Blockstream has published a Bitcoin Improvement Proposal for SHRINCS, its experimental post-quantum signature scheme, marking a concrete step toward preparing Bitcoin for potential future quantum computing threats. The proposal builds on work already tested in production on the company’s Liquid sidechain and positions SHRINCS as a Bitcoin-specific option among emerging post-quantum cryptographic tools.

Although Blockstream co-founder and CEO Adam Back has long maintained that practical quantum attacks remain decades away, the company has continued research into practical defenses. Researchers describe the effort as a prudent measure to develop and document upgrades well before any threat materializes.

A Bitcoin-Native Design for Post-Quantum Security

SHRINCS is a hash-based signature scheme introduced by Blockstream researchers Jonas Nick and Mikhail Kudinov. An opcode proposal appeared in May, and the full BIP was released recently. Nick called it the first concrete proposal for a post-quantum signature scheme designed specifically for Bitcoin. He noted that it is not intended as the network’s final signature solution and is not optimal on every measure, yet it offers a strong practical balance among current options.

Independent experts have described the scheme as highly aligned with Bitcoin’s existing architecture. It supports BIP-39 seed recovery and rests on the same SHA-256 assumptions that underpin Bitcoin mining. The scheme has already signed real transactions on Liquid mainnet, including a demonstration that incorporated a copy of the Bitcoin white paper.

Signature sizes start at a minimum of 548 bytes plus a 48-byte public key and can reach up to 4,619 bytes. This remains approximately nine times larger than current Schnorr signatures of 64 bytes or older ECDSA signatures of around 70 bytes. By comparison, National Institute of Standards and Technology-endorsed post-quantum schemes are between 38 and 123 times larger than Bitcoin’s present signatures.

Throughput Impact and Size Optimizations

Larger signatures pose a direct challenge to Bitcoin’s transaction capacity. Direct adoption of certain NIST lattice-based or hash-based schemes could reduce throughput to roughly 0.5 transactions per second or as low as 0.36 TPS. Under Segregated Witness rules, signature data occupies less block weight than other transaction data, mitigating some of the increase.

Estimates indicate that widespread use of SHRINCS could support around 3 TPS, remaining close to current network performance levels. Full use of Taproot Schnorr signatures is projected at about 6.5 TPS. Blockstream has focused on shrinking NIST-aligned hash-based signatures by a factor of roughly 13 times while preserving compatibility with Bitcoin’s operational constraints.

Stateful Design and Associated Trade-Offs

To achieve smaller signatures, SHRINCS adopts a stateful approach. It stores used one-time keys on the user’s device rather than embedding a large multi-layer hash tree structure that would keep the scheme fully stateless. Each successive signature grows by about 16 bytes. If a device is lost, recovery requires a large stateless fallback transaction of approximately 5,777 bytes.

The BIP itself notes that a formal security proof remains outstanding. The scheme is still early-stage, has not undergone full independent auditing, and has not received the extensive public cryptanalysis applied to NIST standards. Additional complexity arises from rules governing seed initialization, compact signing paths, and conditions under which devices must switch to larger stateless signatures.

Interoperability risks exist as well. Keys generated with certain hypertree pruning settings for the stateless component are incompatible with implementations that lack that support, creating a potential for lost funds if keys are imported across mismatched systems.

Ongoing Refinements and Broader Research

Blockstream has continued refining the scheme throughout the year and recently showed that SHRINCS and related post-quantum methods can operate on common hardware wallets. A companion approach previously called SHRIMPS, intended to support backup devices sharing the same seed, has been integrated as a built-in stateless path under the same 48-byte public key and optimized to be about 26 percent smaller.

Parallel research explores lattice-based signatures, which tend to be smaller but are viewed by some as less mature, as well as zero-knowledge proof aggregation of signatures. Combining SHRINCS with zero-knowledge aggregation could theoretically raise throughput to around 6.7 TPS. The company has kept the choice of signature scheme separate from more contentious questions of block-size increases or the introduction of zero-knowledge proofs, recognizing that bundling multiple major changes could hinder consensus.

Any post-quantum upgrade will require broad community support and careful evaluation of both technical soundness and operational risks. The publication of the SHRINCS BIP moves the discussion from pure experimentation toward formal review, while leaving open questions about security validation, wallet implementation consistency, and the path to eventual activation.