FILECOIN · L1 · STAGE 0 UNAWARE/UNANNOUNCED · QRI 17 v3.1.0 methodology

In plain terms

What it is. Filecoin is a network where independent providers get paid to store other people's data and keep proving they still hold it, and the math behind those storage proofs is the same kind a future quantum computer could break.

What we found. The proof that a provider is really storing your data leans on the same vulnerable math as the keys, so a quantum fix here means rebuilding the storage-proof machinery itself, and no one running the network has published a plan or even named someone to lead one.

Why it matters. Storage deals run for years and every past proof of storage stays on the network forever, so once that math can be broken those records could be faked and there would be no honest way to re-check what was ever stored.

Groth16 over BLS12-381 is not a peripheral signature scheme on Filecoin, it is the primitive that makes a sealed sector a sealed sector. Block signatures, drand randomness, account signatures, sector seal proofs (PoRep/PoSt), and SnarkPack proof aggregation all run on the same pairing-based stack. Replacing it requires a full sealing-pipeline rewrite, not a flag-flip. No FIP, no foundation blog, no Protocol Labs research output addresses post-quantum migration.

inLinkedIn ↷Audit access ⇆Compare Verified 2026-05-01

Summary

Filecoin runs an entirely pairing-based stack: BLS12-381 for block leader signatures (f3 addresses) and consensus, drand threshold BLS12-381 G1 for leader-election randomness, secp256k1 ECDSA for f1 addresses, and Groth16 over BLS12-381 for the sector seal proofs (Stacked-DRG PoRep + Window/Winning PoSt). SnarkPack aggregates Groth16 via Inner-Pairing-Product over BLS12-381. FIP-0105 (NV27, 2025-09-24) added EIP-2537 BLS12-381 precompiles to FVM, deepening the pairing commitment. libp2p transport uses Noise or TLS 1.3 with classical X25519/Ed25519. Mainnet PQC traffic 0%. Forge subtotal 12/75; Decrypt subtotal 5/25. Gate 1a-Sig FAIL, Gate 1a-KEM FAIL. Filecoin Foundation and Protocol Labs have published no FIP addressing post-quantum migration; CryptoNet research group has prior PQ-related grants but no FIP output. The structural problem is that a Shor break against BLS12-381 invalidates not only signatures but the soundness of every sector seal proof on chain. X+Y estimate 16–29 years places Filecoin outside the 2035 risk window. QRI 17, Band 2 Acknowledged (substantively pre-acknowledgement).

What the gates say

Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition; f1 and f3 are alternative not composed; both classical
Gate 1a, Hybrid KEM: FAIL , libp2p transport uses classical X25519/Curve25519 with no hybrid PQ KEM; validator gossip, RPC, mempool in scope
Gate 1b, Commit-to-hash: COND , no OR-composition declared
Gate 2, Evidence reconstruction: PASS , for 6 of 7 dims; sub-score 1d voided (no PQ artifacts to reconstruct
Gate 3, Primitive naming: PASS , BLS12-381 G1+G2, Groth16, SnarkPack Inner-Pairing-Product, drand threshold BLS, secp256k1 ECDSA, Poseidon, Blake2b-256, Curve25519/X25519, Ed25519 named with mechanism

Burn-vs-rescue policy on file

Declared option f, Undeclared. No public position from Filecoin Foundation or Protocol Labs on classical-key freezing, STARK-based rescue of historical sealed sectors, hybrid client-layer migration, rate-limited canary, or optional migration. The Filecoin-specific analogue, what happens to sealed sectors whose Groth16 proofs are post-Shor forgeable, is not addressed in any FIP, blog, or research output.

Seven dimensions

Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.

1 Cryptographic Exposure weight 15% 26 / 100

1a · primitive inventory 16 / 20

spec.filecoin.io documents the active primitives end-to-end with mechanism. Inventory complete and reconstructible.

