Sui Blockchain to Implement NIST-Approved Post-Quantum Cryptography

The Sui blockchain announced it is adopting two post-quantum signature schemes to safeguard its network against the emerging threat of quantum computing. The move, detailed by the Sui Foundation, aims to provide a future-proof security layer for user accounts and high-value assets by integrating algorithms approved by the U.S. National Institute of Standards and Technology (NIST).

A Proactive Defense Against Quantum Threats

The upgrade addresses the risk that future quantum computers could break the elliptic-curve cryptography that currently secures most blockchain networks, banking systems, and internet communications. Sui's announcement highlighted the specific vulnerability of blockchains, where public keys are permanently exposed on-chain after a single transaction.

This exposure creates a “harvest-now-forge-later” attack vector, where malicious actors can collect public keys today and decrypt their corresponding private keys once sufficiently powerful quantum hardware becomes available. The foundation cited a March 2026 estimate from Google Quantum AI suggesting such an attack could take mere minutes on a future fault-tolerant quantum computer.

A Two-Pronged Cryptographic Approach

To mitigate these risks, Sui is implementing a dual-algorithm strategy that rests on different mathematical principles, ensuring a weakness in one does not compromise the other. Both schemes follow the joint CISA/NSA/NIST quantum-readiness roadmap.

• ML-DSA-65 (FIPS 204): This scheme will be used for native accounts and everyday transactions. Sui is integrating a more secure variant (Level 3) in response to recent security research in the field.
• SLH-DSA-SHA2-128s (FIPS 205): This hash-based signature scheme is designated for high-value assets held in smart contract vaults. By implementing it at the contract level rather than the protocol core, Sui aims to maintain adaptability with future industry standards without requiring a core network upgrade.

Ad

Implementation and User Impact

Sui stated that its architecture was designed for “cryptographic agility,” allowing these new schemes to be added as a feature update rather than a disruptive network overhaul. For users, the transition is designed to be seamless, with no requirement to change existing recovery phrases or wallet addresses.

New quantum-safe private keys will be derived from the same recovery phrase users already possess. A feature called “address aliases” will enable accounts to update their authorization keys without moving funds or changing their public-facing address. The primary trade-off, according to the announcement, is an increase in transaction size due to the larger data footprint of post-quantum signatures.

The rollout is planned in stages:

• Quantum-safe vaults are targeted for Mainnet this year.
• Native ML-DSA-65 accounts are expected on Testnet by the end of the year.
• Full native account authentication on Mainnet is targeted for Q1 2027.

The new capabilities will be introduced as an additive, opt-in feature, following the same deployment path as previous upgrades like zkLogin and passkeys.