SUI · L1 · STAGE 1 ACKNOWLEDGED · QRI 29 v3.1.0 methodology

In plain terms

What it is. Sui already proved it can add a whole new way of signing transactions by upgrading the live network, so its plumbing for switching to quantum-safe protection is among the most capable we reviewed.

What we found. That capability sits almost entirely on paper: nothing quantum-safe is switched on yet, and the part where validators agree on each block has no plan at all for the change.

Why it matters. Until the switch is actually flipped, every account and every validator stays openable by a future quantum computer, and the one corner with no plan is the hardest to fix in a hurry.

Sui's flag-byte signature dispatcher (Ed25519, ECDSA secp256k1/r1, BLS12-381, MultiSig, zkLogin, Passkey) is a strong agility template, validated by adding secp256r1 post-launch via protocol upgrade. The Mysticeti v2 batched-BLS-in-consensus design is performance-elegant but PQ-fragile: no spec exists for replacing BLS in the aggregation path. Architecture-Execution Gap is 46.

inLinkedIn ↷Audit access ⇆Compare Verified 2026-05-01

Summary

Sui scores QRI 29, Band 3 Planning, Migration Stage 1. Mainnet (genesis 2023-05-03) runs Ed25519 (flag 0x00, default account signing), ECDSA secp256k1 (flag 0x01), ECDSA secp256r1 / P-256 (flag 0x02), MultiSig (flag 0x03), zkLogin (flag 0x05, Groth16 + RSA-signed JWTs), and Passkey (flag 0x06). Consensus authority signing uses BLS12-381 in minSig mode (96-byte pubkey, 48-byte signature) with proof-of-knowledge at validator registration. Move runtime verifies Groth16 over both BN254 and BLS12-381. Every signing primitive at consensus, account, and ZK-verification layers is Shor-breakable. The Mysten Labs cryptography-research bench is the strongest L1 in the pilot, peer-reviewed ePrint 2025/1368 (Post-Quantum Readiness in EdDSA Chains, ACM CCS 2025 poster) proposes using the EdDSA seed as a ZK witness to authorize a new PQ key without changing addresses. Truncator targets gas-friendly hash-based signatures. Both are paper-stage, not deployed. Sui Foundation PQ blog frames migration as a multi-year journey without dates. The decisive gap is Dim 5 / Dim 4 spread (60 − 14 = 46): excellent architecture, near-zero deployment. The 4f BFT aggregation-path is the most consequential blind spot, no published replacement for Mysticeti v2's batched BLS.

What the gates say

Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition AND or OR; multi-scheme classical signing exists but no classical+PQ hybrid spec on a dated track
Gate 1a, Hybrid KEM: FAIL , TLS handshake on validator-to-validator and RPC links uses classical KEX Curve25519/X25519; no hybrid PQ KEM declared
Gate 1b, Commit-to-hash: COND , no OR-composition declared
Gate 2, Evidence reconstruction: PASS , every sub-score is reconstructible from cited public artifacts within 48 hours
Gate 3, Primitive naming: PASS , every primitive named, Ed25519, ECDSA secp256k1/r1, BLS12-381, Groth16/BN254, SHA3-256, Blake2b-256, ML-DSA, Falcon, SPHINCS+ in research

Burn-vs-rescue policy on file

Declared option f, Undeclared. The Mysten Labs ePrint paper Post-Quantum Readiness in EdDSA Chains (2025/1368) describes a (b)-style structural rescue path, using the EdDSA seed as a ZK witness to authorize a new PQ key without changing the address. This is the only public artifact pointing toward a Sui rescue strategy. It is not foundation policy and has no implementation timeline. No freeze, no burn, no rate-limit canary, no STARK rescue, no optional-migration sunset declared.

Seven dimensions

Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.

1 Cryptographic Exposure weight 15% 41 / 100

1a · primitive inventory 16 / 20

Sui publicly documents every primitive in active production use. Naming and specificity excellent. Minor deduction because Sui does not publish a single canonical primitive-inventory page.

Primitives: Ed25519 (flag 0x00, RFC 8032 with SHA-512) · ECDSA secp256k1 (flag 0x01, SHA-256) · ECDSA secp256r1 / P-256 (flag 0x02) · MultiSig (flag 0x03) · zkLogin (flag 0x05, Groth16 + RSA-signed JWTs) · Passkey (flag 0x06) · BLS12-381 in minSig mode (consensus authority signing, 96-byte pubkey, 48-byte signature, with KOSK) · Groth16 over BN254 (Move runtime ZK verification) · Groth16 over BLS12-381 (Move runtime ZK verification) · SHA-256, SHA3-256 (default protocol hash), Keccak256, Blake2b-256 · Ed25519 keys for QUIC TLS in Narwhal primary/worker and consensus networking

1b · shor grover pq tag 4 / 20

Every signing primitive in production at the consensus layer, account layer, and ZK-verification layer is Shor-breakable. zkLogin compounds exposure.

