What it is. Cardano has put out an unusually candid public plan to defend itself against future quantum computers, including the speed cost it expects to pay, even though none of that protection has been built into the live network yet.
What we found. Its track record of upgrading smoothly and getting the community to agree is the best among the large networks we looked at, but the gap between the plan and any working code is the thing holding it back.
Why it matters. A network can show off a great plan and still leave coins exposed, so what protects a holder is finished work on the live chain, not a roadmap or past upgrade wins.
Cardano publishes a 3-phase PQ roadmap (Project Nightstream with Linux Foundation Decentralized Trust / Google Cloud / Microsoft Research) and a 5-10× performance penalty before shipping a line of PQ code. The Hard Fork Combinator + Voltaire / CIP-1694 governance give the migration the strongest coordination machinery in the L1 sample. PR #441 and Issue #413 (PQ-signature CIPs) are both closed without merge, the architecture-level CIP track is not yet active.
Summary
Cardano scores QRI 32, Band 3 Planning, Migration Stage 1. Mainnet signing is Ed25519 with KES Sum6Kes (MMM iterated-sum forward-secure construction) at the block-producer layer; addresses use BLAKE2b-224 hashes of payment keys (CIP-19). Praos VRF (Edwards25519-based) and Mithril BLS12-381 stake-aggregate signatures complete the consensus stack. Every active primitive is Shor-broken (DL or pairing) or Grover-weakened. BLAKE2b-224's 112-bit Grover floor is already below NIST 2030 deprecation. Zero PQ primitives ship on mainnet today. Gate 1a-Sig FAIL and Gate 1a-KEM FAIL each impose QRI ≤ 60; mainnet-traffic cap binds first at 5a=0%. Architecture-Execution Gap is 65 (Dim 4 73 − Dim 5 8). The roadmap is unusual for being honest: the named coordination lead publishes a phased plan and explicit performance trade-offs before shipping. Project Nightstream (Feb 2026) targets a lattice-based proof-chain via Mithril; no shipped consensus-client code. Voltaire / CIP-1694 governance and the Hard Fork Combinator give the migration path the strongest coordination machinery in the L1 sample. Execution gap is the binding constraint.
What the gates say
- Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition AND/OR with commit-to-hash; mainnet signing is Ed25519-only
- Gate 1a, Hybrid KEM: FAIL , no documented hybrid KEM at validator gossip / RPC TLS layer; standard X25519 / classical TLS
- Gate 1b, Commit-to-hash: COND , no OR-composition exists
- Gate 2, Evidence reconstruction: PASS , every sub-score has ≥3 named artifacts
- Gate 3, Primitive naming: PASS , every sub-score names primitives with mechanism
Burn-vs-rescue policy on file
Declared option f, Undeclared. Cardano's own burn-vs-rescue option for unmoved / lost ADA at quantum-vulnerable addresses has not been formally declared. The named coordination lead's public position on Bitcoin BIP-360 argues that ZK-recovery cannot save pre-BIP-39 coins and that any practical PQ migration is a hard fork, that position is about Bitcoin, not Cardano. Architecturally, the Hard Fork Combinator + tripartite governance enables any of (a-f) but no on-chain action has been taken.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 15% 49 / 100
Foundation docs name every active primitive with mechanism. CIP-381 added Plutus pairing operations over BLS12-381 (Chang #1 hard fork). Mithril uses BLS12-381 stake-based threshold multi-signatures.
Ed25519 (EdDSA over Edwards25519, SHA-512), account-level transactions · KES Sum6Kes (MMM iterated-sum forward-secure construction) with Ed25519 at depth zero, block-producer signing · Praos VRF (Ouroboros Praos VRF with unpredictability under malicious key generation), slot leadership · BLAKE2b-256 (tx IDs, block hashes) · BLAKE2b-224 (Shelley address derivation, payment/stake key hashes, script hashes per CIP-19) · BLS12-381 (CIP-381 Plutus pairing operations; Mithril stake-based threshold multi-signatures) PQ-safe primitives: zero on mainnet today.
Ed25519 (account sigs)→ Shor-break-via-DL-without-pairingsKES Sum6Kes / Ed25519 at depth zero (block-producer)→ Shor-break-via-DL-without-pairings (forward-secure rotation limits forge window to ≤90 days per key generation)Praos VRF (Ed25519 curve)→ Shor-break-via-DL-without-pairingsBLS12-381 (CIP-381 Plutus, Mithril aggregation)→ Shor-break-via-pairingsBLAKE2b-256→ Grover-weaken (256→128-bit)BLAKE2b-224→ Grover-weaken (224→112-bit, below NIST 2030 deprecation floor)SHA-512 (inside Ed25519)→ Grover-weaken (512→256-bit)
0 PQ families on mainnet. All consensus, signing, and Mithril aggregation primitives are classical EC / pairing-based. KES is forward-secure but built on Ed25519. Hash family (BLAKE2b) present but Grover-weakened.
Classical primitives map to legacy NIST levels (Ed25519 ≈ 128-bit pre-quantum, BLAKE2b-224 ≈ 112-bit pre-quantum below FIPS 2030 deprecation floor). No FIPS 203/204/205/206 primitive is deployed.