Primitives: BLS12-381 (block leader signatures, f3 addresses; G1 pubkeys, G2 signatures) · secp256k1 ECDSA (f1 user addresses) · drand threshold BLS over BLS12-381 G1 (leader-election randomness, hash-to-curve v7 RFC, Blake2b-256) · Groth16 over BLS12-381 (Stacked-DRG PoRep, Window/Winning PoSt) · Poseidon over BLS12-381 scalar field (widths t=3/5/9/12) · SHA-254 (truncated SHA-256, BinTrees in PoRep) · SnarkPack Inner-Pairing-Product over BLS12-381 (Groth16 aggregation) · EIP-2537 BLS12-381 precompiles (FVM, FIP-0105 NV27 2025-09-24) · libp2p Noise / TLS 1.3 with X25519 / Ed25519 / Curve25519 (transport)

1b · shor grover pq tag 4 / 20

Tags:

BLS12-381 G1+G2 (consensus, account signing, drand) → Shor-break-via-pairings
Groth16 over BLS12-381 (PoRep, Winning PoSt, Window PoSt) → Shor-break-via-pairings
SnarkPack Inner-Pairing-Product over BLS12-381 → Shor-break-via-pairings
secp256k1 ECDSA → Shor-break-via-DL-without-pairings
libp2p X25519/Ed25519 → Shor-break-via-DL-without-pairings
Blake2b-256 → Grover-weaken (256→128-bit)
Poseidon → Grover-weaken with research-tier cryptanalytic maturity
SHA-254 → Grover-weaken

1c · family diversity 0 / 20

Zero PQ-safe families. All deployed primitives are classical (pairing-DL, plain DL, classical hashes).

1d · nist security category 0 / 20

VOIDED (no PQ primitive deployed mainnet maps to a NIST PQC category).

1e · implementation quality 6 / 20

rust-fil-proofs, blstrs/bls12_381, bellperson, Protocol Labs maintained, audited (Trail of Bits historic SDR audit cited in spec). No machine-checked PQ proofs in lotus, venus, or rust-fil-proofs. Stateless. Cryptanalytic tier 1 for ECDSA/SHA, tier 2 for Blake2b, tier 4 for Poseidon.

2 Quantum Recovery Exposure weight 10% 17 / 100

Forge subtotal: 12/75 Decrypt subtotal: 5/25

2a · active key exposure 4 / 25

Storage providers sign Window PoSt approximately every 24 hours per sector partition; block leaders sign every epoch (30s). All BLS12-381 G1 public keys are on-chain and derivable from f3 addresses; secp256k1 public keys are revealed on first spend from f1 addresses. Active TVL exposure spans the entire ~$1.4–2B FIL market cap.

2b · cold key exposure 6 / 25

54 months mainnet (genesis 2020-10-15). f1 addresses hide pubkey until first spend; f3 (BLS) addresses commit-to-pubkey directly (no hash wrapper), so cold f3 funds are pubkey-exposed even before spending. No coin-burn or sunset mechanism declared.

2c · sig long term validity 2 / 25

Every historical Filecoin block, Window PoSt, Winning PoSt, PreCommit/ProveCommit, and drand round is a BLS12-381 or Groth16-BLS12-381 artifact. Post-Shor, an attacker can forge historical sector proofs and re-derive sealed sector data attestations; chain history is structurally non-reauditable in a post-CRQC world without re-proving under PQ-safe schemes.

2d · encryption confidentiality hndl 5 / 25

libp2p transport (TLS 1.3 with X25519, or Noise XX with Curve25519) carries validator gossip, RPC traffic, and provider-client data deals. No hybrid PQ KEM deployed. Client-side data encryption is application-layer responsibility, typically AES-256 with classical KEM, HNDL-vulnerable for sealed but encrypted client data.

3 Metadata, Anonymity & Confidentiality weight 13% 20 / 100

3a · tx graph visibility 2 / 20

Pseudonymous and fully transparent. All deals (provider, client, piece CID, size, duration, price) are on-chain and queryable via filfox.info, glif.io, beryx.io. Provider-to-client mapping is public by construction.

