IOTA · L1 · STAGE 1 ACKNOWLEDGED · QRI 26 v3.1.0 methodology

In plain terms

What it is. IOTA once protected its network with signatures a quantum computer could not break, then switched them off in 2021 to make the network easier to use.

What we found. The quantum-safe protection now lives only in a separate identity feature off to the side; every signature that actually moves money on the main network can be broken by a future quantum computer, and IOTA has published no plan to fix that.

Why it matters. IOTA has already proven it can swap out its security three times when it had to, so the question for anyone holding or building here is whether it brings that protection back before a quantum computer can read today's funds and transactions.

IOTA is the chain in the pilot that historically used a PQ-resistant signature scheme (W-OTS, 2016-2021) and explicitly migrated away from it in 2021 (TIP-17 Wotsicide / Chrysalis) for usability. Today's PQ work lives at the off-chain Identity layer (IOTA Identity 1.7-beta, October 2025, with LINKS Foundation under EU Horizon QUBIP); base-ledger consensus signatures are 100% Shor-vulnerable.

inLinkedIn ↷Audit access ⇆Compare Verified 2026-05-01

Summary

IOTA scores QRI 26, Band 3 Planning, Migration Stage 1. Rebased mainnet (live since 2025-05-05) documents four signature flags: Ed25519 (RFC 8032, SHA-512, ZIP215), ECDSA secp256k1, ECDSA secp256r1, and Multisig. Intent-message hashing uses Blake2b-256 before signing. Historical W-OTS (Winternitz one-time, hash-based) is documented in TIP-17 (Wotsicide, obsolete) as removed in Chrysalis Phase 2 (2021-04-28), IOTA's PQ-resistant heritage was deliberately retired for ecosystem viability. The 2025 Rebased mainnet upgrade kept Ed25519 (with ECDSA secp256k1/r1 added) on a Move VM / DPoS architecture forked from Sui. Identity layer (off-chain) documents ML-DSA (44/65/87), SLH-DSA, Falcon (512/1024) hybrids developed with LINKS Foundation under EU Horizon QUBIP, but explicitly Identity-layer, not base ledger. The Move VM admits a fifth signature flag for ML-DSA or SLH-DSA without consensus hard fork; the gap is not architectural, it is execution and milestone-discipline. mainnet-traffic cap binds at 5a=0%, Architecture-Execution Gap is 55, supply-chain weak-link cap fires across all 4 vendor tiles. IOTA Foundation's three crypto-migration hard-fork track record (Curl-P 2017, Wotsicide 2021, Rebased 2025) demonstrates strong coordination capacity.

What the gates say

Gate 1a, Hybrid signature: FAIL , base ledger has no documented hybrid signature composition; Identity 1.7-beta has id-MLDSA44-Ed25519 / id-MLDSA65-Ed25519 composite, but Identity-layer scope, not base ledger
Gate 1a, Hybrid KEM: FAIL , no hybrid PQ KEM at validator-gossip / RPC TLS layer documented; standard TLS assumed
Gate 1b, Commit-to-hash: COND , no OR-composition declared at base ledger
Gate 2, Evidence reconstruction: PASS , every sub-score has ≥ 3 public artifacts
Gate 3, Primitive naming: PASS , every primitive named exactly

Burn-vs-rescue policy on file

Declared option f, Undeclared. No public IOTA Foundation statement on quantum-vulnerable address policy at the base ledger. Historical Wotsicide forced migration of W-OTS addresses to Ed25519 with a deadline (TIP-17 → Stardust TIP-34); no equivalent forward-looking sunset for Ed25519 has been published.

Seven dimensions

Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.

1 Cryptographic Exposure weight 15% 42 / 100

1a · primitive inventory 16 / 20

Rebased mainnet documents four signature flags. Identity layer documents ML-DSA / SLH-DSA / Falcon, but explicitly Identity-layer, not base ledger. Inventory is named precisely; small deduction because Rebased docs do not list a default.

