My thoughts and experience on post quantum chains using lattice signatures from the start

I spent the last couple of months working on a chain, forked from QRL, that signs everything with ML-DSA-87 instead of elliptic curves. Most networks still use the curves Shor’s algorithm is built for. It does not make guessing harder. It solves the discrete log. A large enough quantum computer would forge the signatures that currently protect keys and the history that depends on them. That part is clear. What I wanted to see was what the engineering actually looks like once you stop talking about the threat and start producing blocks under the new sizes.

ML-DSA-87 is the highest parameter set. The public key is 2,592 bytes and the signature is 4,627 bytes. A normal ECDSA or Ed25519 signature is roughly 64 to 72 bytes. Every validator duty and every ordinary transaction carries something on the order of seventy times larger. Storage grows. Bandwidth grows. Gas accounting has to absorb the extra bytes. Wallets have to handle seeds and keys that are no longer tiny. There is no smaller version of this parameter set that still hits the same security level. The numbers are fixed in the standard.

I decided to use it for both validator duties and ordinary spending accounts and to keep the two keys separate. The spending account comes from a 51-byte seed. The validator key is a different ML-DSA-87 key that lives in a signer on the machine the operator runs. It never sits in the browser wallet. A spending seed is not a validator key. There is no classical signature sitting next to the lattice one as a fallback.

I also mixed a light hash search into the proof of stake. I call it an ergon. It is Keccak-256. The hash covers the chain id, the slot, the parent block, the payout address, and a nonce. One answer can be included in the block the stake already assigned. In the first four years the finder gets 17 KALYX and the validator who includes it gets 3. A block with no answer mints nothing. A missed slot stays empty and mints nothing. The block number does not jump the gap. Stake still chooses who may write the block. About every 10 seconds. Eight slots make an epoch. You need 40,000 KALYX effective balance to enter as a validator. One key counts at most that much. At 20,000 the chain can eject the key. At most eight new validators activate in one epoch.

Supply starts with 500,000,000 at genesis. Up to another 500,000,000 can be created only when a block includes an ergon. The ceiling is 1,000,000,000. After that nothing more is minted. Base fees can burn supply back down toward 500,000,000 and then they stop. Coins that are not moved from wallets are not burned. The tip still goes to the proposer. A private note is a second balance of the same coin. Shielding is the last public view of those coins. A later payment hides the amount. The account that holds the note is still named. Lose the note and the coins cannot come back. The check is hash-based. It does not replace the ML-DSA-87 signatures.

I also wrote a standard for what I call Super Intelligence Validators. A model can draft what the next block should contain and send that draft to a signer. The signer holds the ML-DSA-87 key and can refuse. The model never sees the key. The private testnet currently runs two ordinary genesis validators. No model is signing. The agent fleet is not switched on. A follower node can check and relay what those two publish. Turning a follower off does not stop them. A follower also cannot keep the chain writing if both of them are down.

None of this is audited yet but I’m working towards that. The public testnet is live and producing blocks. I’ve set the testnet chain id to 21520. The same chain id can be started again from a new genesis and old history does not carry over. Testnet coins are for trying the protocol.

The interesting part for me has been building with the choices in the open. No classical fallback. Empty slots that stay empty. Separate keys so a model can draft without ever touching the signing key. Acceptance that every block carries kilobytes of signature material. Starting with the larger signatures as the default removes a class of migration headaches later. It also means higher per-transaction overhead forever.

Most existing chains are still years away from anything like this on mainnet. A few have started putting Falcon or ML-DSA accounts out. They are still early. I have mostly been running nodes, using the wallet and explorer, and watching what the bigger payloads actually feel like in practice. The seed stays in the tab until you save the file. Public sends show the account, the amount, the fee, and the block. Private notes work the way the docs describe. Whether the trade-off is worth it depends on how soon the quantum threat becomes real and how much you care about not living through a long dual-key or hybrid period in the middle. For now it is just useful to have something actually running the numbers instead of only talking about them.

If you’re interested in checking out the chain and providing feedback, let me know and I would be more than pleased to discuss further.