ALGORAND · L1 · STAGE 3 PILOTED AT PROTOCOL MARGINS · QRI 41 v3.1.0 methodology

In plain terms

What it is. Algorand is the rare blockchain that has already switched on quantum-proof signing for real on its live network, instead of only promising to.

What we found. Almost nobody uses that protection yet: fewer than one in ten thousand transactions are signed the quantum-proof way, ordinary accounts still rely on the old vulnerable signing by default, and the protection leans on a single math approach with no backup if that one is ever broken.

Why it matters. Holders and builders get a head start and proof the technology works here, but until everyday accounts and the core network voting move over, most balances stay exposed to a future quantum attacker.

The single chain in the 67-chain v3.1.0 evaluation set with shipped post-quantum primitives in mainnet production. Falcon-1024 LogicSig accounts (live since 2025-11-03) and Pixel-BLS State Proofs (live since 2022) sign real protocol data on mainnet, at less than 0.01 percent of total signing traffic, with no hybrid composition documented and lattice-monoculture as the binding cap.

inLinkedIn ↷Audit access ⇆Compare Verified 2026-05-01

Summary

Algorand is the only chain in the 67-chain v3.1.0 evaluation with post-quantum signing in mainnet production. State Proofs (Falcon-1024, since 2022, 140K+ certificates) and Falcon LogicSig accounts (live since 2025-11-03 via consensus v41) provide real shipped substance. The Mainnet-Traffic cap fires (5a < 0.01% of signing traffic), the Cryptographic-Diversity cap fires (lattice-monoculture: only Falcon, no hash-based or code-based fallback), and Gate 1a-Sig fails (parallel rather than hybrid composition). The Architecture-Execution Gap is 30 points (Dim 4 70 vs Dim 5 40). The native consensus Falcon module remains a 2026 roadmap item, with BFT aggregation-path the under-developed dimension. QRI 41, Band 5 Prototyped, the only Band-5 chain in the set.

What the gates say

Gate 1a, Hybrid signature: FAIL , parallel, not hybrid, Falcon LogicSig accounts coexist with Ed25519 default; no AND/OR composition
Gate 1a, Hybrid KEM: FAIL , TLS uses RSA / X25519 ECDH; no ML-KEM hybrid for validator transport
Gate 1b, Commit-to-hash: COND , no OR-composition declared
Gate 2, Evidence reconstruction: PASS , every sub-score has ≥ 3 evidence sources; reconstructible in 48h
Gate 3, Primitive naming: PASS , every primitive named with mechanism

Burn-vs-rescue policy on file

Declared option f, Undeclared. Algorand Foundation has not published a formal position on dormant-balance handling. Implicit posture (inferred from Foundation messaging) favors optional migration via the Rekey primitive; no formal sunset date or rate-limit canary.

Seven dimensions

Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.

1 Cryptographic Exposure weight 15% 68 / 100

1a · primitive inventory 18 / 20

Algorand Foundation publicly inventories every primitive used at protocol level. One uncertainty: production status of Pixel multi-signatures versus BM-Ed25519 in the live consensus aggregation path is not fully documented.

Primitives: Ed25519 (block proposals, committee voting, default account signatures) · ECVRF (cryptographic sortition / committee selection) · BM-Ed25519 (forward-secure ephemeral consensus keys) · Pixel (pairing-based forward-secure multi-sig, BLS-Pixel construction) · Falcon-1024 / FN-DSA (State Proofs since 2022; LogicSig accounts since 2025) · SHA-512/256 (block hash, transaction hash) · Sumhash512 (zk-friendly hash inside State Proofs; AVM opcode 0x86 in v41) · BLS12-381 (State Proof participation; cross-chain interop)

1b · shor grover pq tag 16 / 20

Tags:

Ed25519 → Shor-break (DL on Edwards curve)
ECVRF → Shor-break (sortition history reconstructable post-Shor)
BM-Ed25519 → Shor-break (Ed25519-derived)
Pixel / BLS multi-sig → Shor-break-via-pairings (BLS12 family)
BLS12-381 → Shor-break-via-pairings
Falcon-1024 → PQ-safe (NIST FN-DSA, lattice over NTRU, Category 5)
SHA-512/256 → Grover-weaken (effective 128-bit security)
Sumhash512 → Grover-weaken (lattice/algebraic; novel construction, less mature classical analysis)

1c · family diversity 5 / 20

PQ-safe families represented: lattice only (Falcon-1024). No hash-based (SLH-DSA / XMSS / LMS) and no code-based (Classic McEliece / BIKE / HQC) PQ scheme deployed. Cryptographic-Diversity Cap fires.

