INTERNET COMPUTER (ICP) · L1 · STAGE 1 ACKNOWLEDGED + R&D COMMITMENT · QRI 25 v3.1.0 methodology

In plain terms

What it is. Internet Computer holds a wider mix of signing methods than most chains, and runs the wrapped Bitcoin, Ethereum and dollar coins that people hold on it, yet none of it is protected against a quantum computer.

What we found. A handful of nodes share one secret key for a whole zone, so cracking that single key would let an attacker fake every transaction that zone ever signed and seize the wrapped reserves it guards; the team has promised research since 2021 but has shipped no protection to its live network.

Why it matters. Money you parked years ago and money moving today sit behind the same breakable lock, and a strong promise to act later is not the same as a working defence once that lock can be picked.

ICP's cryptographic stack is broader than most L1s, BLS12-381 threshold signatures at consensus, threshold ECDSA secp256k1 for ckBTC custody, threshold Schnorr (BIP-340 + Ed25519), canister signatures, and BLS-IBE vetKD encrypted-key delivery. Every primitive is Shor-vulnerable; one subnet's BLS12-381 key compromise forges every signature that subnet ever issued, including chain-key custody of ckBTC/ckETH/ckUSDC reserves.

inLinkedIn ↷Audit access ⇆Compare Verified 2026-05-01

Summary

ICP runs every signing primitive on Shor-vulnerable curves: BLS12-381 (subnet consensus, NNS root key, vetKD, canister signatures), threshold ECDSA secp256k1 (ckBTC/ckETH custody), threshold Schnorr (BIP-340 + Ed25519 GA Sep 2024), and WebAuthn passkeys (P-256, EdDSA) at Internet Identity. Mainnet PQC traffic 0%. Threshold-key compromise has higher blast radius than per-user-key compromise: post-Shor recovery of one subnet's BLS12-381 secret-shared key forges every signature that subnet ever issued. vetKD is the singular novel HNDL surface, encrypted keys delivered via BLS-IBE-style mechanism over BLS12-381 G2 are decryptable post-Shor. Proposal 35660 (Dec 2021, adopted by NNS) committed DFINITY to long-term PQ research with named research leads; Camenisch (Dec 2024) reaffirmed crypto-agility commitment with pubkey-replacement plan. No spec, no testnet, no mainnet PQ deployment. NNS-coordinated upgrade capability is strong (4c 13/15). Gate 1a-Sig FAIL, Gate 1a-KEM FAIL. QRI 25, Band 3 Planning, Migration Stage 1.

What the gates say

Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition at consensus, threshold-signing, or II layer; all primitives pure classical
Gate 1a, Hybrid KEM: FAIL , vetKD encrypted-key delivery uses BLS-IBE over BLS12-381 with no hybrid KEM; boundary-node TLS uses classical X25519 / RSA
Gate 1b, Commit-to-hash: COND , no OR-composition deployed
Gate 2, Evidence reconstruction: PASS , every sub-score backed by ≥3 public artifacts; reconstructible in 48 hours
Gate 3, Primitive naming: PASS , BLS12-381 G1/G2, secp256k1, BIP-340, Ed25519/EdDSA, ES256/P-256, SHA-256/224 named with mechanism

Burn-vs-rescue policy on file

Declared option f, Undeclared. No public DFINITY position on classical-vulnerable user accounts, chain-key custody of ckBTC/ckETH/ckUSDC reserves under post-Shor BLS12-381 break, or historical vetKD-encrypted state. NNS could in principle execute any of options (a)-(e) but has not published a policy.

Seven dimensions

Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.

1 Cryptographic Exposure weight 15% 36 / 100

1a · primitive inventory 16 / 20

Foundation docs name every primitive with mechanism. Subnet consensus, NNS root key, threshold canister signing, vetKD encrypted-key delivery, and user authentication are inventoried and reproducible.

Primitives: BLS12-381 G1 threshold signatures (subnet consensus, NNS root key) via NIDKG (Groth ePrint 2021/339) · Threshold ECDSA secp256k1 (key id (secp256k1, key_1), ckBTC/ckETH outbound) · Threshold Schnorr secp256k1 BIP-340, GA Sep 2024) · Threshold Schnorr Ed25519 (key id (ed25519, key_1), GA Sep 2024, FROST-style) · WebAuthn passkeys at Internet Identity (COSE ES256 / EdDSA) · Canister signatures (BLS12-381-derived) · vetKD over BLS12-381 G2 transport pubkeys · SHA-256, SHA-224 (II principal derivation)

