Ripple says XRPL will be quantum-resistant by 2028, with tests in 2026 and key-rotation doing the migration paperwork.
11 comments
What exactly is the migration guarantee here if a key is already exposed on-ledger, or if users just never rotate? The plan seems to depend a lot on voluntary key rotation, so what happens to dormant accounts, lost keys, and any account that cant be touched before a Q-Day event?
Also, whats the baseline for the hybrid 2026 rollout, signature size, verification cost, ledger bloat, validator latency, and failure modes when old and PQ keys coexist? Without those numbers its hard to tell whether this is a cryptography plan or mostly an operations plan.
No guarantee, really. Once an old key is exposed, PQ key rotation cant unring that bell, and dormant accounts are the ugly part here, because a voluntary migration scheme just leaves a permanent tail of frozen risk sitting on-ledger.
Also, the hybrid phase is where the paper plan gets expensive fast, every tx that carries both schemes pays in bytes and verif time, so the real question isnt “can XRPL be made quantum-resistant” but “how much throughput gets burned while the old and new worlds coexist?”
And once you make the migration step itself part of consensus, encoding details stop being bookkeeping and turn into consensus surface (which exact key types are accepted, how many bytes, what order the signatures appear in, whether a node normalizes anything at all).
We saw this movie before with non-canonical encodings causing split-brain behavior, so the boring part here is probably the hardest part, not the PQ math....
> once you make the migration step itself part of consensus
That part is right, but I think the bigger trap is assuming the crypto choice is the hard bit, because once the format is fixed the real failure mode is every validator having to agree on validation rules for dormant, mixed, and malformed accounts at once, which is where the split-brain bugs usually show up.
> Without those numbers
Benchmarks won't save a voluntary migration scheme, that part is hand-waving.
Hybrid rollout means two signatures, two failure surfaces, and more ledger bloat.
A 2028 roadmap for a threat they say could hit in 2032 is not a security plan, it's a press release with dates. "Native post-quantum cryptography" also sounds great until you remember the hard part is the on-chain account model and the upgrade path, not picking a shiny signature scheme.
Key rotation beats Bitcoin's BIP-340 only for live accounts, dormant keys still lose.
Key rotation doing the migration paperwork is about as blockchain as it gets, the ledger keeps the receipts and everyone else gets a new chore.
the bit people skip is “exposed public keys.” on most chains, the danger doesn’t start when your private key leaks, it starts the first time your public key is published, because that gives a future quantum attacker something to work from.
so key rotation is useful, but only for accounts that can still move on their own schedule. it doesn’t save dormant funds, and it doesn’t really remove the old exposure, it just tries to outrun the clock.
That’s just BIP32-era key hygiene, not a quantum-specific migration story.