OASIS NETWORK · PRIVACY-FOCUSED CHAIN · STAGE 0 UNAWARE, NO PQC AWARENESS IN ANY PRIMARY OASIS FOUNDATION SOURCE · QRI 25 v3.1.0 methodology

In plain terms

What it is. Oasis keeps its private transactions secret by locking them inside sealed secure-hardware chips rather than by scrambling them with privacy math, and it has done no work to get ready for quantum computers.

What we found. A future quantum computer would not crack the hardware lock itself, but it could fake the trust-proof that vouches for those chips, letting an attacker pose as a genuine chip and pull out private data stored long ago.

Why it matters. Holders and builders relying on Oasis for confidentiality should assume secrets recorded today can be exposed later, since nothing on the project's published plans points toward fixing this.

Privacy-focused L1 with three runtime ParaTimes (Sapphire, Cipher, Emerald) on a CometBFT Ed25519 consensus core. Confidentiality on Sapphire and Cipher rests on Intel SGX TEE hardware isolation + Deoxys-II AEAD encryption + X25519 ECDH for client-runtime sessions, NOT on cryptographic privacy primitives. The ECDSA-based DCAP attestation chain and X25519 client-runtime key agreement are Shor-vulnerable.

inLinkedIn ↷Audit access ⇆Compare Verified 2026-05-01

Summary

Oasis Protocol scores raw QRI 25, after-cap QRI 25, Band 3 (Planning, borderline Band 2 Acknowledged), Migration Stage 0 (Unaware). The unusual scoring case is that confidentiality on Sapphire and Cipher rests on Intel SGX TEE hardware isolation (Deoxys-II AEAD under SGX-derived seal keys, X25519 ECDH for in-flight envelopes) rather than on cryptographic privacy primitives. A CRQC does not directly break SGX seal-key AES, but it does break the ECDSA-based DCAP attestation chain that anchors the trust model and the X25519 key agreement protecting in-flight calldata, so HNDL on captured client-runtime traffic is real and attestation-chain forgery enables a path to historical sealed-state recovery. Dim 4 (51/100) earns architectural credit for ParaTime modularity, AA-equivalent encrypted-key-management contracts, default-stateless-hash credit, and N/A 4f (CometBFT Ed25519 individual signing). Dim 5 (15/100) is essentially zero PQ deployment plus full announcement-to-shipped-absence credit. Gate 1a-Sig FAIL, Gate 1a-KEM FAIL, mainnet-traffic cap, Cryptographic-Diversity cap, Architecture-Execution Gap (36 points), Milestone-Discipline cap, Supply-Chain cap all apply. Confidentiality subtotal of 6/40 rests on a relaxed TEE-as-non-quantum-hardness reading; a strict reading pushes QRI to ~22 (still Band 3, borderline Band 2). CI plus-minus 5.

What the gates say

Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition AND or OR at consensus or runtime layer; pure Ed25519 / Secp256k1 ECDSA throughout
Gate 1a, Hybrid KEM: FAIL , client→runtime channel uses pure X25519 ECDH; validator gossip and RPC TLS use pure classical KEM/DH; no hybrid PQ KEM
Gate 1b, Commit-to-hash: COND , no OR-composition exists
Gate 2, Evidence reconstruction: PASS , each sub-score has ≥3 primary URLs across the dimension
Gate 3, Primitive naming: PASS , all sub-scores name specific primitives: Ed25519, Secp256k1 ECDSA, X25519 ECDH, Deoxys-II, SHA-512/256, Keccak-256, Intel SGX DCAP ECDSA attestation

Burn-vs-rescue policy on file

Declared option f, Undeclared. No public Foundation policy on freeze, rescue, hybrid client-layer migration, rate-limit canary, or optional migration. No equivalent of Bitcoin Improvement Proposals like BIP-360 / Hourglass exists in Oasis governance documentation.

Seven dimensions

Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.

1 Cryptographic Exposure weight 12% 26 / 100

1a · primitive inventory 14 / 20

Inventory verifiable from Sapphire.sol library docs and Oasis Core ADR set. Not all attestation-layer primitives documented in Oasis foundation sources directly, SGX DCAP ECDSA attestation chain is documented by Intel.