Ed25519 via libsodium / ed25519-dalek with strict verification. KES Sum6Kes is a Rust implementation of MMM iterated-sum forward-secure construction; key-evolution interval ~36 hours (Sum6 = 2^7 = 128 evolutions over the 90-day operational-cert validity). Ouroboros Praos / Genesis are peer-reviewed (IACR 2017/573). KES is stateful by design, key-evolution is mandated at the protocol level via operational certificates.
2 Quantum Recovery Exposure weight 10% 46 / 100
Cardano uses Shelley addresses where payment credentials are BLAKE2b-224 hashes of Ed25519 verification keys (CIP-19). Pubkeys are NOT revealed until first spend, similar to Bitcoin P2PKH but with hash truncated to 224 bits. Once spent, the Ed25519 pubkey is exposed on-chain in the witness; subsequent funds at the same address are quantum-vulnerable. eUTXO model encourages address rotation but does not enforce it. KES rotation does not protect account keys, only block-producer keys.
Mainnet since 2017-09-29 (Byron). Long dormancy tail. Byron-era addresses use legacy double-hash (SHA3-256 then BLAKE2b-224) which still hides pubkey pre-spend. Founder allocations and ICO-era unmoved UTXOs exist. BLAKE2b-224 truncation provides 112-bit Grover floor, below NIST 2030 deprecation level.
Historical Ed25519 signatures in spent transactions are forgeable post-Shor in principle, but the chain's append-only consensus prevents retroactive substitution. Block-producer KES forward-security limits the window where a compromised KES key can be used to backdate blocks (≤ ~90 days per operational cert). Account-level Ed25519 signatures are not forward-secure.
Node-to-node Ouroboros gossip uses TLS for the network mux layer; standard X25519 / Ed25519 / classical TLS on validator and relay infrastructure. RPC providers (Blockfrost, Koios, Maestro) terminate TLS classically. No documented hybrid KEM deployment in cardano-node. HNDL surface is bounded, block contents are public, but validator gossip metadata, mempool relay, and operator-side keys held under classical TLS-protected sessions are HNDL-exposed.
3 Metadata, Anonymity & Confidentiality weight 13% 36 / 100
Pseudonymous on the eUTXO mainnet. Stake addresses tie payment credentials to the same staking key, increasing graph linkability above pure UTXO chains. Midnight (privacy-focused partner chain) launched federated mainnet late March 2026 using ZK-SNARKs and selective disclosure but is a separate chain, not the Cardano L1 ledger.
~3,000 active SPOs (Mithril stake registration shows registered stake at 22% of network as of August 2025, with 82.9% of SPOs on recent client versions). Many SPOs run self-hosted nodes. RPC layer (Blockfrost, Koios, Maestro, Demeter) more concentrated. Mempool gossip fully observable.
Cardano has historically had limited bridge surface (Wanchain, Milkomeda EVM sidechain). LayerZero integration was announced for 2026. Smaller bridge footprint than Ethereum / Solana lowers passive-observer correlation surface.
Ed25519 (Edwards25519) and Praos VRF are Shor-broken; once a payment key has signed, the pubkey is on-chain. BLAKE2b-224 hash limits pre-spend exposure. No on-chain encryption of payloads on the Cardano L1 (Midnight is separate).
No on-chain mixer or cryptographic shuffle in cardano-node. No CoinJoin equivalent in eUTXO mainnet.
4 Migration Architecture weight 10% 73 / 100
Hard Fork Combinator (HFC) is documented in the Cardano consensus layer and has shipped 5+ era transitions (Byron→Shelley 2020-07, Allegra/Mary 2020-12/2021-03, Alonzo 2021-09, Vasil 2022-09, Chang #1 2024-09 enacting CIP-1694, Plomin/Voltaire enactment Q1 2026). Algorithm-level swap (e.g., adding ML-DSA alongside Ed25519) has not been demonstrated; the HFC swaps eras, not primitives, and CIP-381 added pairing primitives at the Plutus VM level rather than at the consensus signing layer.
KES key rotation is native (operational certificates rotated each KES period, ~36 hours). No native account abstraction equivalent to ERC-4337 / EIP-7702. eUTXO scripts (Plutus V1/V2/V3) provide programmable spending logic at the script-address level, which gives some AA-flavored flexibility, but is not a documented client-layer PQC migration path.
5+ coordinated hard forks in 5 years with no contested forks, no chain split, no rollback. Voltaire / CIP-1694 enacted on schedule under three-stakeholder coordination (DReps, Constitutional Committee, SPOs). Updated Constitution ratified with 79% of active voting stake.
The publicly-stated migration architecture is hybrid by design, a post-quantum proof chain (extension of Mithril) is intended to checkpoint the classical L1 with PQ signatures, with full chain merge planned long-term. Architecturally possible. Spec-level documentation is at framework / livestream level; no merged CIP. PR #441 and Issue #413 on cardano-foundation/CIPs are both closed without merge.
