Quantova Proposes Post-Quantum Signature Checks for Cardano Smart Contracts

Quantova has proposed adding two post-quantum digital signature verification functions to Plutus, Cardano’s smart contract platform.

Submitted on October 15, the proposal received the candidate designation CIP-0206 during the Cardano Improvement Proposal review process. It remains open for technical review, and the functions have not been introduced on the network.

Two Signature Standards for Plutus

CIP-0206 proposes verification functions for ML-DSA and SLH-DSA, two algorithms standardized by the U.S. National Institute of Standards and Technology as FIPS 204 and FIPS 205.

The algorithms rely on different cryptographic approaches. ML-DSA is based on mathematical problems involving lattices, while SLH-DSA uses hash functions. Quantova proposes supporting both so that Plutus contracts could verify signatures produced using either method.

Each proposed function would receive a public key, a message and a signature. A smart contract could use the result to determine whether a required signature is valid before carrying out an action.

Quantova identifies multisignature treasuries and blockchain bridges among the potential applications. The proposal concerns verification within smart contracts; it does not itself change the keys or signatures Cardano users currently use to authorize wallet transactions.

Signature Size and Performance Testing

One consideration is the amount of transaction space the proposed signatures would require. According to the proposal, an ML-DSA-65 signature occupies 3,309 bytes, with a public key of approximately 1,952 bytes. For the SLH-DSA-SHA2-128s variant, the signature occupies 7,856 bytes and the public key 32 bytes.

Both signatures fall within the transaction size limit discussed in the proposal, but they could consume a substantial share of the available space. Any increase to that limit would be a separate change to Cardano’s consensus rules.

Participants in the proposal discussion have also shared signature verification benchmarks. Quantova reported approximately 64 microseconds for ML-DSA-65 verification and between 130 and 330 microseconds for SLH-DSA variants. Another reviewer published separate measurements for existing Cardano cryptographic functions, including Ed25519.

The figures were obtained using different machines and libraries. Further testing in the Plutus environment would be needed to establish the cost model for the proposed functions.

Quantova also provided reference code and test cases for the verification process. In an October 17 update, the company reported a set of 31 test vectors covering valid signatures, modified messages and mismatched keys, among other cases.

[NEWSBREAK]

Review and a Separate Wallet Proposal

CIP-0206 responds to a question raised in CPS-0027 about which post-quantum signature schemes should be introduced as Plutus built-ins. CIP editors have invited cryptography specialists and Plutus contributors to review the proposal and its performance requirements.

Adding the functions and their cost model would require a hard fork because they affect the Plutus evaluator, which is relevant to network consensus. The proposal assigns implementation work to Cardano ledger and Plutus maintainers. No activation date has been announced.

A separate candidate, CIP-0197, addresses post-quantum protection for HD wallets. While CIP-0206 focuses on signature verification inside smart contracts, CIP-0197 explores an approach involving existing wallet keys and zero-knowledge proofs.

Intersect’s Technical Steering Committee has also announced a November 4 discussion on post-quantum cryptography with Input Output researchers. The event covers the broader subject and does not list CIP-0206 as a specific agenda item.