What Is Post-Quantum Here, and What Is Not
Most projects answer "are you quantum-safe?" with a yes. The useful answer names the parts that are, the parts that are not, and what would have to change. This page is that answer.
The short version
Post-quantum settlement core; the bank-attestation leg is curve-bound, and we say so. The vault's protocol layer uses no elliptic curves. Two elliptic-curve dependencies sit outside it, and they are not equally serious: the bank payment attestation is soundness-critical — break it and a payment that never happened can be proven — while the off-chain mailbox is confidentiality-only, so breaking it reveals messages and forges nothing. Neither is part of the settlement rules, and either can be replaced without changing them.
| Layer | Primitive | Against a quantum adversary |
|---|---|---|
| Settlement proofs | Circle-STARK over Mersenne-31 (Stwo) | Soundness rests on hash collision-resistance — no number-theoretic assumption to break |
| Hashing | Poseidon2 and Blake2s over M31 | Grover halves the margin; parameters are sized for that |
| Threshold authority | Shamir secret sharing over a prime field | Information-theoretic — not a computational assumption at all |
| Account authority | Knowledge of a key, proven by hash preimage | Grover only |
| Aggregator rotation | Hash-based verifiable random function | Hash assumptions only |
| Bank attestation | secp256k1 ECDSA, from the notary | Shor breaks it — see below |
| Mailbox transport | X25519 | Shor breaks it — see below |
Why the protocol layer has no curves
Shor's algorithm breaks RSA, ECDSA, ECDH, Schnorr and BLS. It does not break hash functions: Grover's algorithm gives only a quadratic speedup on unstructured search, which costs a hash-based scheme half its security bits and is answered by choosing larger ones. So a design built from hashing, Shamir secret sharing and STARK proofs has nothing for Shor to attack — not because it was hardened against quantum attack, but because it never depended on the structure Shor exploits.
That is a construction choice with a cost. Curve-based signatures are small and fast; hash-based alternatives are neither. The threshold scheme, for instance, is not a curve signature at all — each participant proves knowledge of their own share, no party ever reconstructs a master secret, and the whole check is hashes and Merkle openings.
The bank attestation is the exception that matters
A PayMoney settlement turns on a proof that a bank payment happened. That proof is produced with TLS Notary: a notary co-observes the TLS session with the payer and signs an attestation over what was transmitted. That signature is secp256k1 ECDSA, and the settlement circuit verifies it inside the proof.
This has three consequences worth stating plainly.
- It is the one Shor-breakable primitive on the settlement path. An adversary with a cryptographically relevant quantum computer could forge a notary attestation and, with it, a payment that never happened.
- It is the most expensive thing in the circuit. Verifying a secp256k1 signature inside a STARK over a small field is the single largest component of the proof — the field's structure is a poor match for the curve's, and no published implementation exists to borrow.
- It is replaceable. The notary scheme is not part of the vault's settlement rules. Swapping the attestation signature for a hash-based or lattice scheme changes the verifier circuit and nothing else.
Security of the settlement reduces to three assumptions: the TLS session's pseudorandom function, the soundness of the STARK, and the unforgeability of the notary's signature. A break in any one is a break.
The mailbox is the cheaper exception
Off-chain messages between participants are encrypted with X25519 and ChaCha20-Poly1305. This is confidentiality only: breaking it lets an adversary read messages. It does not let them forge a settlement, move value, or alter the vault's state, because nothing in the settlement rules trusts the mailbox. Migration to a post-quantum key exchange is additive and touches no protocol code.
What would change the answer
- A notary attestation scheme that is not curve-based would remove the settlement path's only Shor-breakable dependency.
- A post-quantum mailbox transport would remove the other.
Neither is built. This page describes a published design, not running software, and will be updated as that changes rather than in advance of it.