1d · nist security category 16 / 20

Falcon-1024 → NIST Category 5 (256-bit classical equivalent), exceeds CNSA 2.0 minimum. SHA-512/256 → AES-128 effective post-Grover. Mainnet deployment is on Falcon-1024, not Falcon-512.

1e · implementation quality 13 / 20

Library provenance: algorand/falcon (Go wrapper) + algorandfoundation/falcon-signatures (CLI). Core C reference attributed to Thomas Pornin; deterministic-mode design by David Lazar and Chris Peikert. Constant-time coding practices claimed by Foundation (no third-party constant-time validation cited publicly). No machine-checked formal verification published. Cryptanalytic tier: Falcon Tier 3 (NIST PQC standardized); Sumhash512 Tier 4 (research-grade).

2 Quantum Recovery Exposure weight 10% 33 / 100

Forge subtotal: 24/75 Decrypt subtotal: 9/25

2a · active key exposure 6 / 25

Default accounts use Ed25519. Public keys are fully revealed on first transaction. > 99% of mainnet transaction volume signs under Ed25519. Foundation/Kiln staking concentration (~20% + ~20%) means a substantial share of staked-and-active value is on already-revealed pubkeys.

2b · cold key exposure 11 / 25

Mainnet launched 2019-06; ~83 months at evaluation date. Substantial dormant supply on Ed25519 pubkeys (genesis and early-distribution wallets). Rekey primitive enables migration without changing address, but cold balances by definition do not rotate.

2c · sig long term validity 7 / 25

All historical Ed25519 transaction signatures are forgeable post-Shor. State Proofs since 2022 sign block-header summaries with Falcon-1024, providing a quantum-resistant audit trail for state attestations but not for individual user transaction signatures. Pre-State-Proof history (2019–2022) has no PQ attestation layer.

2d · encryption confidentiality hndl 9 / 25

Validator gossip and RPC endpoints use standard TLS (RSA / ECDH X25519). No PQC KEM (e.g., ML-KEM / hybrid X25519+ML-KEM-768) integrated. The 'Sealed' xGov proposal (April 2026) is for app-layer ML-KEM-512 messaging, not validator transport.

3 Metadata, Anonymity & Confidentiality weight 13% 25 / 100

3a · tx graph visibility 5 / 20

Pseudonymous transparent ledger. Public addresses, public balances, public state. No native shielded transactions, no on-chain mixing.

3b · rpc mempool concentration 6 / 20

Top-3 RPC: Algonode, Nodely, Foundation public endpoints. Moderate concentration; precise share not publicly published. Mempool gossip observable to any participant. Validator metadata retention undeclared at protocol level.

3c · cross chain bridge correlation 7 / 20

Wormhole is the primary external bridge. State Proofs enable trustless cross-chain verification (one-way: Algorand → external chain). Source-to-destination linkability across bridges is high (transparent on both sides).

3d · retroactive de anonymization 7 / 20

Shor on the Edwards curve breaks ECVRF proofs, allowing retroactive reconstruction of sortition outcomes (which validator was selected when), revealing committee membership for past rounds. Foundation explicitly identifies VRF as a 'challenging research problem' requiring quantum-resistant replacement.

3e · mixnet shuffle 0 / 20

No on-chain mixer, no native commit-reveal shuffle, no integrated mixnet.

