-ready wallet authentication can strengthen device access but cannot make Bitcoin transactions quantum-secure.