Primitives: Ed25519 (consensus signing per CometBFT validator key spec) · Secp256k1 ECDSA (Sapphire EVM external txs and precompiles) · Secp256r1 (Sapphire Secp256r1PrehashedSha256 precompile) · Secp384r1 (Secp384r1PrehashedSha384) · Sr25519 (Sapphire precompile) · X25519 ECDH (client-to-runtime key agreement) · Deoxys-II AEAD (envelope encryption for transactions and confidential storage) · SHA-512/256, SHA-512, SHA-384, Keccak-256 · KMAC / cSHAKE / TupleHash (internal random-byte generation) · Curve25519 keypair generation · Intel SGX DCAP ECDSA attestation primitives (inherited from hardware platform)

1b · shor grover pq tag 4 / 20

Tags:

Ed25519 → Shor-break-via-DL-without-pairings
Secp256k1 ECDSA → Shor-break-via-DL-without-pairings
Secp256r1 ECDSA → Shor-break-via-DL-without-pairings
Secp384r1 ECDSA → Shor-break-via-DL-without-pairings
Sr25519 → Shor-break-via-DL-without-pairings
X25519 ECDH → Shor-break-via-DL-without-pairings
Curve25519 keypair → Shor-break-via-DL-without-pairings
SGX DCAP ECDSA attestation → Shor-break-via-DL-without-pairings
Deoxys-II AEAD → Grover-weaken (security halves; 256-bit AES-class still leaves 128-bit margin)
SHA-512/256, SHA-512, SHA-384, Keccak-256 → Grover-weaken
KMAC/cSHAKE/TupleHash → Grover-weaken

1c · family diversity 0 / 20

0 PQ-safe families (lattice 0, hash-based 0, code-based 0, isogeny 0). All PK primitives are classical elliptic-curve / discrete-log.

1d · nist security category 0 / 20

No PQC primitive deployed → no NIST category mappable.

1e · implementation quality 8 / 20

ADR-0009 documents Oasis Core's Ed25519 verification semantics, documented behavioural specification, not machine-checked formal verification. Standard implementations from upstream Curve25519/secp256k1 libraries. Library provenance: oasis-core (Go, in-house), CometBFT v0.37.x (upstream), Intel SGX SDK. No statefulness considerations. Tier 1 (classical ECC, SHA-2/3 family).

2 Quantum Recovery Exposure weight 10% 22 / 100

Forge subtotal: 17/75 Decrypt subtotal: 5/25

2a · active key exposure 5 / 20

Sapphire and Emerald accounts use Secp256k1 ECDSA, EVM model reveals public key as soon as transaction is signed. Cipher and consensus-layer ROSE accounts use Ed25519, where Schnorr-derivative scheme exposes pubkey on first spend. ROSE TVL plus Sapphire DeFi TVL is at quantum-vulnerable addresses with revealed pubkeys.

2b · cold key exposure 8 / 20

ROSE consensus-layer accounts use Ed25519 hashed addresses; Sapphire/Emerald addresses are Ethereum-style 20-byte hashes of secp256k1 pubkeys. Cold (never-spent) addresses retain pubkey-hash protection. No documented PQ-rescue policy for any unspent balance class.

2c · sig long term validity 4 / 20

All historical consensus and runtime transactions are Ed25519 / Secp256k1 ECDSA signed. Post-Shor, every historical signature is forgeable. Block-by-block hashing chain preserves order/integrity post-Shor but every Ed25519/ECDSA signature is independently forgeable.

2d · encryption confidentiality hndl 2 / 10

RPC TLS, validator gossip (CometBFT P2P), client→runtime calldata channel: all rely on classical X25519/ECDH/TLS handshake primitives. No hybrid PQ KEM deployed at any documented endpoint. Captured ciphertext-on-wire is HNDL-vulnerable.

2e · note ciphertext payload 3 / 30

Sapphire's confidentiality model is TEE-resident state encrypted with Deoxys-II under SGX-derived seal keys, not zk-style notes encrypted under public keys. HNDL surface split: (i) in-flight client→runtime calldata encrypted under X25519 ECDH session keys, every recorded encrypted Sapphire/Cipher transaction is HNDL-decryptable post-CRQC; (ii) at-rest sealed state inside enclave is encrypted under SGX seal keys (AES-class), Shor does NOT break this directly; residual HNDL surface for at-rest state goes through compromise of ECDSA-based DCAP attestation chain.

3 Metadata, Anonymity & Confidentiality weight 25% 25 / 100

Anonymity subtotal: 24/80 Confidentiality subtotal: 6/40

3a · tx graph visibility 9 / 20

Sapphire conceals transaction inputs, return values, and contract state inside SGX enclave; transaction graph at consensus layer (sender, recipient address, amount of ROSE gas paid) is visible. Cipher provides same model. Emerald is non-confidential EVM. Closer to shielded payload, pseudonymous graph than to fully shielded chain.

