Sui adds 2 NIST-approved quantum signatures before 2027 mainnet

Sui is adding two NIST-approved post-quantum signature schemes, ML-DSA-65 and SLH-DSA-SHA2-128s, with native account authentication on mainnet targeted for Q1 2027.

"Quantum resistant accounts and investment vaults with no need to change addresses," Adeniyi Abiodun, co-founder and chief product officer at Mysten Labs, said.

The two schemes rest on different mathematics, so a weakness found in one does not undermine the other. ML-DSA-65, already used by Chrome and Cloudflare to protect web traffic, will secure native accounts at NIST Level 3. SLH-DSA-SHA2-128s, a hash-based signature scheme, will protect smart contract vaults holding high-value assets. Users keep their existing recovery phrases through a new derivation path, and Address Aliases let accounts update authorization keys while holding addresses and assets in place. No forced migration, no expensive transfer of everything an account holds.

The move comes as NIST proposes deprecating traditional cryptography by 2030 and disallowing it by 2035. Google Quantum AI estimated in March 2026 that recovering a private key from an exposed public key would run in minutes on a fault-tolerant machine of under half a million physical qubits. Quantum-safe vaults are targeted for mainnet this year, with ML-DSA-65 accounts reaching testnet by year-end.

Blockchains face a distinct quantum risk because public keys are permanently exposed onchain the moment an account transacts. In most systems, an attacker needs a breach before they can start working on a key. Onchain, the key is already published, making harvest-now-forge-later collection possible without quantum hardware — just a visible key and patience.

Why the upgrade path matters

The hardest part of any cryptographic migration is not the new algorithm — it's that everyone is already using the old one. On Sui, an ML-DSA-65 private key is a 32-byte seed, the same size wallets store today, derived from the same recovery phrase through a new standard derivation path. Wallets back up and restore exactly as they do now.

The honest cost is size. A post-quantum signature and public key are substantially larger than an Ed25519 pair, which increases transaction size. ML-DSA-65 verification on Sui is close enough to Ed25519 that per-signature network cost does not rise, and Sui's transaction size limit and programmable transaction blocks absorb the rest.

Industry-wide quantum preparation

Sui's move follows a broader push across the crypto industry. On July 25, Coinbase announced it was adapting its CoreKMS key management system to a post-quantum version, aiming for partial implementation by 2027. The NIST timeline recommends deprecating traditional cryptography by 2030 and disallowing it by 2035 in favor of quantum-resistant signatures.

Post-quantum accounts arrive as an additive, opt-in capability through the same rollout path zkLogin and passkeys used. Nothing existing changes, and no application needs to do anything today. Independent audits are underway, and timelines remain open while review and testnet feedback continue.

For Sui, the upgrade is a bet that quantum-resistant infrastructure will become a competitive differentiator as institutions evaluate long-term blockchain durability. With NIST's 2030 deprecation timeline approaching, protocols that move early on post-quantum readiness may earn credibility with security-focused investors.

This article is for informational purposes only and does not constitute investment advice.