#near账户支持抗量子ml-dsa签名
Changing the locks doesn't mean moving house, because the new key was never put inside
▪️ Public-chain accounts now support post-quantum ML-DSA signatures—no need to migrate assets
▪️ The approach uses implicit accounts: addresses are derived from the initial-state hash, and public keys aren't put on-chain
▪️ A single signature is about 3,300 bytes—50 times larger than existing solutions
▪️ The testnet is live; mainnet is planned for the coming weeks
The hardest part of post-quantum signatures isn't computing power—it's size. A single signature is about 3,300 bytes, 50 times larger than existing solutions. If we keep the current account structure, every account will take up more on-chain space. That's the cost of quantum resistance that's easiest to underestimate.
The solution isn't to cram a big key in—it's not to put it in at all. Account addresses are derived from the hash of the initial state, and assets are tied to that hash. Neither the public key nor the key hash goes on-chain. What the chain sees is just a commitment; it can't see the key. No matter how large the signature is, it takes up no on-chain space.
The official term is “crypto-agility”—signature schemes should be replaceable like spare parts. There's another piece to go with it: for chains that can't add post-quantum keys, a recovery registry lets users first register a rotatable hash as their recovery key.
So the point isn't the words “quantum-resistant”—it's who bears the cost of changing the locks. If changing locks means users have to move their assets themselves, even the most secure solution will be put off. Shifting the cost off users is what makes the change possible.
Three things to watch next: when mainnet launches, which parameter set is ultimately chosen (the sizes of different sets vary by nearly a factor of two), and whether other chains adopt this structure.
If changing the locks doesn't require you to do a thing, would you still wait until quantum computers arrive?
$NEAR
Changing the locks doesn't mean moving house, because the new key was never put inside
▪️ Public-chain accounts now support post-quantum ML-DSA signatures—no need to migrate assets
▪️ The approach uses implicit accounts: addresses are derived from the initial-state hash, and public keys aren't put on-chain
▪️ A single signature is about 3,300 bytes—50 times larger than existing solutions
▪️ The testnet is live; mainnet is planned for the coming weeks
The hardest part of post-quantum signatures isn't computing power—it's size. A single signature is about 3,300 bytes, 50 times larger than existing solutions. If we keep the current account structure, every account will take up more on-chain space. That's the cost of quantum resistance that's easiest to underestimate.
The solution isn't to cram a big key in—it's not to put it in at all. Account addresses are derived from the hash of the initial state, and assets are tied to that hash. Neither the public key nor the key hash goes on-chain. What the chain sees is just a commitment; it can't see the key. No matter how large the signature is, it takes up no on-chain space.
The official term is “crypto-agility”—signature schemes should be replaceable like spare parts. There's another piece to go with it: for chains that can't add post-quantum keys, a recovery registry lets users first register a rotatable hash as their recovery key.
So the point isn't the words “quantum-resistant”—it's who bears the cost of changing the locks. If changing locks means users have to move their assets themselves, even the most secure solution will be put off. Shifting the cost off users is what makes the change possible.
Three things to watch next: when mainnet launches, which parameter set is ultimately chosen (the sizes of different sets vary by nearly a factor of two), and whether other chains adopt this structure.
If changing the locks doesn't require you to do a thing, would you still wait until quantum computers arrive?
$NEAR