Cardano's only stateful signing primitive is KES Sum6Kes, used at the block-producer layer. State management is enforced at the protocol level via operational certificates with bounded KES periods (typical 90-day operational-cert validity, 36-hour evolution). The 15/15 is awarded for KES discipline, not for PQ stateful-hash deployment.
N/A. Ouroboros Praos uses non-aggregating Ed25519-based KES at the block-producer layer; chains using non-aggregating signatures at consensus are out-of-scope for 4f. Mithril uses BLS12-381 threshold-aggregate signatures, but Mithril is a checkpoint / certificate layer, not the Cardano consensus signing layer.
5 Deployment Execution weight 22% 8 / 100
0%. No PQ primitive signs Cardano L1 transactions, blocks, or VRF outputs.
cardano-node and cardano-base contain no PQ signature implementation. The kes repository implements MMM forward-secure Ed25519, not PQ. Mithril repo contains BLS12-381 (Shor-broken via pairings) for stake aggregation, not PQ. Project Nightstream (collaboration with Google / Microsoft Research) was announced February 2026 as a research effort to replace classical ZK-SNARKs with lattice-based proofs; no shipped consensus-client code.
Zero SPOs use PQ keys. KES + Ed25519 only.
VOIDED to 0 if 5a = 0 per v3.1. The 3-phase livestream timeline (research agenda 2025-2026; 2-3 years proof chain; 3+ years merge) names phases but no enforcement-mechanism-backed flag-day, no CIP with hard-fork activation epoch, no sunset date for Ed25519 / VRF.
Announced PQ items in trailing 12 months: Project Nightstream (Feb 2026 announcement), Post-Quantum Cardano livestream + 3-phase roadmap, Mithril proof-chain framing as the PQ checkpoint mechanism, FIPS 203-206 alignment statements, multiple Bitcoin / BIP-360 commentary appearances. Shipped PQ on mainnet: 0. Ratio is high (≥3 announced / 0 shipped). Announcement quality is unusually disciplined, explicit publication of 5-10× performance penalty without hardware acceleration before shipping.
Undisclosed at chain-spec level. No published Cardano-specific bytes-per-block-under-PQ analysis.
6 Supply Chain Vendor Readiness weight 22% 10 / 100
Top-3 wallets: Lace by IOG, Eternl, Yoroi by EMURGO; Daedalus is desktop full-node, also IOG. PQ roadmap: 0 of top-3 publish a PQC roadmap. Ledger / Trezor used as Cardano hardware wallets and have no shipped PQ Cardano firmware.
Relevant bridges: Wanchain, Milkomeda (EVM sidechain), LayerZero (announced integration 2026). None publishes a PQ roadmap covering Cardano bridge endpoints.
Cardano-supporting custodians include Coinbase Custody, Anchorage, Kraken Institutional, BitGo. Coinbase Custody has issued general PQC-awareness statements at the parent-company level (institutional research note); no Cardano-specific PQ migration path.
RPC: Blockfrost, Koios, Maestro, Demeter, none publishes PQ TLS or hybrid KEM termination. HSM: stake-pool operators commonly use YubiHSM / Ledger HW for cold keys; no PQ HSM integration documented for Cardano. TEE: not part of Cardano consensus.
7 Governance & Coordination weight 8% 57 / 100
~3,000 active SPOs; client diversity is single-implementation (cardano-node Haskell). Nakamoto coefficient is among the highest in major L1s (publicly cited 25-50 range). Single-client risk balances strong stake distribution.
Five+ coordinated hard forks in 2020-2026 with no rollbacks; CIP-1694 / Voltaire transition completed on schedule; new Constitution ratified by 79% of active DRep stake.
Intersect MBO (member-based organization, formed 2024), IOG (Charles Hoskinson), Cardano Foundation, EMURGO. Voltaire-era tripartite governance: DReps + Constitutional Committee (7-member, community-elected after interim) + SPOs. The named coordination lead has personally fronted the PQ roadmap publicly.
Voltaire transition is a precedent for coordinated change at scale. No precedent of coordinating crypto migration under an active attacker.
No documented canary, honeypot, rate-limited spending rule, or cryptographic tripwire embedded in Cardano consensus.
X + Y vs Z, when does the math turn against you?
v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?
Verdict
X+Y > 2035 in essentially all plausible paths, Outside risk window vs Z25; Crisis Zone vs Z10
Z-compliance
Outside compliance window, BLAKE2b-224 (112-bit Grover floor) below the 2030 deprecation line; all Ed25519 / VRF usage below the 2035 disallowance line
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
Cardano's proof-chain via Mithril uses BLS12-381 today (Shor-broken via pairings); the framework sees BLS as a substrate to be later upgraded with PQ co-signing. An alternative reading is that any chain whose checkpoint substrate is Shor-vulnerable should be scored as having no checkpoint protection at all.
Delta-QRI under alternative weighting
Under the alternative reading on Mithril substrate, 4d would drop from 9 to 4, lowering Dim 4 normalized score to ~67 and raw QRI from 32 to ~31. ±1 around the central 32.
Announcement-to-shipped ratio
Announced: 6. Shipped: 0. Ratio: 6.
Tag: >1.5 deduction
Peers in the L1 profile
9 chains closest to Cardano by Stage then QRI.