4 Migration Architecture weight 10% 70 / 100

4a · crypto agility 14 / 15

LogicSig accounts permit post-quantum signature verification (Falcon-1024) in production without a hard fork, Falcon LogicSig went live via consensus v41 (go-algorand 4.3.0, released 2025-09-16), adding falcon_verify opcode (0x85) and sumhash512 (0x86) to AVM v12. Coordinated consensus upgrades v34 → v41 over five years.

4b · aa key rotation 17 / 20

LogicSig accounts behave as native account abstraction. Rekey primitive permits any account to switch its authorizing key (including from Ed25519 to a Falcon LogicSig) without changing the address or moving funds. Active production volume exists since Nov 2025.

4c · hard fork track record 14 / 15

Coordinated protocol upgrades v34 through v41 over five years; no contested forks. Consensus v41 PQ upgrade (Sep 2025) shipped with smooth node-operator coordination.

4d · hybrid deployment readiness 10 / 15

Falcon LogicSig accounts coexist with Ed25519 default accounts on mainnet, de facto parallel-deployment hybrid at the protocol level (different accounts can choose either scheme; the same account does not co-sign with both). No documented Falcon AND Ed25519 OR-composition or AND-composition for the same signing event.

4e · stateful hash state management 15 / 15

Algorand uses Falcon (stateless lattice). No stateful hash scheme (XMSS, LMS, leanXMSS) at consensus or execution. Default 15/15 per v3.1 rule.

4f · bft aggregation path 0 / 20

Algorand consensus today aggregates committee votes via Ed25519 (BM-Ed25519 forward-secure ephemeral keys) and references Pixel multi-signature research for forward-secure BLS aggregation. Both are Shor-breakable. No PQ aggregation path declared, no spec, no testnet pilot. Native consensus Falcon module is on the 2026 roadmap; aggregation strategy is unpublished.

5 Deployment Execution weight 22% 40 / 100

5a · mainnet pqc traffic pct 1 / 25

Floor estimate < 0.01% of mainnet signing traffic is PQ. State Proofs (Falcon, 140K+ certificates over 3.5 years) sign every-256-rounds; Falcon LogicSig live 2025-11-03 with no public dashboard quantifying user-tx share. Mainnet-Traffic cap fires. Score 1/25 reflects: non-zero (Falcon LogicSig in production, State Proofs run continuously) but not Stage-3-traffic material.

5b · pqc code in consensus client 9 / 15

Falcon-verify opcode and sumhash512 opcode merged into go-algorand and shipped in v4.3.0-stable (consensus v41, 2025-09-16). State Proof signing (Falcon at protocol level) merged in 2022 (go-algorand 3.4.2). Native consensus Falcon module for block proposals/committee votes is on the 2026 roadmap, not yet in mainline.

5c · validator pqc key adoption 2 / 15

Validators run State Proof participation keys (Falcon) alongside Ed25519 consensus participation keys, required since go-algorand 3.4.2 (2022-03). Block proposals and committee votes themselves continue to be signed with Ed25519/BM-Ed25519. Score reflects partial adoption.

5d · published dated milestones 7 / 10

5a > 0, so 5d is NOT voided. Three milestones delivered with on-chain enforcement (State Proofs 2022, AVM v12 2025-09-16, first Falcon mainnet tx 2025-11-03); three 2026 milestones announced without precise dates (native consensus Falcon, Ledger firmware support, governance toggle).

5e · pqc washing delta 9 / 15

Shipped: State Proofs Falcon-1024 (2022 → ongoing), falcon_verify opcode (2025), Falcon LogicSig mainnet (2025-11-03), Falcon Signatures CLI, algorandfoundation/falcon-signatures repo. Announced: consensus Falcon, Ledger firmware, governance toggle (all 2026, no precise dates). Ratio (announced/shipped) ≈ 0.83, strong shipped substance, no deduction.

5f · signature footprint multiplier 12 / 20

Falcon-1024 signature ~1280 bytes vs Ed25519 64 bytes ≈ 20× raw multiplier. Algorand block design absorbs Falcon LogicSig at LogicSig-program-budget level without inflating block sizes for Ed25519-only blocks (Foundation states verification < 200μs, fits within program budget). Effective per-block multiplier on a hybrid block is well below 38× because most signatures remain Ed25519.