Primitives: Ed25519 (RFC 8032, SHA-512, ZIP215) · ECDSA secp256k1 · ECDSA secp256r1 · Multisig (signature flag 0x03) · Blake2b-256 (intent-message hashing before signing) · W-OTS (Winternitz one-time, hash-based), historical, removed in Chrysalis Phase 2 (2021-04-28) per TIP-17 · ML-DSA (44/65/87), IOTA Identity 1.7-beta off-chain only · SLH-DSA, IOTA Identity 1.7-beta off-chain only · Falcon (512/1024), IOTA Identity 1.7-beta off-chain only

1b · shor grover pq tag 6 / 20

Base-ledger consensus signatures are 100% Shor-vulnerable. PQ primitives exist only at the off-chain Identity layer.

Tags:

Ed25519 → Shor-break-via-DL-without-pairings
ECDSA-secp256k1 → Shor-break-via-DL-without-pairings
ECDSA-secp256r1 → Shor-break-via-DL-without-pairings
Blake2b-256 → Grover-weaken-128bit
SHA-512 → Grover-weaken-256bit
ML-DSA-44/65 (Identity only) → PQ-safe lattice
SLH-DSA (Identity only) → PQ-safe hash
Falcon-512/1024 (Identity only) → PQ-safe lattice

1c · family diversity 5 / 20

1 family deployed at base ledger: classical EC (Ed25519 + ECDSA variants, same family for PQ purposes). Identity-layer adds 2 PQ families (lattice + hash) but those are not in the consensus path. Diversity Cap fires for base-ledger PQ scope (zero PQ families deployed at consensus).

1d · nist security category 4 / 20

Ed25519: not a NIST PQC standard, classical-128-bit; ML-DSA-44 (Identity): NIST cat 2; ML-DSA-65 (Identity): NIST cat 3; Falcon-512 (Identity): NIST cat 1; SLH-DSA (Identity): cat 1-5 depending on parameter set. No NIST-PQC categorized primitive in the consensus path.

1e · implementation quality 11 / 20

Ed25519-dalek (Rust) has known constant-time implementation, RFC 8032 compliance, ZIP215 signature-validation rule. Move VM provenance via Mysten Labs fork. ZKryptium library (LINKS Foundation, October 2023) for selective-disclosure credentials in IOTA Identity. PQ libraries cited in Identity 1.7-beta as experimental, suitable for developer testing but not production deployments pending further NIST alignment.

2 Quantum Recovery Exposure weight 10% 20 / 100

Forge subtotal: 16/75 Decrypt subtotal: 4/25

2a · active key exposure 5 / 25

Ed25519 addresses derive from the public key hash (Blake2b-256). On first spend, the public key is revealed in the transaction; subsequent spends from the same address have a revealed key. No active-key migration plan published for the base ledger.

2b · cold key exposure 7 / 25

Pre-Chrysalis (≤2021-04-28) addresses on the legacy Tangle were W-OTS-derived (hash-based, Shor-resistant). TIP-17 forced migration to Ed25519. Cold W-OTS funds that did not migrate by the deadline are no longer spendable on the live network. Post-Chrysalis dormant Ed25519 addresses sit on Shor-vulnerable curves.

2c · sig long term validity 4 / 25

DAG history under Rebased is signed under Ed25519 / ECDSA. Historical pre-Chrysalis W-OTS signatures were valid only on the legacy network (now decommissioned beyond the migration receipt mechanism). Post-Shor, all currently verifiable signatures on Rebased mainnet are forgeable.

2d · encryption confidentiality hndl 4 / 25

Validator gossip and RPC use standard TLS (default classical X25519/ECDH/RSA, IOTA does not document a non-standard transport). No hybrid PQ KEM is documented.

3 Metadata, Anonymity & Confidentiality weight 13% 26 / 100

3a · tx graph visibility 5 / 20

DAG transaction graph is fully public. Pseudonymous addresses, like Bitcoin/Ethereum. No native shielding.

3b · rpc mempool concentration 8 / 20

Rebased launched May 5 2025 with 13 Genesis Validators (IOTA Foundation, IOTA Ecosystem DLT Foundation, Tangle Ecosystem Association, DLT GREEN, P2P.org, LugaNodes, Twinstake, Kiln, Stakin, Nansen, Blockscope, Coinage x DAIC, Staketab). DPoS network designed to ramp to 50 validators initially, then 150. Foundation-aligned operators dominate the genesis set.

