Zakura Proposes One-Time Viewing Keys to Block Quantum Linking of Shielded Zcash

Zcash full node developer Zakura has proposed "one-time" viewing keys to prevent a future quantum computer from linking a user's shielded Zcash payments, according to an engineering post by Zakura developer Adam Tucker published Sunday. The fix requires no network upgrade, Zakura said in a tweet introducing what it called "post-quantum unlinkable swaps for Zcash."

The proposal targets a specific structural weakness in how shielded swaps execute today. Zcash's shielded transactions hide the sender, recipient and amount, and each shielded account relies on a single incoming viewing key that sits behind all of its addresses. The wallet uses that key to find and decrypt payments sent to any of them.

A classical computer cannot recover the key from an address. A sufficiently powerful quantum computer running Shor's algorithm could, according to the post, and would then see the value and memo of every payment the account has ever received — and tie them together.

What does the gap mean in practice?

The exposure is not theoretical for users of cross-chain swap rails. The biggest risk, according to the post, comes from swaps through NEAR Intents, a cross-chain swap service. Each swap out of ZEC writes one of the user's shielded addresses to NEAR's public chain as a refund address, whether or not a refund is ever made.

The posted addresses look different, but they all belong to the same account. Breaking one would expose all of them.

The volume at stake is material. Between $600 million and $700 million had flowed through Zcash's NEAR Intents route by May, Zcash Open Development Lab CEO Josh Swihart said at the time.

"Until Tachyon ships, there is a glaring hole: a single published shielded address lets a quantum attacker link every payment that address's key has ever received," Tucker wrote, referring to the proposed scalability upgrade that Zcash developers say would also deliver full post-quantum privacy.

How the fix works

Zakura's approach derives a separate incoming viewing key for each address that must be published, while leaving the account's spending key untouched. A quantum attacker who breaks one posted address learns only about the payments sent to that address.

"If a quantum computer ever breaks a posted swap address, it will not be able to link this to any other transaction," Tucker wrote in a Twitter thread.

The design also addresses an operational cost: restore times from a seed phrase. Because a wallet holding many one-time keys would otherwise scan for each one, the wallet queries NEAR's payouts using private information retrieval — a technique that lets it ask a server which addresses it is interested in without revealing them.

For context, that means a user recovering a wallet with dozens of swap addresses does not trade privacy for speed: the lookup stays confidential on both ends.

Where this fits Zcash's quantum roadmap

The proposal follows Zakura's plan for quantum-safe transparent addresses earlier in October, which also used private information retrieval and projected post-quantum signature opcodes in Zcash for January. Swihart said in May that Zcash was aiming for full post-quantum status within 12 to 18 months.

Concern about the cryptography securing crypto wallets extends beyond quantum timelines. Ethereum Foundation researcher Justin Drake and Ethereum co-founder Vitalik Buterin have warned that AI could break it before quantum computers do.

What does this change for wallet operators?

Wallets built on Zakura's open-source libraries, such as Vizor, will be able to integrate the one-time keys for software wallets in the coming weeks, according to the post. Hardware wallets will follow once their firmware supports it — a sequencing detail that matters for custody teams planning upgrade windows.

For developers, the practical shift is narrow: no consensus change, no fork coordination, no client version dependency. Integration happens at the wallet layer, which shortens deployment timelines from months to weeks.

For users of NEAR Intents swaps, the change converts a catastrophic failure mode — one broken address exposing an entire payment history — into a contained one. That is the operational difference practitioners should price in when assessing post-quantum risk today rather than at Tachyon's arrival.

The next checkpoint to watch is January, when post-quantum signature opcodes are expected to land in Zcash, opening the path toward the full post-quantum status Swihart targeted for within 12 to 18 months of his May remarks.