Sui is advancing plans to integrate post-quantum cryptography into its protocol, aiming to protect accounts and high-value holdings against the eventual risk that sufficiently powerful quantum computers could compromise today’s elliptic-curve signatures.

Public keys on a blockchain become permanently visible once an account transacts. This creates a “harvest-now-forge-later” vulnerability: adversaries can collect those keys today and wait for quantum hardware capable of running Shor’s algorithm. Research cited by the network from Google Quantum AI in March 2026 estimated that recovering a private key from an exposed public key could take only minutes on a fault-tolerant machine using fewer than 500,000 physical qubits.

Two Distinct Signature Schemes

Rather than relying on a single algorithm, Sui is adopting two NIST-standardized schemes that rest on different mathematical foundations. A breakthrough against one would not automatically compromise the other.

For ordinary user accounts, the network will make ML-DSA-65 (FIPS 204) a native protocol signature scheme. It selected the Level 3 parameter set rather than the lower-cost Level 1 option after a July 2026 episode in which an artificial-intelligence model reduced the effective strength of another post-quantum candidate in roughly 60 hours. The same Level 3 parameters are already appearing in other infrastructure, including AWS Key Management Service, Android 17’s secure hardware Keystore, and post-quantum protections used by Chrome and Cloudflare for a large share of web traffic.

For high-value assets held in smart-contract vaults, Sui will use the hash-based SLH-DSA-SHA2-128s (FIPS 205). This scheme will live inside Move contracts rather than the core protocol, preserving the ability to adapt to future industry standards without a network-wide upgrade. The approach also suits Sui’s bridges to other chains.

Seamless Path for Existing Users

Sui’s architecture was designed for cryptographic agility, allowing new signature schemes to be added without altering consensus rules or existing state. An ML-DSA-65 private key is a 32-byte seed derived from the same recovery phrase users already hold, via a new standard derivation path. Wallet backup and restore processes remain unchanged.

Address aliases, already live on the network, enable an account to replace its authorization key with a post-quantum key while retaining the original address and all assets. No forced migration or bulk transfer is required. The primary trade-off is size: post-quantum signatures and public keys are substantially larger than Ed25519 pairs, increasing transaction footprints. Verification performance, however, stays close enough to current levels that per-signature network costs do not rise materially. Transaction size limits and programmable transaction blocks are expected to absorb the difference, with further optimization work continuing.

Support for ML-DSA-65 will also extend to Sui’s multisignature authenticator, permitting accounts to require both a classical and a post-quantum signature.

Rollout Timeline

The core implementation has been built and benchmarked. Independent audits are in progress. Quantum-safe vaults are targeted for mainnet deployment later in 2026. Native ML-DSA-65 accounts are planned for testnet by the end of 2026, with native account authentication on mainnet scheduled for the first quarter of 2027. Wallet, SDK and command-line interface support will arrive in parallel. The feature set will be additive and opt-in, following the same path previously used for zkLogin and passkeys. Existing accounts, applications and contracts continue to function without modification.

The schedule remains subject to audit results and testnet feedback. The network frames the work as a routine protocol-feature update rather than a fundamental redesign.

Broader Context

The initiative aligns with NIST’s post-quantum standardization effort and the joint CISA/NSA/NIST quantum-readiness roadmap. It also tracks accelerating government timelines, including a June 2026 executive order that directs U.S. federal agencies to deploy post-quantum digital signatures by the end of 2031 for sensitive systems. Similar preparatory work is under way across the industry, ranging from custody providers refining key-exposure controls to other blockchains testing larger post-quantum signatures and institutions planning key-management upgrades.

Sui’s combination of dual algorithms, deterministic key derivation and address aliases is intended to give users a practical route to stronger long-term protection while the wider ecosystem continues its own transition.