3c · cross chain bridge correlation 7 / 20

IOTA Mainnet integrated LayerZero and Stargate January 2026, building on LayerZero/Stargate support added to IOTA EVM in September 2024. Connects to 150+ chains including Ethereum, Solana, Base, BSC. Cross-chain correlation surface is large; bridge-side privacy not addressed.

3d · retroactive de anonymization 6 / 20

Post-Chrysalis transactions are signed under Ed25519; under Shor, public keys revealed in transactions enable retroactive linking. Pre-Chrysalis W-OTS portion is not retroactively de-anonymizable at the signature layer (hash-based) but the legacy Tangle is no longer the production ledger.

3e · mixnet shuffle 0 / 20

No on-chain mixer, no commit-reveal, no shuffle node infrastructure documented.

4 Migration Architecture weight 10% 63 / 100

4a · crypto agility 13 / 15

IOTA has shipped three crypto-migration hard forks: Curl-P → Kerl/Keccak (2017 vulnerability response), W-OTS → Ed25519 (Chrysalis, 2021-04-28), Stardust → Move VM Rebased (2025-05-05). Move VM permits adding signature flags without consensus hard fork (Rebased already supports four flags). Adding a fifth flag for ML-DSA or SLH-DSA is architecturally feasible but not documented as planned.

4b · aa key rotation 11 / 20

Rebased inherits Sui-style account model (Move-based) with signature-scheme agility per signing flag. Multisig is native (flag 0x03). Key rotation primitives at account layer are present in Move's address model. No deployed PQ client-layer path.

4c · hard fork track record 13 / 15

Chrysalis (2021), Stardust (2023), Rebased (2025-05-05), Starfish Consensus Upgrade (2026-04-28). Foundation-coordinated; no contested forks documented.

4d · hybrid deployment readiness 4 / 15

Move VM admits new signature flags. IOTA Identity 1.7-beta deploys hybrid signatures (id-MLDSA44-Ed25519 / id-MLDSA65-Ed25519 via LINKS Foundation's compositeJwk DID verification material), but this is at the Identity (off-chain credential) layer, not the base ledger. No base-ledger hybrid composition spec or testnet has been published.

4e · stateful hash state management 15 / 15

Chain currently has no stateful-hash scheme deployed.

4f · bft aggregation path 0 / 20

IOTA Rebased validator consensus mechanism documented as DPoS/Move-based (Mysten Sui-derived). The arXiv-published IOTA Tangle 2.0 research paper references BLS12-381 for aggregated signatures, but Rebased-mainnet validator consensus implementation does not document BLS aggregation as a deployed feature distinct from the signature flags.

5 Deployment Execution weight 22% 8 / 100

5a · mainnet pqc traffic pct 0 / 25

Zero PQ signing traffic on Rebased mainnet base ledger. All consensus signatures are Ed25519 / ECDSA / Multisig. Identity 1.7-beta PQ signatures are off-chain credential-layer, not on-chain consensus traffic.

5b · pqc code in consensus client 0 / 15

IOTA Rebased core node software does not document merged PQ signature verification code (the four signature flags are all classical).

5c · validator pqc key adoption 0 / 15

No validator PQ key registration documented.

5d · published dated milestones 0 / 10

VOIDED per v3.1 because 5a = 0. IOTA Identity 1.7-beta release (October 2025) and QUBIP Horizon Europe project participation are documented PQ milestones but apply to the Identity layer, not base-ledger consensus.

5e · pqc washing delta 8 / 15

IOTA's PQ messaging in 2025-2026 (Identity 1.7-beta blog post; QUBIP coordination announcements; community articles citing IOTA quantum-proof) is moderate but presents a clear gap between Identity-layer (real PQ deployment in beta) and base-ledger (no PQ deployment). Some external community claims of IOTA is quantum-resistant trace back to historical W-OTS heritage rather than current Ed25519 mainnet, a washing risk. Estimated announced-vs-shipped ratio ≈1.5-2.0x.

5f · signature footprint multiplier 0 / 20

Rebased base-ledger has no PQ signature in production; multiplier under PQ undisclosed.