3b · rpc mempool concentration 8 / 20

RPC concentration: Oasis Foundation operates first-party RPC endpoints; third-party providers (Chainstack, Ankr, Figment) also active. No public top-3 RPC % share figure. Mempool gossip standard CometBFT P2P. Validator metadata retention not declared.

3c · cross chain bridge correlation 7 / 20

Sapphire integrated with Celer cBridge (lock-and-mint plus cross-chain messaging) and Wormhole. Bridges are dominant deanonymization surface for users moving value into Sapphire from a transparent chain.

3d · retroactive de anonymization 6 / 20

Privacy on Sapphire/Cipher rests on Intel SGX TEE seal keys (AES-class, Grover-weakened but not Shor-broken) PLUS ECDSA-based DCAP attestation chain. CRQC breaks ECDSA → forges DCAP attestations → attacker can impersonate legitimately-attested enclave and obtain key-manager-derived decryption keys for historical sealed state. TEE seal keys themselves not directly Shor-vulnerable, differentiates from zk-privacy chain where every encryption primitive is on Shor-broken curves.

3e · mixnet shuffle 0 / 20

No on-chain mixnet, no commit-reveal shuffle, no cMix-class structural mix-network. Sapphire's privacy model is encrypt-state-inside-enclave, not metadata-mixing.

3f · content payload encryption shelf life 0 / 20

Client→runtime payloads encrypted with X25519-Deoxys-II envelope. X25519 is Shor-broken. No PQ KEM hybrid announced, no testnet, no mainnet, no historical re-encryption plan. 0 is the floor for Shor-vulnerable PK enc with no plan.

4 Migration Architecture weight 12% 51 / 100

4a · crypto agility 4 / 15

ParaTime architecture in principle a hosting surface for future PQC-runtime. Consensus-layer Ed25519 is fixed by CometBFT v0.37.x and is not algorithm-pluggable without a fork. ADR-0009 acknowledges Ed25519 verification-semantics issues and recommends future-code consideration of FIPS 186-5 Algorithm 2 or ZIP-215, neither post-quantum.

4b · aa key rotation 9 / 20

Sapphire offers distinctive encrypted key-management contract model: confidential storage holds long-lived keypairs that authenticate via WebAuthn/hardware wallets/passkeys/multi-credential registrations. Functionally an account-abstraction-layer alternative to ERC-4337/EIP-7702, ParaTime-native. No announced PQ-safe credential type.

4c · hard fork track record 9 / 15

Mainnet upgrade log shows multiple coordinated upgrades since launch (Nov 2020): Cobalt, Damask, Eden, ParaTime additions (Sapphire mainnet 2022, Cipher, Emerald), Tendermint→CometBFT migration in oasis-core 23.0.x. No publicly visible contested-fork history.

4d · hybrid deployment readiness 4 / 15

ParaTime architecture could in theory host PQC-runtime alongside Ed25519 consensus, but no such ParaTime announced, in spec, or in testnet. Consensus layer itself has no documented hybrid-signature path.

4e · stateful hash state management 15 / 15

N/A → full credit. No stateful hash schemes (XMSS, LMS, leanXMSS) anywhere in active stack.

4f · bft aggregation path 0 / 20

N/A, Oasis consensus uses CometBFT (Tendermint-derivative) Ed25519 individual validator signing, NOT BLS aggregation. v3.1.0 explicitly lists CometBFT/Tendermint Ed25519 chains as N/A for 4f.

5 Deployment Execution weight 18% 15 / 100

5a · mainnet pqc traffic pct 0 / 25

Mainnet PQC signing traffic: 0%. No PQC primitive deployed at any consensus or runtime signing surface.

5b · pqc code in consensus client 0 / 15

oasis-core CHANGELOG (master branch through 2026-05) shows no merged PR adding ML-DSA, SLH-DSA, Falcon, ML-KEM, or any other NIST PQC primitive. CometBFT upstream at v0.37.x has no PQC consensus signing.

5c · validator pqc key adoption 0 / 15

0% of consensus validators have PQC keys actively used. Consensus key spec is Ed25519 per CometBFT validator-key format.

5d · published dated milestones 0 / 10

VOIDED to 0 by v3.1.0 rule because 5a = 0. 2025 Oasis Roadmap (Jan 2025) does not mention PQC, ML-DSA, ML-KEM, lattice, hybrid signatures, or quantum. Roadmap focus areas are Sapphire, ROFL adoption, TDX support, decentralized-AI deployments.

