Proving-system and ledger primitives are explicitly specified in the public ledger specification and the node runtime source, both published under Midnight Foundation copyright. Deduction retained because no consolidated Foundation cryptographic specification exists: the consensus authority-key types, the BEEFY and cross-chain key types, and the peer-transport handshake are discoverable only by reading client source, and the public developer glossary and documentation name no curve and no signature scheme. NightStream is inventoried as announced-only R&D: its published lab scope names the protocol family and field but no chosen parameter set, its maintainers describe it as research software that is not production-ready and not independently audited, and nothing from it appears in the shipping client stack.

Zero PQ families deployed. Pre-cap state.

No primitive maps to NIST PQC categories 1-5. BLS12-381 and secp256k1 target roughly 128-bit classical security; Poseidon parameter sets target 128-bit classical. Shor breaks every curve and pairing primitive; Grover halves hash preimage levels.

midnight-proofs began as a fork of PSE halo2 v0.3.0 and is now maintained as a standalone implementation; midnight-curves originated as forks of blstrs and the Zcash jubjub implementation and is likewise standalone. Versions pinned in the shipping node at evaluation: midnight-proofs 0.7.2 and 0.8.1, midnight-curves 0.2.1 and 0.3.1, midnight-ledger 8.1.1, midnight-transient-crypto 2.2.0 and 3.0.0. A 2024 collaboration with an external formal-methods firm and Intersect produced open-source recursive-proof work in Halo2. No formal verification of the Midnight stack and no constant-time validation is published. Plonk plus KZG is Tier 3 cryptanalytic maturity; Poseidon is Tier 4 research-grade. No public audit report for the mainnet cryptographic stack was retrievable at evaluation date.

Unshielded transaction authority is a BIP-340 Schnorr verifying key on secp256k1, revealed on first spend. Shielded Zswap coin public keys are SHA-256 images of a random 256-bit secret, so the coin-spend authority itself is not a revealed curve point, but spend authorization is a zk-SNARK whose soundness rests on Plonk with KZG over BLS12-381 and is therefore forgeable post-Shor. Nine named federated node operators hold Aura sr25519 authoring keys and GRANDPA Ed25519 finality keys that sign every block, a concentrated active-Forge surface.

Mainnet history is about five months at evaluation (genesis 2026-03-17). The Zswap receiving key includes a Jubjub encryption public key that must be published to receive shielded value, so recipient key material is on the public record independent of spend activity. The NIGHT Glacier Drop distributed to holders of eight token bases (ADA, BTC, ETH, SOL, XRP, BNB, AVAX, BAT), with over 3.5 billion NIGHT claimed by more than 170,000 wallet addresses in the 2025-08-05 to 2025-10-20 window, leaving a large published address set with a long unclaimed tail.

Every transaction-authorizing signature on the chain since genesis on 2026-03-17 is forgeable post-Shor, whether it is a BIP-340 Schnorr signature on the unshielded path or a zk-SNARK spend proof on the shielded path. Block-authoring and finality signatures carry no PQ attestation layer. Audit-trail non-repudiation does not survive Shor.

Validator peer transport is libp2p Noise over X25519, with no PQ component, so validator-mesh traffic is harvest-now-decrypt-later exposed. Live handshake probes on 2026-08-19 found the public web edge and the public third-party RPC edge both negotiating the X25519MLKEM768 hybrid group under TLS 1.3, which protects client-to-RPC traffic in transit against a harvesting adversary. Partial credit reflects that measured hybrid edge; it is unannounced, undocumented by the chain, may be a content-delivery-network default, and does not extend to the consensus mesh.

Zswap note encryption establishes a shared secret by non-interactive Diffie-Hellman over Jubjub, derives a key from that point with the Poseidon-based transient hash, and encrypts the payload with Poseidon used as a block cipher in CTR mode. Confidentiality therefore rests entirely on the discrete-log problem on Jubjub. An adversary harvesting note ciphertexts today decrypts every Midnight private state transition once Shor lands, exposing the regulated-industry data Midnight is pitched to protect (payroll, KYC, healthcare). No PQ KEM, no hybrid testnet, no historical re-encryption plan.

The Kachina-based architecture shields private contract state behind zk-SNARK proofs, publishing only the proof, the public state delta and the encrypted note payload. Zswap combines the Zcash and SwapCT designs, keeping unspent coins undeterminable through paired commitment and nullifier sets over a Merkle tree. The Compact DSL forces explicit private and public state declaration, and selective disclosure lets a holder prove facts without revealing the underlying data. A transparent unshielded path also exists. Address reuse persists.

Top-3 RPC: a public third-party RPC service, Midnight-foundation infrastructure, and node-operator-run endpoints. The federated phase concentrates RPC observability among the nine named node operators. Mempool gossip is observable to the federated operator set. Operator metadata retention is undeclared at protocol level.

The canonical interface is the Cardano partner-chain link, which the node reaches by observing Cardano mainchain state through a chain indexer, and which is observable on the Cardano side. The NIGHT Glacier Drop drew claims from holders of ADA, BTC, ETH, SOL, XRP, BNB, AVAX and BAT, so more than 170,000 claiming addresses published correlatable identity material on their source chains. Source-to-destination linkability is high.

