Cardano CIP-0197 Open Review for Post-Quantum Wallet Protection

One proposal wey dem label as CIP-0197 for now don open for review inside Cardano’s CIP repository. Paweł Jakubas submit am, and e outline one optional post-quantum protection layer for Cardano wallets wey base on CIP-1852.

Instead make users move go new wallet format, the design go keep the keys and addresses wey dem dey use already, and e go add proof say the signer control the seed-derived secret wey connect to one public key.

CIP-0197 Add New Proof Layer to Cardano Wallets

Cardano HD wallets dey use BIP32-Ed25519 derivation to generate account hierarchy from one root seed. Ed25519 still secure for computers wey we get today, but if quantum computer strong well, e fit theoretically break elliptic-curve signature systems through Shor’s algorithm.

If dem replace Cardano’s existing derivation system with post-quantum alternative, e fit cause heavy compatibility wahala. Wallets, exchanges, custodians, hardware devices, multisignature accounts, and governance credentials fit all need migration.

CIP-0197 propose make dem add zero-knowledge proof wey tie to the wallet’s account-level seed witness. Verifier fit confirm say the signer dey control the required secret without to know the seed itself.

The proposal dey use the ZKPoSP construction wey ePrint 2026/1508 describe as starting point. The preferred direction na transparent STARK technology, wey no need trusted setup and dem design am around cryptographic assumptions wey people consider resistant to known quantum attacks.

Existing Cardano Addresses Go Still Remain Compatible

To maintain address compatibility na the main practical advantage of the proposal. If dem mandate new signature system, e go need coordinated changes across Cardano’s wallet and service infrastructure.

CIP-0197 instead describe two-phase transition.

For the first phase, the normal Ed25519 signature go still remain on-chain while the additional proof go dey verified outside the ledger. Wallet providers, exchanges, custodians, and indexers fit test the system or introduce their own proof requirements without to change Cardano’s consensus rules.

This one go provide implementation data, but e no go make the Cardano ledger post-quantum secure yet. The network go still accept transactions wey valid Ed25519 signatures alone authorize.

Second phase fit introduce native proof verification inside Cardano nodes. The proof fit then become part of the transaction witness wey the network go enforce. To reach that stage go require consensus change, native verifier, and much smaller proofs.

Proof Size Still Be the Main Obstacle

Reference figures from the underlying research paper put the proof size around 219 KB. Verification dey take around nine to ten milliseconds, while to produce one signing proof dey take about 12.5 seconds. One one-time derivation process need roughly 156 seconds.

Dem record those measurements for high-end 16-core server, no be typical user device. The proposal author still confirm say dedicated Cardano prototype never exist, and browser and WebAssembly performance never get test.

Proof size na the clearest barrier to native deployment. Proof of 219 KB no go fit enter inside Cardano’s current on-chain size constraints unless dem do major optimization or use different distribution method. Reviewers don request more evidence on block impact, memory requirements, wallet performance, and possible alternatives to handle proofs outside blocks.

CIP-0197 give Cardano one specific design to test against future security threat while e try preserve the existing wallet infrastructure. But e no dey change wallet functionality for now or provide live post-quantum protection. Progress go depend on reference implementation, reproducible benchmarks, and proof sizes wey fit operate inside Cardano’s transaction and block limits.