1b · shor grover pq tag 9 / 20

Tags:

BLS12-381 (subnet/NNS, vetKD, canister signatures, NIDKG) → Shor-break-via-pairings
secp256k1 ECDSA (tECDSA, ckBTC/ckETH) → Shor-break-via-DL-without-pairings
secp256k1 BIP-340 Schnorr (tSchnorr) → Shor-break-via-DL-without-pairings
Ed25519 (tSchnorr, II session keys, node-to-node) → Shor-break-via-DL-without-pairings
WebAuthn ES256 (P-256) → Shor-break-via-DL-without-pairings
SHA-256 / SHA-224 → Grover-weaken (224→112-bit, below NIST 2030 floor)

1c · family diversity 0 / 20

Zero PQ families on mainnet. All consensus, threshold-signing, canister-signing, and authentication primitives are classical EC or pairing-based.

1d · nist security category 0 / 20

Classical primitives map to legacy NIST levels (~128-bit pre-quantum). No FIPS 203 (ML-KEM), 204 (ML-DSA), 205 (SLH-DSA), or draft 206 (FN-DSA) primitive deployed.

1e · implementation quality 11 / 20

ICP replica is implemented in Rust (dfinity/ic) by an in-house cryptography group. NIDKG construction published (ePrint 2021/339). Constant-time inherited from k256, ed25519-dalek, BLS12-381 crates. No published Formosa-Crypto / Libjade machine-checked proofs of the threshold protocols. Cryptanalytic maturity tier 1 (classical ECC) for tECDSA/tSchnorr; pairing-tier (custom NIDKG) for BLS12-381.

2 Quantum Recovery Exposure weight 10% 25 / 100

Forge subtotal: 20/75 Decrypt subtotal: 5/25

2a · active key exposure 7 / 25

ICP user accounts derive from Internet Identity passkeys via canister signatures (BLS12-381). NNS root keys, subnet public keys, canister signature anchors, and tECDSA key_1 pubkeys are exposed on-chain. ckBTC and ckETH controlling private keys are held in secret-shared form on tECDSA-enabled subnets, Shor-breaking secp256k1 OR breaking BLS12-381 exposes those custody keys.

2b · cold key exposure 8 / 25

Mainnet launched 2021-05-10. Four years of cold balances exist (genesis allocation, early-investor unlocks, dormant Internet Identity anchors). Subnet BLS12-381 keys are long-lived and re-shared rather than rotated to new pubkeys. Threshold ECDSA key_1 has been the production secp256k1 key since GA (Aug 2022) and has not been rotated.

2c · sig long term validity 5 / 25

Subnet BLS12-381 threshold signatures sign blocks, certified state, canister signatures, and chain-key tokens. These signatures cover long-term subnet assets (ckBTC, ckETH, ckUSDC reserves) and are forgeable post-Shor. tECDSA secp256k1 signatures issued for Bitcoin / Ethereum outbound transactions are forgeable post-Shor.

2d · encryption confidentiality hndl 5 / 25

Node-to-node replica gossip uses TLS for the network mux layer, with classical X25519 / Ed25519 / RSA. RPC providers (boundary nodes) terminate TLS classically. vetKD encrypted-key delivery uses BLS-IBE-style encryption over BLS12-381 G2 transport public keys, every encrypted key transported via vetKD on mainnet today is HNDL-vulnerable.

3 Metadata, Anonymity & Confidentiality weight 13% 28 / 100

3a · tx graph visibility 7 / 20

Pseudonymous. ICRC-1/2 ledger transactions reveal sender and receiver principals on-chain. Internet Identity derives a different principal per dapp origin (cross-app linkability defeated at II layer), but per-dapp on-ledger activity is fully linkable.

3b · rpc mempool concentration 8 / 20

Boundary nodes (HTTPS gateways) operated by DFINITY-controlled infrastructure plus a growing community provider set. Subnet replica gossip observable to ~13–40 nodes per subnet. ICP runs ~42 subnets with ~130 independent node providers (NNS-controlled). No published validator metadata-retention policy.

3c · cross chain bridge correlation 7 / 20

Chain-key Bitcoin (ckBTC, mainnet 2023-04-03), chain-key Ethereum (ckETH), ckUSDC, ckUSDT, and Chain Fusion JSON-RPC outbound to EVM chains create on-chain trails between ICP principals and external addresses.

3d · retroactive de anonymization 6 / 20

Every signing primitive that anchors ICP identity is Shor-vulnerable. Post-Shor recovery of subnet BLS12-381 keys exposes every canister-signature-derived principal, historical II authentications can be re-attributed. vetKD-encrypted payloads are Shor-decryptable.

