What it is. Tezos can change its own rules by a holder vote instead of a disruptive split, and in April 2026 it used that power to add a new kind of account designed to survive a future quantum computer.
What we found. That quantum-safe account is built and merged into the software, but it is switched off on the real network and only runs on a test network, so today no real funds and none of the validators that produce blocks actually use it.
Why it matters. Tezos has the upgrade machinery and a working design, yet anyone holding coins or building on it is still fully exposed until the switch is flipped on the live network, and the people running it have not committed to a date for that.
Tezos has shipped a concrete on-chain post-quantum signature pathway. The Ushuaia proposal (April 2026) introduces tz5 accounts using ML-DSA-44 (FIPS 204) and is currently feature-flagged on mainnet (testnet-only activation), with user operations supported and baking deferred. 20 activated amendments since Athens 2019, zero contested forks. Lattice-monoculture (no second hash-based or code-based fallback declared); BFT-aggregation path on the post-Tallinn consensus is BLS12-381 with no published PQ aggregation roadmap.
Summary
Tezos's Ushuaia proposal (April 2026, the 21st amendment when activated) adds a tz5 account prefix using ML-DSA-44 / FIPS 204, implemented via the libcrux-ml-dsa Rust library and merged into Octez, with mainnet feature-flagged off and testnet active. Self-amending governance (20 activated amendments since Athens 2019, zero contested forks) gives Tezos a strong migration substrate. Scoring is held back by structural choices: parallel-curve deployment rather than hybrid composition (Gate 1a-Sig fails), baking explicitly deferred (no validator PQ traffic), and 0% mainnet PQ traffic (Mainnet-Traffic cap fires). Tenderbake's post-Tallinn consensus aggregation runs on BLS12-381, Shor-vulnerable, with no published PQ aggregation path (4f = 0). Lattice-monoculture (only ML-DSA declared) triggers the Cryptographic-Diversity Cap at 60. Overall QRI 33 ± 5, Band 4 Architected, Migration Stage 2 (capped by Milestone-Discipline). The Architecture-Execution Gap of 38 binds: Tezos has built the substrate; the deployment side remains pre-mainnet. Next milestone observable on layerqu.com: Ushuaia mainnet feature-flag lift.
What the gates say
- Gate 1a, Hybrid signature: FAIL , Ushuaia ships ML-DSA-44 in a parallel account type tz5, no hybrid AND/OR composition documented; explicit statement: 'No deprecation of existing elliptic curve signatures at this stage'
- Gate 1a, Hybrid KEM: FAIL , no documented hybrid KEM in Octez transport, RPC, or DAL
- Gate 1b, Commit-to-hash: COND , no OR-composition declared
- Gate 2, Evidence reconstruction: PASS , every sub-score has ≥ 3 public artifacts except 6c, 6d which trigger evidence-density discount
- Gate 3, Primitive naming: PASS , every primitive named exactly, Ed25519/Curve25519, ECDSA/secp256k1, ECDSA/P-256, BLS/BLS12-381, ML-DSA-44, BLAKE2b, SHA-256
Burn-vs-rescue policy on file
Declared option f, Undeclared. Ushuaia explicitly states: 'No deprecation of existing elliptic curve signatures at this stage.' No public sunset date. An opt-in user migration path (move funds from tz1/2/3/4 to tz5 once mainnet flag lifts) is implicit but not codified as a sunset/freeze/burn. Self-amendment governance makes any of (a)-(e) achievable via a future amendment vote.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 15% 53 / 100
Explicit per-curve documentation; tz5/ML-DSA-44 named in the Ushuaia announcement and the Nomadic Labs forum heads-up.
Ed25519/Curve25519 (tz1) · ECDSA/secp256k1 (tz2) · ECDSA/P-256 a.k.a. secp256r1 (tz3) · BLS/BLS12-381 (tz4) · ML-DSA-44 / FIPS 204 (tz5, feature-flagged on mainnet, testnet active per Ushuaia) · BLAKE2b, SHA-256 4 of 5 deployed signature families are Shor-broken; BLS12-381 (tz4) is now consensus-relevant after Seoul/Tallinn aggregation work.
Ed25519→ Shor-break-via-DL-without-pairingsECDSA secp256k1→ Shor-break-via-DL-without-pairingsECDSA P-256→ Shor-break-via-DL-without-pairingsBLS12-381→ Shor-break-via-pairingsML-DSA-44→ PQ-safe (lattice, NIST cat 2)BLAKE2b/SHA-256→ Grover-weaken (256→128bit)
Families: lattice (1: ML-DSA via Ushuaia), classical-EC (4 deployed). Only declared PQ family is lattice. No hash-based, code-based, or isogeny path on the protocol roadmap or in the Ushuaia announcement. Lattice-monoculture Cryptographic-Diversity Cap fires (QRI ≤ 60 per v3.1).