The dominant confidentiality risk. Recipient key derivation, the note-encryption Diffie-Hellman on Jubjub, the Pedersen value-commitment binding, and the Plonk with KZG proof binding over BLS12-381 all rest on discrete-log or pairing hardness. Once Shor lands, every historical Midnight private record encrypted to a published Jubjub encryption key is decryptable by any party that harvested the chain. This is a one-shot mass de-anonymization of every private transition since genesis on 2026-03-17. Partial credit only because the transparent unshielded path is unaffected.

No protocol-level mix network or cryptographic shuffle. Privacy comes from the SNARK-based Kachina and Zswap record model itself. Wallet-level operations across multiple shielded transitions provide some indistinguishability.

No public commitment covers note or shielded-state payload encryption. The NightStream lab's published scope is a proving system: it names arithmetization, folding, developer tooling, migration paths from existing proof systems, and multi-platform verification targets, and it names no note-encryption KEM. The related integration analyses in Midnight's engineering org cover MPC key custody and P-256 WebAuthn passkey account-binding, not payload confidentiality; the same repository's research tracker lists lattice-friendly address schemes, polynomial commitment schemes, MPC and anonymous credentials as items still open and unchecked. Note encryption remains Diffie-Hellman over Jubjub with Poseidon-CTR, with no hybrid PQ KEM announced, on testnet or deployed, and no historical re-encryption plan. Rubric floor 0: the announcement tier requires a note-encryption-specific announcement, which does not exist.

The Pluto-Eris to BLS12-381 proving-system change, announced 2025-04-15 and shipped as part of the testnet upgrade of 2025-04-28, is a real algorithm-switch event with published effects: verification time 12ms to 6ms per proof and proof size 6KB to 5KB. It is a genuine crypto-agility precedent, though it moved from one Shor-vulnerable curve family to another. No formal crypto-agility specification covers future swaps of curve, signature scheme or proof-system family.

Key derivation follows the Substrate and partner-chain toolchain; no account-abstraction primitive comparable to ERC-4337, EIP-7702 or native AA in zkSync or Starknet is documented. Selective disclosure enables read-capability sharing but is not algorithm rotation. No client-layer PQC path.

Short track record. Testnet operated from 2024 with multiple coordinated upgrades, and the Pluto-Eris to BLS12-381 proof-system swap (testnet, 2025-04-28) was a coordinated cryptographic change. Mainnet launched cleanly at genesis on 2026-03-17. Since launch, mainnet was upgraded to the Node 1.0.0 bundle in July 2026, a maintenance version bump rather than a primitive change, aligning production with the Preprod stack (Node 1.0.0, Indexer 4.3.3, Proof Server 8.1.0). Midnight also published node-operator guidance in May 2026 for adapting infrastructure to Cardano's externally-imposed Van Rossem hard fork; no post-event report confirming the outcome or downtime was retrievable, so that episode is not credited as a completed coordination event. No contested forks. No Midnight-initiated mainnet cryptographic fork yet.

A named replacement program for the proving core exists in the public record: NightStream, an approved Linux Foundation Decentralized Trust lab whose published scope includes migration paths from Halo 2, PLONK and STARKs, and multi-platform verification targets that name Midnight's Compact, with active public commits through August 2026. Midnight's own public architecture map places NightStream in the ZK proof-system layer alongside BLS12-381 and Plonk with KZG, classing NightStream as research and the other two as current. Midnight's engineering org carries integration analyses written against NightStream's actual constraints (Goldilocks 64-bit field, roughly 1 kHz proved execution, 500MB to 2GB memory, browser and mobile WASM): MPC key-custody candidates (Shamir with a TEE, FROST, GG20 and CGGMP) and a two-phase P-256 WebAuthn passkey to native-key binding design costed at roughly 15K to 25K constraints for the one-time binding proof. This is real design engagement, but it is a pure-PQ proving-system replacement path, not a hybrid classical-plus-PQ composition for consensus signing or note encryption; nothing is Foundation-committed, dated or deployed. Countervailing repository evidence: NightStream removed its Midnight bridge crate, records no publicly disclosed adopters, carries no release and no tag, and lists chain-facing deployment wiring as unfinished. Plonk with KZG over BLS12-381 remains the deepest agility constraint: replacing it requires re-instantiating the Compact compiler, the proving system and the verifier circuits.

No stateful hash signature schemes in use. Default 15/15.

Block authoring signs with Aura sr25519 authority keys and finality with GRANDPA Ed25519 authority keys, with no signature aggregation at consensus. BEEFY with an MMR provides a classical light-client attestation path on ECDSA secp256k1, not a PQ aggregation path. No PQ aggregation is declared, no spec, no testnet pilot.

0% of consensus signing, transaction signing, note encryption or proof generation runs on a PQC primitive.