3e · mixnet shuffle 0 / 20

No on-chain mixer, cryptographic shuffle, or mix-network in the replica.

4 Migration Architecture weight 10% 58 / 100

4a · crypto agility 11 / 15

NNS-governed protocol upgrades replace replica binaries weekly across subnets via NNS proposals. Replica's cryptographic stack is modular. DFINITY CTO Jan Camenisch (Dec 2024) committed to replacing cryptographic schemes if needed (crypto agility). Production additions: tECDSA secp256k1 GA Aug 2022; tSchnorr BIP-340 + Ed25519 GA mainnet Sep 2024; vetKD test key on mainnet subnet under proposal 136589 May 2025.

4b · aa key rotation 11 / 20

Every canister IS a smart-contract account with native key management. Internet Identity supports multi-passkey rotation (add/remove devices) and OpenID Connect federation. No client-layer PQC path published. Session-key types are Ed25519 and ECDSA.

4c · hard fork track record 13 / 15

Weekly NNS-coordinated subnet binary upgrades routine since mainnet launch (May 2021). Major coordinated additions include Bitcoin integration (Nov 2022), tECDSA GA (Aug 2022), ckBTC (Apr 2023), ckETH / Chain Fusion (2023–2024), tSchnorr + Ed25519 GA (Sep 2024), vetKD test key (May 2025). No contested fork.

4d · hybrid deployment readiness 4 / 15

No published hybrid PQC envelope at the subnet-consensus, threshold-signing, vetKD, or II layer. Proposal 35660 (Dec 2021) committed DFINITY to PQ research but did not specify a hybrid migration architecture. Sep 2025 forum thread on Qubex Protocol describes a third-party L2 hybrid signature scheme (ECDSA/Schnorr classical + ML-DSA-44 + SLH-DSA-SHA2-128f, ML-KEM-768), not a DFINITY foundation product.

4e · stateful hash state management 15 / 15

ICP deploys no stateful hash-based signature primitive. Default 15/15 for stateless schemes.

4f · bft aggregation path 4 / 20

ICP subnet consensus uses BLS12-381 threshold aggregation via NIDKG. No spec, testnet, or mainnet pilot of a PQ aggregation path published by DFINITY. Camenisch Dec 2024: 'closely monitoring the situation and will propose replacements at the appropriate time.' Score reflects undeclared status with active research commitment.

5 Deployment Execution weight 22% 8 / 100

5a · mainnet pqc traffic pct 0 / 25

Mainnet PQC traffic 0%. No PQ primitive signs subnet blocks, NNS proposals, threshold canister signatures, vetKD encrypted-key transport, or II authentications.

5b · pqc code in consensus client 1 / 15

dfinity/ic replica contains no PQ signature implementation in consensus, NIDKG, tECDSA, tSchnorr, or vetKD code paths. The third-party Qubex Protocol R&D thread (Sep 2025) implements ML-DSA-44 + SLH-DSA-SHA2-128f + ML-KEM-768 inside canisters as an L2 prototype; this is application-layer canister code, not replica consensus client code.

5c · validator pqc key adoption 0 / 15

Zero subnet replicas hold PQ keys; subnet keys are BLS12-381 only. Boundary nodes terminate classical TLS.

5d · published dated milestones 0 / 10

VOIDED to 0 because 5a = 0. Standing dated commitment is Proposal 35660 (Dec 2021, adopted by NNS as long-term R&D objective). Camenisch Dec 2024 reaffirmed crypto-agility commitment with no enforcement-mechanism-backed flag-day, no NNS proposal with hard-coded activation epoch.

5e · pqc washing delta 7 / 15

Announced PQ work in trailing 12 months: Proposal 35660 reaffirmed in 2025 Roadmap Update; Qubex Protocol third-party R&D thread (Sep 2025); third-party RFP for canister-level PQC verification engine (Dec 2025); media coverage citing ICP's 'crypto agility'. Shipped PQ on mainnet: 0 bytes. No deduction trigger.

5f · signature footprint multiplier 0 / 20

No PQ signature scheme is selected or specified for ICP consensus, threshold signing, vetKD, or II. Score 0 per rubric for 'undisclosed.'

6 Supply Chain Vendor Readiness weight 22% 9 / 100

6a · wallet 1 / 25

Top-3: Internet Identity (DFINITY-operated; passkey/WebAuthn ES256/EdDSA, no PQ roadmap), Plug Wallet (browser extension, no PQ roadmap), NFID Wallet (Internet Identity Labs, OpenID + chain-fusion, no PQ roadmap). Ledger Nano via DFINITY/Zondax-built ICP app supports ICP/ckBTC/ckETH but ships classical curves only.