ML-DSA-44: NIST cat 2; ECDSA secp256k1/Ed25519/P-256: 128-bit classical; BLS12-381: 128-bit classical for the discrete-log security level. ML-DSA-44 chosen at the lower NIST category (cat 2) rather than ML-DSA-65 (cat 3) or ML-DSA-87 (cat 5).
formal_verif: HACL* + EverCrypt for classical primitives in Octez (functional correctness, memory safety, secret independence i.e. constant-time); ML-DSA-44 implementation per the heads-up uses libcrux-ml-dsa (Cryspen, Rust, hax-toolchain verified components mixed with unverified components). constant_time: claimed for HACL*-backed primitives; secp256k1 imported directly from Bitcoin reference. cryptanalytic_tier: tier 1 (Ed25519/ECDSA classical), tier 3 (ML-DSA, NIST-standardized). Caveat: an independent 2026 audit (eprint.iacr.org/2026/192) of the libcrux ecosystem found 13 vulnerabilities including specification-level issues in ML-DSA proofs. Documented externally, not a Tezos-side claim.
2 Quantum Recovery Exposure weight 10% 28 / 100
Tezos uses the 'reveal' operation: pubkey is broadcast on first outgoing tx, after which it is permanently public. Vast majority of active addresses have revealed pubkeys. ML-DSA tz5 is feature-flagged off on mainnet, no active funds protected by PQ today.
Pre-reveal cold accounts (never-spent) keep pubkeys hidden behind the tz1/2/3 hash. Once Shor is feasible, an attacker would need to either find unrevealed-but-public pubkeys or wait for a spend that reveals. Lower exposure than Bitcoin P2PK / Ethereum (where pubkeys are always visible after first send). 2017 ICO-era dormant holders with revealed keys remain at risk.
Every historical signature on Tezos mainnet is under one of Ed25519/ECDSA-secp256k1/ECDSA-P-256/BLS12-381, all Shor-broken. No retroactive re-signing or commit-to-hash mechanism declared in Ushuaia.
Validator gossip and RPC use standard TLS (X25519/ECDH classical); no documented hybrid KEM (Kyber/ML-KEM) deployment in Octez transport. Ushuaia addresses signatures only.
3 Metadata, Anonymity & Confidentiality weight 13% 31 / 100
Transparent ledger by default. A Sapling-on-Tezos integration was added at the protocol layer in earlier amendments, but adoption is limited; the dominant mode is fully transparent.
Multiple RPC providers (Nomadic Labs public RPC, TzKT, TzStats, Marigold, Blockdaemon). No documented validator-metadata retention policy. Mempool gossip is observable.
Etherlink (enshrined optimistic rollup) provides Tezos↔EVM bridging at protocol level; secondary bridges (Wrap, Allbridge) connect to other chains. Linkability across these bridges is straightforward for a passive observer.
Sapling's encryption uses Jubjub (a Curve25519-derivative edwards curve); Shor-feasible attackers could de-anonymize historical Sapling notes. Limited practical impact because Sapling adoption is small.
No on-chain or protocol-layer mixnet.
4 Migration Architecture weight 10% 62 / 100
Self-amending governance has activated 20 protocol amendments autonomously since Athens 2019 (Athens through Tallinn). Ushuaia (proposal in voting phase as of April 2026, would be the 21st) introduces a new signature scheme (ML-DSA-44) and a new account prefix (tz5) without a hard fork, exactly the production instance the rubric requires. Tallinn (Jan 2026, amendment 20) similarly added a new BLS-aggregation feature.
No native AA (no ERC-4337 equivalent). Multi-curve account selection (tz1/2/3/4/5) gives per-account scheme choice at creation. The Ushuaia announcement explicitly flags that 'stateful addresses which allow for key rotation while preserving an account's address and history' are deferred to a later amendment, i.e., key-rotation is not yet shipped. Seoul (Sep 2025) introduced protocol-native multisig; this is account-flexibility but not full AA.
20 amendments autonomously activated (Athens through Tallinn), zero contested hard forks. Two proposals rejected during voting (Brest A, Carthage), orderly governance, not contested forks.
Ushuaia ships pure ML-DSA-44 in a parallel account type (tz5), not a hybrid composition with Ed25519 or another scheme. The forum heads-up explicitly states: 'No deprecation of existing elliptic curve signatures at this stage.' Architecturally Tezos can run any composition (multi-curve already in production), but no hybrid-composition spec has been declared.
ML-DSA-44 is stateless; full credit by default. Tezos does not use stateful hash schemes (XMSS/LMS) anywhere.
Tenderbake is BFT-style with deterministic finality. After Seoul (Sep 2025) and Tallinn (Jan 2026), consensus attestations are aggregated under BLS12-381 (tz4), a Shor-vulnerable scheme. The Ushuaia post-quantum proposal explicitly excludes baking ('baking support will follow later'), so the current PQ deployment path leaves consensus aggregation classical. No published spec for a PQ aggregation path.