3b · rpc mempool concentration 6 / 20

Top public RPC endpoints concentrate via Glif (api.node.glif.io), Ankr, ChainStack, and Infura (FVM-only). drand beacon distribution is multi-relay. Mempool (mpool) is gossiped via libp2p pubsub. Validator metadata retention not declared.

3c · cross chain bridge correlation 5 / 20

Two production bridges to/from Filecoin: Axelar and Celer cBridge. Cross-chain flows from Polygon, Ethereum, BNB, Avalanche correlate Filecoin addresses with EVM addresses. FVM (EVM-equivalent runtime) launched 2023-03-14.

3d · retroactive de anonymization 3 / 20

Post-Shor, every historical signing key (BLS12-381 and secp256k1) is recoverable from on-chain pubkeys. Sealed sector PoRep proofs reveal which provider sealed which piece CID; combined with deal records, this exposes the full provider↔client↔data graph forever.

3e · mixnet shuffle 0 / 20

L1 profile uses 4 sub-scores for Dim 3; this entry not scored.

4 Migration Architecture weight 10% 37 / 100

4a · crypto agility 6 / 15

FIP process has shipped 100+ network upgrades and added new precompiles (FIP-0105 BLS12-381 in NV27, 2025-09-24). Address types f1/f3 allow signature-scheme distinction at the wallet boundary, but Groth16-BLS12-381 is hard-coded into PoRep/PoSt circuits and SnarkPack. A PQ-safe replacement for sector seal proofs would require replacing the entire sealing pipeline. No spec FIP exists.

4b · aa key rotation 4 / 20

No native account abstraction at the protocol layer comparable to ERC-4337 / EIP-7702. f4 actor addresses (FIP-0048) bind FVM smart-contract accounts; users can deploy multisig or smart-contract accounts on FVM, which provides app-level rotation but not protocol-level signature-scheme upgrade for f1/f3 EOA accounts.

4c · hard fork track record 12 / 15

Filecoin has executed 27 numbered network upgrades since genesis (NV0 → NV27, 2020-10 to 2025-09). FIP-0086 introduced F3 Fast Finality. FIP-0100 changed sector economics. Coordination via core-devs meetings and weekly governance updates is documented and consistent.

4d · hybrid deployment readiness 0 / 15

No hybrid signature, hybrid KEM, or hybrid SNARK deployment announced or specced.

4e · stateful hash state management 15 / 15

Default for stateless. No stateful-hash scheme deployed; no XMSS/LMS/leanXMSS in the stack.

4f · bft aggregation path 0 / 20

Filecoin Expected Consensus (EC) uses BLS12-381 for block signatures and drand uses threshold BLS12-381 for randomness. F3 Fast Finality (FIP-0086) layers a GossiPBFT-style finality gadget on top, also using BLS aggregation. No PQ aggregation path declared, specced, or piloted.

5 Deployment Execution weight 22% 15 / 100

5a · mainnet pqc traffic pct 0 / 25

0%. Zero PQ-safe primitives sign mainnet bytes.

5b · pqc code in consensus client 0 / 15

lotus, venus, and forest clients ship classical primitives only. No ML-DSA, SLH-DSA, ML-KEM, Falcon, FRI/STARK, or any NIST PQC primitive code path merged into mainnet client release branches.

5c · validator pqc key adoption 0 / 15

Every block leader and storage provider signs with BLS12-381 (and/or secp256k1). 0% of stake or storage power uses PQ keys.

5d · published dated milestones 0 / 10

VOIDED (5a = 0). No named, dated, enforcement-mechanism-backed PQ milestones.

5e · pqc washing delta 15 / 15

Announced PQC trailing 12 months = 0; shipped PQC = 0; ratio undefined → no washing tag. Foundation has not made marketing claims of PQ readiness.

5f · signature footprint multiplier 0 / 20

No PQ signature scheme deployed; multiplier undisclosed. Reference: ML-DSA-44 ~38× over BLS12-381 G2; SLH-DSA-128s ~110–125×, significant for a chain whose 2M+ daily Groth16 proofs and per-epoch BLS aggregations dominate block bandwidth.