Tags:

Ed25519 (account) → Shor-break-via-DL-without-pairings
ECDSA secp256k1 → Shor-break-via-DL-without-pairings
ECDSA secp256r1 → Shor-break-via-DL-without-pairings
BLS12-381 (consensus authority sigs) → Shor-break-via-pairings
Groth16 over BN254 → Shor-break-via-pairings
Groth16 over BLS12-381 → Shor-break-via-pairings
zkLogin (Groth16 + RSA-signed JWTs) → Shor-break (RSA + pairing-friendly)
SHA-256 / SHA3-256 / Blake2b-256 → Grover-weaken (256→128-bit)
TLS handshake on QUIC → Shor-break (DL/EC; no PQ KEM declared)

1c · family diversity 5 / 20

Families represented in production: 0 PQ families. The Mysten Labs-authored ePrint 2025/1368 names Falcon and ML-DSA as candidate replacements and Truncator targets hash-based (Lamport-class) signatures, i.e. there is named research-stage diversity intent without deployment. Per rubric this is 0 deployed; the 5 reflects partial credit for paper-stage family commitment.

1d · nist security category 4 / 20

Ed25519 ~128-bit classical; secp256k1 ~128-bit; secp256r1/P-256 ~128-bit (NIST FIPS 186-5); BLS12-381 ~128-bit; Groth16/BN254 ~100-bit (BN254 below 128-bit security floor under recent TNFS analysis); SHA3-256/Blake2b-256 128-bit Grover-resistant. No NIST PQ category mappings exist for production primitives.

1e · implementation quality 12 / 20

Sui's cryptographic primitives ship via fastcrypto (Rust), a Mysten Labs-maintained wrapper around well-vetted upstream crates. Ed25519 uses ed25519-consensus (ZIP-215 compliant). secp256k1 uses libsecp lineage. External audits by Common Prefix on Pedersen DKG and tBLS implementations within fastcrypto, plus Groth16. No machine-checked formal verification of the cryptographic library. Production primitives are tier 1; Groth16/BN254 is tier 4.

2 Quantum Recovery Exposure weight 10% 40 / 100

Forge subtotal: 30/75 Decrypt subtotal: 10/25

2a · active key exposure 8 / 25

Sui's account model exposes the public key the moment an account first transacts (the address is Blake2b(flag || pubkey), but signing requires revealing the pubkey). Mainnet age ~32 months. No P2PKH-style quiet hashing, pubkeys are revealed in tx envelopes. TVL is concentrated in active accounts; treasury and exchange holdings are signed-on-demand.

2b · cold key exposure 12 / 25

Younger chain than Bitcoin/Ethereum → smaller dormant surface. Foundation and Mysten Labs holdings operated under classical schemes (Ed25519/secp256k1). Sui has no native pubkey-hashing-only resting state for inactive accounts, once a key has signed, the pubkey is on chain and Shor-recoverable.

2c · sig long term validity 10 / 25

All historical signatures are Ed25519/secp256k1/secp256r1/BLS12-381, every one Shor-forgeable post-CRQC. Sui's checkpoint history (~2 years) is not anchored to a PQ commitment, so a future quantum attacker could in principle forge historical certificates against a non-checkpointed full-node sync.

2d · encryption confidentiality hndl 10 / 25

Validator gossip uses QUIC with TLS handshake performed under Ed25519 keys; standard TLS ciphersuites apply (X25519 KEX, no PQ KEM declared). RPC traffic (gRPC over TLS 1.3) likewise relies on classical KEX. No declared PQ-KEM hybrid on validator-to-validator or validator-to-RPC links.

3 Metadata, Anonymity & Confidentiality weight 13% 32 / 100

3a · tx graph visibility 6 / 25

Transparent ledger. Object-centric model means each owned object is traceable to its current owner; transfers are linkable on chain. Sui has no native shielded-pool protocol. zkLogin proves OAuth-issuer linkage but does not anonymize the on-chain graph.

3b · rpc mempool concentration 10 / 25

Top RPC providers for Sui: MystenLabs public RPC, BlockVision, Shinami, Triton, Suiscan/SuiVision. No public composite share data, but anecdotally MystenLabs + BlockVision + Shinami account for the bulk of dapp traffic. Sui has a fast path for owned-object transactions and a consensus path for shared-object transactions; mempool gossip observable on consensus-path validators.

