Cardano CIP-0197 Opens Review for Post-Quantum Wallet Protection

A proposal carrying the tentative CIP-0197 label is open for review in Cardano’s CIP repository. Submitted by Paweł Jakubas, it outlines an optional post-quantum protection layer for Cardano wallets based on CIP-1852.

Instead of moving users to a new wallet format, the design would preserve existing keys and addresses while adding proof that the signer controls the seed-derived secret connected to a public key.

CIP-0197 Adds a New Proof Layer to Cardano Wallets

Cardano HD wallets use BIP32-Ed25519 derivation to generate an account hierarchy from a root seed. Ed25519 remains secure against current computers, but a sufficiently capable quantum computer could theoretically compromise elliptic-curve signature systems through Shor’s algorithm.

Replacing Cardano’s existing derivation system with a post-quantum alternative would create a broad compatibility problem. Wallets, exchanges, custodians, hardware devices, multisignature accounts, and governance credentials could all require migration.

CIP-0197 proposes adding a zero-knowledge proof tied to the wallet’s account-level seed witness. A verifier could confirm that the signer controls the required secret without learning the seed itself.

The proposal uses the ZKPoSP construction described in ePrint 2026/1508 as its starting point. Its preferred direction involves transparent STARK technology, which does not require a trusted setup and is designed around cryptographic assumptions considered resistant to known quantum attacks.

Existing Cardano Addresses Would Remain Compatible

Maintaining address compatibility is the proposal’s main practical advantage. A mandatory move to a new signature system would require coordinated changes across Cardano’s wallet and service infrastructure.

CIP-0197 instead describes a two-phase transition.

During the first phase, the normal Ed25519 signature would remain on-chain while the additional proof would be verified outside the ledger. Wallet providers, exchanges, custodians, and indexers could test the system or introduce their own proof requirements without changing Cardano’s consensus rules.

This would provide implementation data, but it would not make the Cardano ledger post-quantum secure. The network would still accept transactions authorized by valid Ed25519 signatures alone.

A second phase could introduce native proof verification inside Cardano nodes. The proof could then become part of the transaction witness enforced by the network. Reaching that stage would require a consensus change, a native verifier, and much smaller proofs.

Proof Size Remains the Main Obstacle

Reference figures from the underlying research paper put the proof size at approximately 219 KB. Verification takes around nine to ten milliseconds, while producing a signing proof takes about 12.5 seconds. A one-time derivation process requires roughly 156 seconds.

Those measurements were recorded on a high-end 16-core server, not a typical user device. The proposal author has also confirmed that a dedicated Cardano prototype does not yet exist, while browser and WebAssembly performance remains untested.

Proof size presents the clearest barrier to native deployment. A 219 KB proof would not fit within Cardano’s current on-chain size constraints without major optimization or a different distribution method. Reviewers have requested further evidence on block impact, memory requirements, wallet performance, and possible alternatives for handling proofs outside blocks.

CIP-0197 gives Cardano a specific design to test against a future security threat while attempting to preserve its existing wallet infrastructure. However, it does not currently change wallet functionality or provide live post-quantum protection. Progress depends on a reference implementation, reproducible benchmarks, and proof sizes that can operate within Cardano’s transaction and block limits.