5 Deployment Execution weight 22% 24 / 100
Mainnet PQC traffic: 0%. tz5 / ML-DSA-44 is feature-flagged off on mainnet per Ushuaia. Activation is testnet-only.
Ushuaia proposal merges ML-DSA-44 support into Octez (the dominant client) via libcrux-ml-dsa. Code is in production, gated by feature flag. Substantive code presence but not active.
ML-DSA-44 explicitly does not support baking in Ushuaia. Zero validator PQ key adoption.
VOIDED to 0 per v3.1 rule (5a = 0). Ushuaia announcement names ML-DSA-44 / tz5 / future stateful-addresses / future baking, credible roadmap without a dated public sunset.
Announcements limited to two primary artifacts (Ushuaia announcement + agora forum heads-up); shipped status (testnet feature flag on mainnet) consistent with the announcement. Ratio close to 1:1. No press inflation.
ML-DSA-44 reference signature size ~2420 bytes vs Ed25519 64 bytes, i.e. ~38× raw. Ushuaia does not publish per-block bandwidth budget under post-tz5-adoption assumptions. Falls in the 10-38× band (5pts).
6 Supply Chain Vendor Readiness weight 22% 12 / 100
Top-3: Temple, Kukai, Ledger Live (Tezos app). PQC roadmap count: 0 published. Note: current Ledger HW signers cannot process tz4/BLS at consensus speed; tz5/ML-DSA support across wallets is not announced.
Top-3: Etherlink (enshrined L2), Wrap, Allbridge. PQC roadmap count: 0.
Top-3 commonly named for Tezos staking: Coinbase Custody, Kiln, Ledger Enterprise. PQC roadmap count: 0 published for Tezos asset support specifically.
Top-3 RPC: Nomadic Labs public RPC, TzKT, Blockdaemon. HSM: Tezos uses cloud-HSM-friendly P-256 (tz3) by design; Signatory (ecadlabs) supports YubiHSM, AWS CloudHSM, AWS Nitro Enclaves, Confidential Space, none with PQC roadmap published.
7 Governance & Coordination weight 8% 66 / 100
300+ active bakers; staking is proof-of-stake with delegation. Some concentration at top stakers (Coinbase Cloud historically prominent), but distribution is reasonable for an L1. Octez is the dominant client; tezedge is a secondary Rust implementation, providing partial client diversity.
20 activated amendments since Athens 2019, with Quebec/Rio/Seoul/Tallinn all activating on schedule in 2025–2026. Cadence has been consistent across the chain's history.
Nomadic Labs publishes Ushuaia and the post-quantum heads-up under its R&D channel; Trilitech, Marigold, Functori, ecadlabs (Signatory) are named contributors; Tezos Foundation provides funding. PQ-specific WG not formally named, but Nomadic Labs R&D is the de-facto coordinator.
Founder governance dispute resolved 2018 via Tezos Foundation; subsequent governance has been on-chain and orderly. No adversarial coordinated cryptographic change under attack.
No canary, no rate-limited spending rule, no embedded cryptographic tripwire declared.
X + Y vs Z, when does the math turn against you?
v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?
Verdict
X+Y reaches 2033–2042, Crisis Zone (vs Z10 2030); borderline outside risk window at upper bound (vs Z25 2035)
Z-compliance
Outside compliance window at lower bound, under NIST IR 8547, Tezos signatures non-compliant from 2030; under EU NIS2/DORA, regulated entities must align by 2027-2030
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
Two cryptographic libraries discussed in Tezos R&D: HACL* / EverCrypt (long-standing Octez classical primitives) and libcrux-ml-dsa (Cryspen Rust, used for ML-DSA-44 per the forum heads-up). The Ushuaia announcement does not name a library; the forum heads-up names libcrux-ml-dsa. Treat as consistent.
An external 2026 ePrint paper (eprint.iacr.org/2026/192) reports specification-level vulnerabilities in libcrux ML-DSA proofs. Third-party finding, not a Tezos foundation position.
If Dim 6 (Supply-Chain) is weighted at L2-profile 25% instead of L1-profile 22%, QRI shifts ≈ -1 (more weight on the weakest dim). Cryptographic-Diversity Cap and Mainnet-Traffic Cap both bind regardless.
Delta-QRI under alternative weighting
Under L2-profile alternative weighting (Dim 6 = 25%), QRI shifts ≈ -1; caps still bind at 60.
Announcement-to-shipped ratio
Announced: 2. Shipped: 0. Ratio: 1.
Tag: none, announcements reflect a real shipped-to-testnet, code-merged-to-production state; no inflation found
Peers in the L1 profile
9 chains closest to Tezos by Stage then QRI.