6 Supply Chain Vendor Readiness weight 22% 12 / 100

6a · wallet 4 / 25

Top-3 wallets for IOTA Rebased: new browser-based IOTA Wallet (replaces deprecated Firefly post-Rebased), Nightly (community), Bloom Wallet (community). Ledger Nano S/X support inherited from Firefly migration. None publicly document a base-ledger PQ signature roadmap.

6b · bridge 4 / 25

Top-3 bridges: LayerZero (integrated January 2026 to mainnet, September 2024 to IOTA EVM), Stargate (LayerZero-aligned), and IOTA-native bridges. LayerZero and Stargate themselves do not publish PQC roadmaps.

6c · custodian 2 / 25

Institutional staking provider P2P.org operates as Genesis Validator. Fireblocks, BitGo, Coinbase Custody have varying levels of MIOTA support; none publish IOTA-specific PQ custody roadmaps.

6d · rpc hsm tee infra 2 / 25

IOTA Foundation-operated nodes plus Genesis Validator nodes provide RPC. Ledger HSM line support exists for IOTA via Ledger Nano S/X; Ledger does not publish a PQ device-firmware roadmap that names IOTA. No TEE attestation chain documented.

7 Governance & Coordination weight 8% 51 / 100

7a · validator stake distribution 9 / 20

Rebased DPoS started with 13 Genesis Validators (May 5 2025), targeting 50 then 150. Genesis set is Foundation-and-partner-dominated; Nakamoto coefficient is low at launch, expected to rise with permissionless validator onboarding.

7b · upgrade cadence under pressure 17 / 20

Three crypto-migration hard forks (Chrysalis 2021, Stardust 2023, Rebased 2025) plus Starfish Consensus Upgrade (2026-04-28) plus historical Curl-P emergency response (2017).

7c · named coordination lead 12 / 20

IOTA Foundation (Berlin-registered, multiple public principals; co-founder Dominik Schiener active publicly). Tangle Ecosystem Association and IOTA Ecosystem DLT Foundation as additional coordinating bodies. No named PQC working group lead at the base-ledger level (PQ work currently led at Identity-layer through QUBIP coordination with LINKS Foundation).

7d · adversarial coordination precedent 13 / 20

2017 Curl-P vulnerability response and Coordinator deprecation through Coordicide both demonstrate willingness to migrate primitives under external researcher / community pressure. Strong precedent.

7e · canary tripwire mechanism 0 / 20

No canary, honeypot, rate-limit-spending rule, or cryptographic tripwire is documented in IOTA's consensus or governance specs.

X + Y vs Z, when does the math turn against you?

v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?

X, signature shelf life

5–15 years. Post-Chrysalis Ed25519 keys (2021-04-28 onward) sit on Shor-vulnerable curves with no scheduled migration. Cold-key dormant value remains exposed

Y, migration time

6–10 years estimate. IOTA's hard-fork track record is strong, but base-ledger PQ has no published spec or testnet, earliest plausible Stage 5 is 6+ years

Z10 (10% CRQC year)

2030

Z25 (25% CRQC year)

2035

Verdict

X+Y = 11–25 years from 2026 → 2037–2051, Outside risk window vs Z25; Crisis Zone vs Z10

Z-compliance

Outside compliance window, primary jurisdiction (DE/EU; IOTA Foundation Berlin): NIST IR 8547 deprecation 2030 / disallowance 2035; BSI Migrationsplan; EU NIS2

Source-disagreement disclosure

v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.

Hash-based signature default claim

Some general/secondary sources state IOTA 2.0 brings hash-based signatures back by default. Primary IOTA documentation (docs.iota.org/developer/cryptography/transaction-auth/signatures) and the official Q2 2025 progress report do NOT confirm any hash-based base-ledger signature scheme deployed or specced for mainnet today. The arXiv 2022 IOTA Tangle 2.0 research paper documents BLS12-381 aggregation as a research direction. PQ scope at base ledger remains undeployed and unspecified per primary sources.

Delta-QRI under alternative weighting

Heavier weight on Dim 4 architecture/governance vs Dim 5 deployment: if Dim 4 weighted at 22% and Dim 5 at 10% (inverse of L1 default), QRI ≈ 32 (still Band 3 Planning).