3c · cross chain bridge correlation 8 / 25

Sui's two primary bridges are Sui Bridge (native, secured by the Sui validator set) and Wormhole/Portal (multi-chain). LayerZero/Stargate is also active. All three produce on-chain correlations between source-chain and Sui addresses; passive observers can link both legs. No bridge in this set declares a PQC roadmap.

3d · retroactive de anonymization 8 / 25

A future Shor-equipped adversary recovers private keys from any address whose public key has been revealed (every active Sui address). Combined with the transparent graph, this enables full retroactive ownership attribution. zkLogin's privacy boundary against the OIDC issuer is preserved, but a quantum adversary breaking RSA on the issued JWTs could potentially forge zkLogin claims.

4 Migration Architecture weight 10% 60 / 100

4a · crypto agility 12 / 15

Sui's signature dispatch is built around a unified flag-byte + enum wrapper. Native multi-scheme support is in production today: four classical schemes (Ed25519, secp256k1, secp256r1, BLS12-381 in Move runtime, plus zkLogin and Passkey) coexist, mixable inside MultiSig accounts. Adding a new scheme is a protocol upgrade, coordinated through Sui's epoch-based protocol versioning. secp256r1 was added post-launch via protocol upgrade, demonstrating the agility path is real.

4b · aa key rotation 13 / 20

Sui has zkLogin (OAuth-issued account abstraction), Passkey signatures, and MultiSig. Sui does not have ERC-4337-class general AA, and key rotation primitives are tied to address-derivation. The structural pivot is the Mysten Labs ePrint paper 2025/1368 proposing using the EdDSA seed as the witness in a zero-knowledge proof to authorize a new PQ signature without changing addresses or hard-forking. Paper-stage, not deployed.

4c · hard fork track record 12 / 15

Sui has shipped multiple coordinated protocol upgrades since mainnet (May 2023): Mysticeti v1 (mid-2024) and Mysticeti v2 (2025). Upgrades are version-gated at epoch boundaries with validator coordination. No contested forks. Validator participation in upgrades is high (>90% by stake within target epoch).

4d · hybrid deployment readiness 8 / 15

Architecturally, the multi-scheme dispatcher could host ML-DSA-65 alongside Ed25519 for hybrid signing today. Move runtime can verify Groth16 over BN254 and BLS12-381, adding lattice verifiers is incremental work at fastcrypto level. No hybrid is announced on a dated track: no SIP, no testnet, no validator opt-in flag. The Sui Foundation blog frames PQC as a multi-year journey without dates.

4e · stateful hash state management 15 / 15

Sui does not use any stateful hash-based scheme today (no XMSS, LMS, leanXMSS at consensus). Sui's research interest in hash-based signatures via Truncator targets stateless schemes.

4f · bft aggregation path 0 / 20

Mysticeti v1 collected per-transaction BLS signatures; Mysticeti v2 batches BLS signatures inside consensus blocks. Sui sits firmly inside 4f scope (BLS aggregation in consensus). The Sui Foundation's PQ blog and the Mysten Labs cryptography-agility blog discuss ML-DSA, Falcon, and SPHINCS+ as account-signing candidates but do not address the BLS-aggregation-in-consensus replacement path. There is no published spec for replacing BLS12-381 in Mysticeti's batched-aggregation path. Score = 0 (undeclared).

5 Deployment Execution weight 22% 14 / 100

5a · mainnet pqc traffic pct 0 / 25

0%. No PQC primitive is deployed on Sui mainnet at the account-signing, consensus-signing, ZK-verification, or KEM layer.

5b · pqc code in consensus client 2 / 15

fastcrypto is the cryptographic library used by sui-node. The library is extensible by design but does not contain merged ML-DSA, ML-KEM, Falcon, or SLH-DSA implementations. PQ-relevant code in the Mysten Labs orbit consists of the Truncator experimental repo (out-of-tree research) and the EdDSA-PQ ePrint (no public reference implementation linked to a Sui branch).

5c · validator pqc key adoption 0 / 15

Zero validators on Sui hold or use PQC keys for consensus signing. All 100+ validators sign Mysticeti consensus blocks under BLS12-381.

5d · published dated milestones 0 / 10

VOIDED to 0 per v3.1 rule (5a = 0). Sui's public PQ communications cite the NIST timeline as an external anchor, but Sui itself has not published dated milestones, no testnet flag day, no mainnet PQ pilot date, no validator-PQ-key target. The most concrete dated artifacts are research papers.