6 Supply Chain Vendor Readiness weight 22% 2 / 100

6a · wallet 0 / 25

Top-3 by Filecoin user share: Ledger (hardware), Glif (web multisig + Vault), MetaMask (FVM only, does not support native f1/f3 addresses, Snap-mediated). None publish a PQC roadmap for Filecoin signing primitives.

6b · bridge 0 / 25

Top-2 production bridges Axelar and Celer cBridge. No PQC roadmap from either covering Filecoin endpoints.

6c · custodian 0 / 25

Top-3 by FIL holdings: Coinbase Custody, Anchorage, Fireblocks. None publish FIL-specific PQ key custody roadmap.

6d · rpc hsm tee infra 2 / 25

RPC (Glif api.node.glif.io, Ankr, ChainStack), no PQ TLS commitment. HSMs in storage-provider operations vary (commodity Linux, AWS KMS, occasional Thales/YubiHSM); no documented PQ-key support for BLS12-381 signing keys. TEE attestation not part of consensus.

7 Governance & Coordination weight 8% 40 / 100

7a · validator stake distribution 12 / 20

Q3 2025 ~3,000 active storage providers with measurable storage power; capacity 3.0 EiB. Storage power Nakamoto coefficient is mid-range. Client diversity: lotus (Go, primary), venus (Go), forest (Rust).

7b · upgrade cadence under pressure 14 / 20

27 numbered upgrades NV0→NV27 (2020-10 to 2025-09-24) executed without contested forks. Multiple FIPs have been delayed or revised, but coordination process (core-devs, weekly governance updates) holds.

7c · named coordination lead 8 / 20

Filecoin Foundation (CEO Marta Belcher) and Protocol Labs are the named coordinating organizations; FIP editors documented in repo. No PQ-migration named lead, no PQ working group chartered.

7d · adversarial coordination precedent 6 / 20

FIP-0036 base-fee revision (2022) and FIP-0100 economics changes (2025) coordinated under provider economic pressure, not under cryptographic-attack pressure. No precedent for coordinated cryptographic primitive replacement under active attack.

7e · canary tripwire mechanism 0 / 20

No quantum canary, no rate-limited spending rule, no cryptographic tripwire.

X + Y vs Z, when does the math turn against you?

v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?

X, signature shelf life

8–15 years (storage deal commitments multi-year; historical PoRep/PoSt artifacts on-chain forever; sealed-sector keys outlive any individual deal)

Y, migration time

8–14 years (replacing Groth16-BLS12-381 sector seal proofs with FRI/STARK or lattice-SNARK PoRep is a full sealing-pipeline rewrite; no work has begun)

Z10 (10% CRQC year)

2030

Z25 (25% CRQC year)

2035

Verdict

X+Y range ≥16 years (2042+), Crisis Zone (vs Z10 2030); Outside risk window (vs Z25 2035)

Z-compliance

Outside compliance window (X+Y → 2042 vs NIST 2035 disallowance)

Source-disagreement disclosure

v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.

Storage provider count

Filecoin Foundation/Messari Q3 2025 cites ~3,000 active SPs; some 2024-era citations and explorer aggregates report 3,800–3,900 (including inactive). We use ~3,000 active for active-key exposure, ~3,900 cumulative for historical-key surface.

Network capacity

Q1 2025 ~3.8 EiB → Q3 2025 ~3.0 EiB committed. v2 baseline cited '14+ EiB', that figure tracks raw bytes onboarded over the network's lifetime, not currently committed. We use Q3 2025 committed (~3.0 EiB) for current exposure math.

Delta-QRI under alternative weighting

If Dim 6 (supply chain) is reduced from 22% to 15% and the 7% reallocated to Dim 7 (governance), raw QRI moves to ~21 (Band 3 Planning floor). Pre-Acknowledgement substantively under any reasonable reweighting.