Category: EIPs (core subcategory)
Title: Draft EIP: Higher-Security Curve for BLS Signatures
Discussion topic for a draft EIP. It doesn’t have a number or PR yet: draft.
This draft specifies how to move the most security-critical consensus-layer BLS signatures from BLS12-381 to a higher-security pairing-friendly curve, with BLS48-581 as the current candidate. RANDAO reveals, selection proofs, and aggregator signatures stay on BLS12-381. It hedges against a hypothetical attack that halves elliptic curve security. No such attack is known today. This covers only the consensus layer, and a similar approach may be considered for the execution layer. Blobs are not covered.
Validators would register the new key together with their post-quantum keys, through the EIP-8450 registration, and it would stay dormant until needed. A later fork, which could be an emergency hard fork, would switch signing to the new curve, or the chain could switch to the post-quantum keys instead, depending on the situation.
Update Log
- 2026-11-02: initial draft
External Reviews
None as of 2026-11-02.
Outstanding Issues
- 2026-11-02: Initial modeling suggests the switch is feasible on regular multi-core computers with batching and this signature split, but nodes on all attestation subnets need much more, and this isn’t yet demonstrated in a client.
- 2026-11-02: Whether a second dormant key is worth the cost, given that EIP-8450’s post-quantum keys would also resist a classical break.
- 2026-11-02: Other open questions are listed in the draft, including G2 vs G1 signatures, whether aggregator signatures should stay on BLS12-381, unregistered validators, and the final curve choice.