Quantum safety

Every key on this site so far rests on one assumption: nobody can work backwards from a public key to its private key.

Quantum computers could, in principle, break that assumption. This page explains the threat, what Pearl has built against it, and, just as important, what is and isn’t switched on today.

What is a quantum computer?

A quantum computer uses quantum physics to compute in a fundamentally different way. It isn’t faster at everything. It is enormously faster at a handful of specific math problems.

Unfortunately, one of those problems is exactly the one elliptic-curve keys rely on.

What could one break?

Signatures. A large enough quantum computer, running a method called Shor’s algorithm, could compute a private key from its public key on curves like secp256k1. With the private key, it could sign anything, including transactions that spend your coins.

Hashes, much less. Hash functions such as SHA-256 and BLAKE3 hold up far better. The best known quantum attacks weaken them somewhat, but don’t break them.

When? Nobody knows. Machines anywhere near large enough haven’t been shown publicly. The worry is about the long term, and about coins that sit untouched for years.

Where is your public key exposed?

Remember from the keys page: a normal Pearl address, starting prl1p, contains a public key itself, slightly tweaked.

So a strong enough quantum computer could, in principle, attack a Taproot address straight from the blockchain, even if its coins had never been spent. That’s equally true of Taproot addresses on Bitcoin.

What is XMSS?

XMSS is a signature scheme built only from hash functions. Since hash functions resist quantum attacks, XMSS is believed to be post-quantum: safe even against large quantum computers.

It comes with two trade-offs.

A limited number of signatures. Picture a booklet of single-use stamps. Each stamp can sign exactly once, and the booklet is bound together, using a Merkle tree, so that one public key covers every stamp. Pearl’s booklets hold 32 stamps. Using a stamp twice would leak the key, so the software must keep careful track.

Big signatures. An XMSS signature is 2,340 bytes. A Schnorr signature is 64.

Make a guess

Why can't you keep using one XMSS key forever, like a normal key?

Think of your answer first, then check it.

Reveal the answer

Answer Each key holds only 32 one-time signatures.

An XMSS key is really a bundle of one-time keys under a single public key. Each one-time key may sign only once; signing twice with the same one would give away enough to forge signatures. After 32 signatures the bundle is used up, and the coins should move to a new key.

How does Pearl use XMSS?

Pearl adds a new instruction to its Script language: OP_CHECKXMSSSIG, opcode 0xde. It checks an XMSS signature inside an output’s hidden spending rules. Bitcoin has no such instruction.

Pearl also supports P2MR outputs, with addresses starting prl1z. A P2MR output locks coins to a tree of spending rules with no public key in it at all. Pair it with an XMSS rule, and nothing on the way to spending the coins depends on elliptic curves.

P2MR follows a draft Bitcoin proposal, BIP-360, which Bitcoin hasn’t adopted. On Pearl, it has been valid since the first block.

Is my wallet quantum-safe today?

Here is the honest status, as of Pearl v1.5.2, the version this site checked.

• Default addresses: no. Every address the Pearl Desktop Wallet creates, and every change address, is an ordinary Taproot address protected by a Schnorr key alone.
• XMSS is opt-in. Oyster, the wallet program, can create a post-quantum address when asked (getnewaddress with pq=true). It looks like any other prl1p address. Inside, the normal Schnorr key still works, and an XMSS key is tucked away as a backup spending rule. Because the Schnorr key still works, a quantum attacker could use it too, so this is a backup, not full protection.
• Signing with XMSS isn’t wired up yet. A search of the v1.5.2 code found no wallet command that signs with the XMSS key; the wallet spends these addresses with the normal key.
• The wallet doesn’t make P2MR addresses. P2MR works in the rules, and a few P2MR outputs exist on the chain, but they were made by other software.

So the building blocks have been in Pearl’s rules from day one. Using them by default is still to come. If quantum safety matters to you, watch Pearl’s release notes rather than assuming any address is already protected.

XMSS signatures per key

32

XMSS signature

2,340 bytes

sent as five 468-byte pieces

XMSS public key

64 bytes

Opcode

OP_CHECKXMSSSIG (0xde)

P2MR addresses

prl1z…

no public key inside

Default addresses

Taproot (prl1p…)

Schnorr only

That’s the end of the main guide. The last page points to where you can go from here.