No PQC primitive in the Midnight client stack. midnight-proofs is Plonk with KZG over BLS12-381; no FRI, no lattice folding, no ML-DSA, no SLH-DSA, no ML-KEM. Re-verified independently at evaluation: a code search of midnight-node, midnight-ledger and midnight-zk for post-quantum, dilithium, ML-KEM, ML-DSA, kyber, sphincs, falcon, lattice and nightstream returns zero hits in all three repositories, each of which was pushed to on 2026-08-19 and is therefore current and indexed. All PQ material in the organization sits in a separate R&D and design repository and one documentation file.

0 of the 9 named federated node operators run PQC consensus keys. Authority keys remain sr25519 for authoring and Ed25519 for finality.

VOIDED to 0 per v3.1 rule (5a = 0). No dated, enforcement-mechanism-backed PQ milestone exists in any roadmap publication. The NightStream lab's own published development timeline states four phases each labelled with an unresolved placeholder duration rather than a date, publishes no Midnight-deployment milestone, and its repository carries no release and no tag.

Announced PQC exists: the NightStream lab approved under Linux Foundation Decentralized Trust with its proposal merged 2025-09-15, and a stream on Midnight's own video channel on 2026-06-04 titled as a post-quantum proving system, both inside the trailing 12 months. Shipped PQC remains 0: no PQC primitive is verifiable on mainnet under any named scheme. Announced-versus-shipped band above 1.5, so the 10-point Dim 5 deduction applies here. Mitigations recorded, not credited: the program is framed as research by its own maintainers, never claims live quantum safety, and the developer dev-diary is silent on it. A 2026-02-13 conference talk and a reported November 2025 social announcement appear only in secondary coverage, are framed around Cardano rather than Midnight, and are not counted.

Undisclosed. The NightStream lab's published performance targets are indicative and generic (proof generation in seconds on consumer hardware, proof size in the tens of kilobytes) with no Midnight integration figures, no bytes-per-block and no verifier-cost number. No PQ signature scheme is announced for consensus or account signing, so bytes-per-block under PQ is unknown.

The Cardano-native Lace wallet is the primary wallet path via the partner-chain integration, and a wallet SDK education module launched in July 2026 covering seed-based key derivation and DUST registration, not PQC. No top-3 wallet has published a PQC roadmap covering Midnight key derivation. Hardware wallet support is in development; no hardware-wallet vendor has committed to PQ for Midnight's curves.

The canonical Midnight to Cardano partner-chain link is internal to the partner-chain framework, with the node observing Cardano mainchain state through a chain indexer. External multi-chain bridges are not documented as live. No bridge has a published PQC roadmap.

The nine named federated node operators include institutional infrastructure and payments firms (Worldpay, Bullish, MoneyGram, Pairpoint by Vodafone, eToro, AlphaTON Capital, Google Cloud, Blockdaemon, Shielded Technologies), several custody-adjacent. Top-tier institutional custody does not yet support Midnight native asset custody at scale. No named operator has published a PQC roadmap covering Midnight keys.

RPC is served by a public third-party RPC service, Foundation infrastructure and operator-run endpoints. Live probes on 2026-08-19 show the public third-party RPC edge negotiating the X25519MLKEM768 hybrid TLS group, which is transport-layer only and is not a published PQC roadmap covering Midnight key material. No documented HSM vendor PQC integration for Midnight curve material. TEEs are not in the consensus path, though a hosted TEE prover appears on the roadmap as future work. No tile ships PQC for key material.

Federated mainnet launch (Kūkolu phase) with a named-entity operator set of nine: Worldpay, Bullish, MoneyGram, Pairpoint by Vodafone, eToro, AlphaTON Capital, Google Cloud, Blockdaemon and Shielded Technologies. Concentrated by design during the federated phase. The Foundation states it intends to transition to a fully decentralized network, with the Mōhalu phase opening validator participation more broadly.

The Pluto-Eris to BLS12-381 proving-system migration (testnet, 2025-04-28) is a substantive coordinated cryptographic upgrade. Mainnet reached genesis on 2026-03-17. Post-launch, the mainnet bundle was upgraded to Node 1.0.0 in July 2026, and node-operator guidance was published in May 2026 for adapting to an externally-imposed Cardano-side hard fork, though no post-event outcome report was retrievable. Mainnet window is still short at about five months, and there is no demonstrated coordinated upgrade under live attacker pressure.

Midnight Foundation (Switzerland) and Input Output are the named institutional leads. Two additions since baseline: a formal Midnight Improvement Proposal process launched 2026-08-04 with defined stages from Idea through Editor Vote, a named accountable author requirement, GPG-signed commits, a minimum two-week community-commentary window and editor votes, a real coordination venue that carries no PQ content yet; and Midnight Foundation plus Input Output staff are named initial committers of the NightStream post-quantum proving-system lab under Linux Foundation Decentralized Trust, which has a published scope and a named sponsor. Still no Foundation-internal PQ migration working group and no named PQ-lead with a migration mandate.

No adversarial-pressure coordination event in the short history. The proof-system migration was planned, not attack response.

No community honeypot, no rate-limited spending rule, no cryptographic tripwire, no automated-response mechanism.