6b · bridge 4 / 25

Top-3: Chain-key Bitcoin (ckBTC; tECDSA secp256k1 + subnet BLS12-381), Chain-key Ethereum / Chain Fusion (ckETH), ckUSDC / ckUSDT. All rely on the same tECDSA secp256k1 + BLS12-381 stack, single-family Shor exposure. Higher floor than other tiles because ckBTC/ckETH have explicit DFINITY ownership and would migrate via NNS proposal.

6c · custodian 2 / 25

Top-3 by ICP custody volume: Coinbase Custody (lists ICP), BitGo (lists ICP), Fireblocks (research / non-custody integrations). None has published an ICP-specific PQ migration roadmap.

6d · rpc hsm tee infra 2 / 25

RPC providers: DFINITY-operated boundary nodes plus community boundary nodes; ic0.app gateway. No PQ TLS hybrid KEM in the boundary fleet. HSM: stake-pool / node-provider HSMs (where used) are vendor-default classical (Thales / YubiHSM / AWS KMS). TEE: ICP replicas run on commodity bare metal.

7 Governance & Coordination weight 8% 49 / 100

7a · validator stake distribution 11 / 20

~42 subnets, each with 13–40 nodes (default 13 for application subnets, 28–40 for high-replication subnets including the NNS subnet and key tECDSA subnets). ~130 independent node providers globally. NNS-controlled membership; node providers are vetted via NNS proposal. DFINITY Foundation retains significant influence via early-investor neuron concentration and protocol-development authority.

7b · upgrade cadence under pressure 16 / 20

NNS proposals execute weekly. Replica binaries upgraded subnet-by-subnet with no-downtime rolling upgrades. Major cryptographic additions (tECDSA, tSchnorr, vetKD test key) shipped under NNS coordination on stated timelines. Strong operational track record under non-emergency conditions.

7c · named coordination lead 13 / 20

DFINITY Foundation (CEO/Chief Scientist Dominic Williams; CTO Jan Camenisch; VP Research includes Jens Groth, Andrea Cerulli on PQ R&D). Proposal 35660 (Dec 2021) named Groth and Cerulli as PQ R&D leads. No publicly-named, mandated PQ migration program manager with quarterly deliverables.

7d · adversarial coordination precedent 9 / 20

NNS has handled governance-attack precedents (large-neuron voting, contested SNS launches) but no precedent of a coordinated cryptographic primitive change under active adversarial pressure. The closest precedent is the routine NIDKG re-sharing protocol that allows subnet membership changes.

7e · canary tripwire mechanism 0 / 20

No community honeypot, no rate-limited spending rule, no cryptographic tripwire embedded in subnet consensus, no automated PQ-event response.

X + Y vs Z, when does the math turn against you?

v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?

X, signature shelf life

7–15 years (subnet BLS12-381 keys long-lived; tECDSA key_1 production since 2022-08; ckBTC/ckETH custody keys de-facto permanent)

Y, migration time

8–12 years (strong NNS coordination, but undeclared target primitive, undeclared aggregation path, absence of hybrid spec)

Z10 (10% CRQC year)

2030

Z25 (25% CRQC year)

2035

Verdict

X+Y range 15–27 years (2041–2053), Crisis Zone (vs Z10 2030); Outside risk window (vs Z25 2035)

Z-compliance

Outside NIST 2030 deprecation and 2035 disallowance under any X+Y end of range

Source-disagreement disclosure

v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.

vetKD test-key vs production framing

vetKD test-key launch is described variously as production-grade or as test-only across DFINITY communications. The official forum thread (proposal 136589, May 2025) explicitly states the key is for testing; one developer-update post phrases vetKD as 'available.' Score reflects the conservative test-only reading.

Foundation vs third-party PQ work

The Sep 2025 Qubex thread (third-party L2 hybrid prototype) and the Dec 2025 PQC RFP appear high in search engines and could be misread as DFINITY foundation deployments. Both are third-party. Foundation position remains Proposal 35660 + Camenisch crypto-agility statement.

Delta-QRI under alternative weighting

Under a weighting that prioritizes governance-coordination capacity (+5pp Dim 7 at expense of Dim 6), QRI rises to ~27–28 (still Band 3). Under a weighting prioritizing deployment execution (+5pp Dim 5 at expense of Dim 7), QRI falls to ~22–23 (Band 3 still binds).