Sui Sets Post-Quantum Signature Roadmap for Accounts and Onchain Vaults

Sui plans to add two post-quantum digital signature options to its blockchain, creating separate security paths for everyday accounts and high-value smart-contract vaults while allowing users to retain their existing recovery phrases.

The network intends to add ML-DSA-65 as an opt-in native signature scheme for regular accounts and SLH-DSA-SHA2-128s inside Move smart contracts for vault-style custody. Both algorithms belong to families standardized by the U.S. National Institute of Standards and Technology.

Sui is targeting quantum-safe smart-contract vaults for mainnet deployment in 2026, ML-DSA-65 accounts on testnet by the end of the year and native account authentication on mainnet in the first quarter of 2027. Those are roadmap targets, not features that users can assume are live today.

What Happened

Sui said the two-signature design is intended to address different operational and security needs. ML-DSA-65 would become a native protocol option for ordinary accounts. SLH-DSA-SHA2-128s would be implemented through Move smart contracts for high-value assets, providing a second approach based on different mathematical assumptions.

The network also described a migration path designed to reduce user disruption. Because Sui account keys are derived deterministically from a seed, users are expected to be able to generate a post-quantum key from the recovery phrase they already hold. Sui's address-alias system would then allow an account to update its authorization key without transferring assets to a new address.

That distinction is important. Blockchain security migrations can create operational risk when users must move assets, change addresses or manage multiple recovery procedures. A design that preserves the user's existing recovery material and account identity could simplify the transition, although wallets, custodians and applications would still need to implement and test the new functionality.

Why Quantum Computing Matters for Blockchains

Most major blockchains use digital signatures based on elliptic-curve cryptography. A public key allows the network to verify that a transaction was authorized by the corresponding private key without revealing that private key.

A sufficiently capable quantum computer running Shor's algorithm could, in theory, derive private keys from exposed public keys and forge valid signatures. Current quantum computers are not considered capable of breaking production blockchain keys, but cryptographic migrations can take years to design, standardize, implement and coordinate.

Blockchain accounts present a specific long-term issue because public keys may remain visible onchain after an account signs a transaction. An attacker can archive those keys now and wait for more capable quantum hardware. If the underlying signature scheme becomes breakable before the account migrates, the attacker could attempt to reconstruct the private key and authorize a fraudulent transaction later.

This risk differs from the better-known practice of collecting encrypted data for future decryption. Blockchains depend on signatures for authorization and ownership, so the relevant future threat is forgery. The timing remains uncertain, but migration readiness is increasingly treated as an engineering requirement rather than a prediction that a cryptographically relevant quantum computer is imminent.

How the Two Signature Schemes Work

ML-DSA is the Module-Lattice-Based Digital Signature Algorithm specified in NIST's FIPS 204 standard. Sui plans to use the ML-DSA-65 parameter set, which NIST associates with its third security category. Lattice-based signatures can provide comparatively efficient verification, but their public keys and signatures are much larger than those used by common elliptic-curve systems.

SLH-DSA is the Stateless Hash-Based Digital Signature Algorithm specified by NIST in FIPS 205. It is based on SPHINCS+ and relies on hash-function security rather than the lattice assumptions behind ML-DSA. Sui plans to use the SLH-DSA-SHA2-128s parameter set for smart-contract vaults.

Using mathematically distinct schemes creates a form of diversification. A future weakness in one family would not automatically compromise the other. Sui said the smart-contract implementation could also be changed as standards evolve without requiring a core protocol upgrade for every revision.

The tradeoff is size and cost. Post-quantum public keys and signatures are substantially larger than Ed25519 keys and signatures. FIPS 205 lists a 7,856-byte signature for SLH-DSA-SHA2-128s. Larger transaction data can increase bandwidth, storage and verification burdens. Smart-contract execution also introduces costs and complexity that must be measured under real network conditions.

Migration Without New Addresses

Sui's proposed migration path depends on two existing design characteristics: deterministic key derivation and address aliases.

Deterministic derivation means the same recovery phrase can be used to generate cryptographic keys according to an agreed method. Sui says users will be able to derive the new post-quantum key from the recovery material they already possess, avoiding the need to create and protect a second phrase solely for the transition.

Address aliases separate an account's stable identifier from the key currently authorized to control it. In practical terms, an account could replace its vulnerable authorization key while maintaining the address, history and application relationships associated with that account.

The design can reduce asset-transfer risk, but implementation details still matter. Wallets must derive and store the new keys correctly. Hardware devices and institutional custody systems must support larger signatures and new signing operations. Applications must recognize the new authorization methods. Recovery, revocation and multi-signature policies also need to be tested before high-value users can rely on the system.

Institutional and Custody Implications

For custodians, asset managers and treasury operators, post-quantum readiness is a governance problem as much as a cryptographic one. Institutions need an inventory of exposed keys, account types, signing devices, recovery procedures and vendor dependencies before they can plan a migration.

Sui's two-track model could let institutions place high-value assets in a conservative hash-based vault while using native ML-DSA accounts for more frequent transactions. That separation resembles traditional risk-tiering, where cold storage and operational wallets use different controls.

However, a standardized algorithm does not make a full custody system secure by itself. Key generation, random-number quality, hardware implementation, transaction policy, access controls and recovery operations can all introduce vulnerabilities. Independent code review and operational testing will be necessary as Sui's implementation becomes available.

The roadmap could also influence other blockchain projects. Networks with fixed address formats or limited cryptographic agility may face more disruptive migrations. Sui is presenting its account architecture as an advantage, but the practical value will depend on whether wallets and applications adopt the new schemes and whether users can migrate without confusing or unsafe workflows.

Risks, Limits, and Open Questions

The most important limitation is timing. Sui has announced target dates, but the features are not all live. Development, audits, testing and ecosystem integration may change the schedule.

Performance is another open question. Post-quantum signatures increase transaction size, and the smart-contract vault path may add execution overhead. Benchmarks under production-like workloads will be needed to quantify fees, latency and throughput effects.

There is also a migration-coordination risk. Opt-in security can protect users who act, but inactive accounts may remain on classical keys. The network, wallets and custodians will need clear tooling and communication to identify exposed accounts and help users update authorization before a credible threat emerges.

Finally, cryptographic standards evolve. Sui's choice to use two NIST-standardized families reduces reliance on a single mathematical approach, but neither standardization nor diversity eliminates implementation bugs or future cryptanalytic advances.

What Comes Next

The first milestone is the planned 2026 mainnet deployment of quantum-safe smart-contract vaults. That should provide an early environment for high-value users and security researchers to evaluate the SLH-DSA implementation.

Native ML-DSA-65 accounts are targeted for testnet by the end of 2026, followed by mainnet authentication in the first quarter of 2027. Before those milestones, the market should watch for code releases, audit reports, wallet support, benchmark data and detailed migration documentation.

Institutional users will also need guidance from custody providers and hardware-wallet vendors. Support at the protocol level is only one part of the stack, and users cannot adopt a new signature scheme safely if their signing devices, policy engines or recovery systems do not support it.

The Bottom Line

Sui's roadmap is a concrete attempt to move post-quantum preparation from research into an operational blockchain migration. Its most notable feature is not simply the choice of NIST-standardized algorithms, but the plan to preserve recovery phrases and account identities while offering distinct controls for ordinary accounts and high-value vaults.

The work remains forward-looking. Deployment dates are targets, adoption will be optional and larger signatures impose real costs. Even so, the proposal gives developers, custodians and asset owners specific milestones against which to evaluate Sui's quantum-readiness claims.