5e · pqc washing delta 12 / 15

Trailing-12-month foundation / Mysten-Labs / podcast announcements: ~6-8 PQ-themed posts, talks, and press hits. Shipped PQ bytes: 0. Sui's announcements are mostly capability claims (agility, EdDSA seed-based migration is possible) rather than deployment claims; modest deduction for the volume of quantum-ready framing relative to zero deployed bytes, no cap-65 trigger because Sui does not claim production PQC today.

5f · signature footprint multiplier 0 / 20

Undisclosed. Sui has not published bytes-per-block projections for ML-DSA-65 or SLH-DSA-128s under Mysticeti v2, nor for hybrid Ed25519+ML-DSA at the account layer. Truncator's compression work (5-12% reductions) is not deployment.

6 Supply Chain Vendor Readiness weight 22% 10 / 100

6a · wallet 2 / 25

Top-3 Sui wallets by user share: Sui Wallet (Mysten-maintained), Suiet, Phantom (multi-chain, added Sui support). None publishes a PQC roadmap.

6b · bridge 3 / 25

Top-3 Sui bridges: Sui Bridge (native, validator-secured), Wormhole/Portal, LayerZero/Stargate. None has a public PQC roadmap. Sui Bridge inherits Sui validator cryptography (BLS12-381).

6c · custodian 3 / 25

Top-3 institutional custodians supporting SUI: Coinbase Custody, BitGo, Copper. None has shipped PQC-MPC custody. Fireblocks and Anchorage also active; same status.

6d · rpc hsm tee infra 2 / 25

Top-3 Sui RPC providers: MystenLabs RPC, BlockVision, Shinami. No PQC roadmap declared. HSM vendors used by validators are standard YubiHSM / AWS KMS / Thales, none with shipped PQ-key-storage. No TEE-attestation-PQ pipeline declared.

7 Governance & Coordination weight 8% 48 / 100

7a · validator stake distribution 11 / 20

~116 validators (H1 2025 data), >100 in 2026. Top validator holds ~2.9% of total stake. ~75% of SUI is staked. Validator set is permissioned-by-application (Foundation Delegation Program gates new entrants). Single canonical implementation of the Sui node, single-client risk is real.

7b · upgrade cadence under pressure 13 / 20

Mysticeti v1 (2024) and Mysticeti v2 (2025) ship within tight epoch-coordinated windows. Multiple protocol-version bumps per year. No under-pressure precedent (no zero-day-driven emergency upgrade documented).

7c · named coordination lead 14 / 20

Named: Sui Foundation (governance / grants / community), Mysten Labs (engineering). Engineering lead figures: CEO of Mysten Labs, CPO, CTO (Move language designer), Chief Cryptographer. Mandate is published. No formal Sui Improvement Proposal track equivalent to AIPs/EIPs is in place, protocol changes are coordinated through Mysten/Foundation channels.

7d · adversarial coordination precedent 10 / 20

No precedent of coordinated cryptographic change under live attacker pressure. Multiple smooth upgrades demonstrate baseline coordination capacity. No emergency-cryptographic-rotation drills disclosed publicly.

7e · canary tripwire mechanism 0 / 20

No canary, no rate-limited spending rule, no cryptographic tripwire embedded in Sui consensus. No public proposal for one.

X + Y vs Z, when does the math turn against you?

v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?

X, signature shelf life

5–15 years (active TVL, treasury, exchange holdings)

Y, migration time

4–8 years to Stage 5 from 2026, given structural agility advantage but absence of dated milestones, vendor coordination, and BFT-aggregation-path resolution

Z10 (10% CRQC year)

2030

Z25 (25% CRQC year)

2035

Verdict

X+Y range 2031–2041, median 2036, Outside risk window vs Z25 2035; Crisis Zone vs Z10 2030

Z-compliance

Outside compliance window under conservative Y; reachable only on optimistic Y end (Y=4 → 2030 Stage 5)

Source-disagreement disclosure

v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.

NIST timeline vs Sui Foundation blog

Sui's blog cites the NIST 2030 deprecation / 2035 disallowance schedule as the external anchor without committing Sui-specific dates → potential gap if NIST timeline accelerates.

Mysten Labs research vs Sui Foundation policy

ePrint 2025/1368 proposes a concrete EdDSA-PQ migration path; the Sui Foundation has not adopted this paper as an official roadmap. Internal source disagreement: research is ahead of policy.

Delta-QRI under alternative weighting

Under alternative-weighting that gives more credit for cryptographic-team research output (Dim 4 weighted at 15%, Dim 7c at 25/100 of Dim 7), Sui's QRI lifts by approximately +3-4 points (32-33) but remains in Band 3 Planning.