5e · pqc washing delta 15 / 15

Announced PQC items (trailing 12mo): 0. Shipped PQC: 0. No claim, no shipped delta. Full credit because no inflated narrative exists.

5f · signature footprint multiplier 0 / 20

No PQ signature in mainnet → no observed bytes-per-block multiplier → undisclosed → 0.

6 Supply Chain Vendor Readiness weight 18% 14 / 100

6a · wallet 4 / 25

Top-3: Oasis ROSE Wallet (first-party); MetaMask (Sapphire EVM via custom RPC); Keplr (consensus-layer ROSE). 0 top-3 vendors with PQC roadmap → minimum-floor 4 for foundation-operated infrastructure presence.

6b · bridge 3 / 25

Top-3: Celer cBridge (primary asset bridge); Wormhole; first-party Oasis Bridge. 0 top-3 with PQC roadmap.

6c · custodian 4 / 25

ROSE supported on Coinbase exchange. Specific institutional custody partnerships not enumerated as Oasis-specific. None of those custodians has published MPC-PQ roadmap.

6d · rpc hsm tee infra 3 / 25

RPC: Oasis Foundation endpoints + Chainstack + Ankr/Figment. HSM: standard validator HSM tooling, no Oasis-specific PQC HSM integration. TEE: Intel SGX (production runtime); Intel TDX (planned per ROFL roadmap). Intel SGX/TDX attestation chain is ECDSA-based; no PQ-attestation roadmap published by Intel.

7 Governance & Coordination weight 5% 40 / 100

7a · validator stake distribution 8 / 20

~120 active validators on consensus committee. Per third-party analyst summaries, top-7 validators control ~33% of stake (Nakamoto coefficient ≈ 7). Mid-pack decentralization. Single-client risk: Oasis Core only consensus client.

7b · upgrade cadence under pressure 11 / 20

Mainnet upgrade log: Cobalt, Damask, Eden, multiple ParaTime additions, Tendermint→CometBFT migration. Coordinated upgrades on cadence; no documented under-attacker upgrade history.

7c · named coordination lead 12 / 20

Oasis Protocol Foundation is named coordination lead, with public engineering updates (monthly cadence) and roadmap publications. No PQC-specific working group or named PQ-migration lead announced.

7d · adversarial coordination precedent 9 / 20

2025 TEE Break Challenge (1 BTC bounty in Sapphire smart-contract for anyone who could extract in-enclave key, Oct 2025 - end-2025) is precedent for security-incentive coordination but not PQC-coordination precedent.

7e · canary tripwire mechanism 0 / 20

No published canary/honeypot/rate-limit/cryptographic-tripwire mechanism for quantum-attacker detection. TEE Break Challenge is one-off bounty, not embedded consensus-level tripwire.

X + Y vs Z, when does the math turn against you?

v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?

X, signature shelf life

10-20 years

Y, migration time

10-15 years to Stage 5

Z10 (10% CRQC year)

2030

Z25 (25% CRQC year)

2035

Verdict

X+Y > 2035 across reasonable bounds, Outside risk window (vs Z25 2035); Crisis Zone (vs Z10 2030)

Z-compliance

Outside compliance window, NIST IR 8547 deprecation 2030 / disallowance 2035

Source-disagreement disclosure

v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.

TEE-vs-cryptographic-privacy scoring

Where the Confidentiality sub-score lands depends on how SGX seal-key non-quantum-hardness is credited. A strict reading (TEE confidentiality is conditional on attestation chain, attestation chain is ECDSA, ECDSA is Shor-broken, therefore retroactive deanon is fully realizable) pushes 3d to 0-2/20 and 2e to 0-2/30. A relaxed reading (sealed state at-rest AES is not directly Shor-vulnerable) supports 3d at 6/20 and 2e at 3/30 as scored.

Analyst summary vs primary sources

Coinlaw.io references advancements toward post-quantum cryptography that does not match any published Oasis Foundation document. We treat primary sources as authoritative.

Delta-QRI under alternative weighting

Strict-TEE-as-Shor-broken weighting: -3 → strict-weighting QRI ≈ 22, still Band 3 (borderline Band 2). Conclusion robust to interpretation.

Announcement-to-shipped ratio

Announced: 0. Shipped: 0. Ratio: 0.

Tag: none, no inflated narrative present. Third-party analyst summary at coinlaw.io references advancements toward post-quantum cryptography but is extrapolation, not Foundation claim.