6 Supply Chain Vendor Readiness weight 22% 17 / 100

6a · wallet 5 / 25

Top-3 by Algorand-user share: Pera Wallet, Defly, Ledger HW. No top-3 wallet has published a Falcon roadmap. Pera has passkey integration via Liquid Auth (Web2 UX, not Falcon key management). Foundation states 'Ledger firmware for the larger keys' is on 2026 roadmap (Foundation roadmap item, not Ledger commitment).

6b · bridge 3 / 25

Top: Wormhole (primary external bridge), Algorand State Proofs (one-way light-client outbound). Wormhole has no public PQC roadmap. State Proofs are PQ-secure outbound (Falcon-signed) for trustless cross-chain verification, but inbound bridge surfaces remain classical.

6c · custodian 4 / 25

Top-3: Coinbase Custody, BitGo, Anchorage Digital, Fireblocks (all support Algorand). Coinbase published an institutional PQC position paper (2026-04-21) covering ecosystem PQC posture; no Coinbase Custody-specific Algorand migration timetable. BitGo and Anchorage have no published PQC roadmap traced.

6d · rpc hsm tee infra 5 / 25

Top-3 RPC: Algonode, Nodely, Foundation public endpoints. HSMs: validator setups use AWS KMS, YubiHSM, Thales, no Algorand-specific PQC HSM commitment. TEE attestation chains not in Algorand validator path. No PQC roadmap on any infra tile.

7 Governance & Coordination weight 8% 59 / 100

7a · validator stake distribution 12 / 20

Pure-PoS using VRF-based committee selection from total online stake. Stake distribution (March 2026): community 80.5%, Foundation 19.5%. Major concentrations include Foundation (~20%) and Kiln (~20%). Nakamoto-style 33% threshold reached by ~2 entities in worst-case stake clustering.

7b · upgrade cadence under pressure 17 / 20

Smooth coordinated upgrades v34 → v41 over five years. xGov on-chain grants platform launched mainnet October 2025. State Proofs upgrade (2022) and PQ-prep upgrade (v41, 2025) shipped to schedule. No contested forks.

7c · named coordination lead 18 / 20

Algorand Foundation publicly named as coordination lead. Cryptography team includes Chris Peikert (head of cryptography, lattice researcher) and Vinod Vaikuntanathan (scientific advisor, MIT faculty). Silvio Micali (founder, Turing Award) sets long-term cryptographic direction.

7d · adversarial coordination precedent 12 / 20

No adversarial-pressure coordination event in Algorand's history. Proactive PQ shipping (State Proofs 2022, AVM Falcon 2025) is a positive signal but not a true adversarial test.

7e · canary tripwire mechanism 0 / 20

No published rate-limit canary, no cryptographic tripwire embedded in consensus, no Hourglass-equivalent mechanism, no community honeypot for forge detection.

X + Y vs Z, when does the math turn against you?

v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?

X, signature shelf life

5–15 years

Y, migration time

5–8 years to Stage 5

Z10 (10% CRQC year)

2030

Z25 (25% CRQC year)

2035

Verdict

X+Y reaches 2031–2041, Crisis Zone (vs Z10 2030); partial Outside risk window (vs Z25 2035)

Z-compliance

Partially outside NIST 2030 deprecation window (Ed25519 default remains classical)

Source-disagreement disclosure

v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.

State Proofs as 'consensus-level' PQ deployment

Some industry coverage treats Algorand's State Proofs (Falcon-signed certificates every 256 rounds) as consensus-level PQ adoption. This evaluation separates State Proofs (a consensus-adjacent protocol-level certificate) from consensus signing itself (block proposals + committee voting + sortition VRF, which remain classical Ed25519/ECVRF).

Delta-QRI under alternative weighting

Under the alternative-weighting that treats State Proofs as consensus-PQ adoption, sub-scores 5b and 5c rise (5b → 12, 5c → 6) producing QRI ≈ 44. Mainnet-Traffic and Cryptographic-Diversity caps still bind at 60.