Post Quantum transaction signature (PQTS) Breakout #5

Protocol Calls & happenings
1

Agenda

Meeting Time: Wednesday, April 01, 2026 at 13:00 UTC (60 minutes)

GitHub Issue

1 Like
2

YouTube recording available: https://youtu.be/V59OkKfATng

3

Meeting Summary:

The fifth post-Quantum transaction signature breakout meeting focused on hardware support, with presentations from Project 11 and Ledger teams discussing BIP32 implementations and post-quantum signature challenges. Conor from Project 11 presented lattice-based solutions for maintaining BIP32 functionality while highlighting significant trade-offs including larger key sizes and cryptography complexity. Yannick and Alain from Ledger demonstrated hardware implementation challenges, presenting benchmark results for various post-quantum algorithms and discussing future prospects for secure element improvements.

Click to expand detailed summary

The meeting was the fifth occurrence of a post-Quantum transaction signature breakout room, focusing on hardware support. Conor Deegan from Project 11 was scheduled to present papers on BIP32 for lattice, followed by Yannick from Ledger discussing post-quantum signatures. Antonio mentioned Julio from Aragon’s contribution of testnet wallet functionality at a freshly created address, supporting algorithms like Falcon and Dalithium, as well as ephemeral ECDSA.

Conor from Project 11 presented a paper on maintaining BIP32 in a post-quantum setting using lattice-based cryptography. He outlined two constructions: a standard MLDSA HD wallet and a new non-hardened key derivation scheme using Raccoon G, which maintains extended public key functionality while reducing security proofs to standard lattice assumptions. Conor emphasized that while lattice-based solutions offer a path forward for maintaining BIP32 features, they come with significant trade-offs including larger key sizes and the use of lattice cryptography, which may not be the preferred approach for all applications.

Conor and Antonio discussed the possibility of using ephemeral key derivation with a 500 million direction limit, which Conor confirmed would work alongside an ephemeral scheme. They explored challenges with hash-based signatures, with Conor explaining that replicating the solution for hash-based signatures would be difficult due to commutativity issues and is likely not feasible without post-quantum algorithms. The group agreed to further discuss potential solutions, including using lightweight one-time signatures like Winternets or Ed25519, during an in-person meeting in Cannes.

Yannick and Alain from Ledger’s Security team presented on the challenges of implementing post-quantum cryptography in hardware signers. They explained that while current post-quantum signature schemes like Dilithium, SPHINCS+, and Falcon are not well-suited for constrained hardware platforms due to high memory requirements and computational demands, Ledger’s hardware signers rely on two chips: an MCU (STM32) and a secure element (ST33) with limited resources including 64KB of RAM and 1.5MB of non-volatile memory. The presentation focused on demonstrating the hardware constraints that make post-quantum implementation challenging, with Yannick preparing to hand over to Alain to present preliminary benchmarks of post-quantum standards running on the ST33.

The team discussed benchmarking results for three post-quantum cryptography algorithms: Falcon, Lithium, and SLHDSA (Sphinx). Alain presented findings showing that Falcon had acceptable performance but high memory requirements, while Lithium offered better security but slower execution times. SLHDSA showed unacceptable signing times of 6 minutes for basic security levels, making it unsuitable for current devices. Yannick outlined future prospects, noting that the next generation of secure elements will have more memory and hardware acceleration for lattice-based schemes, though hash-based signatures remain uncertain. The team identified several next steps including implementing side-channel attack countermeasures, exploring stateful hash-based signatures, and investigating potential improvements to current implementations.

Next Steps:

  • Conor, Matteo, Stefano, and Antonio: Meet in Cannes to discuss BIP85 and one-time signature implementation for ephemeral key generation
  • Yannick: Ask internal Ledger specialists about heap allocation limitations (7-8 kilobytes) on SE33 and provide answer to Stefano
  • Yannick and Stefano: Have a separate technical conversation about MPC in the head primitives and heap allocation constraints on hardware
  • Ledger team (Yannick and Alain): Continue work on implementing countermeasures for side-channel attacks in MLDSA and Falcon implementations
  • Ledger team (Yannick and Alain): Explore stateful hash-based signatures (XMSS, LMS) and few-time signature schemes to evaluate performance improvements
  • Ledger team (Yannick and Alain): Work on state of the art of side channel attacks, currently focusing on MLKM with MLDSA as next target
  • Conor: Share paper and GitHub links in chat for BIP32 lattice-based implementation
  • Alain: Send link to paper exploring various parameter sets for Sphinx in the chat

Recording Access: