When this week’s Ethereum rebuild proposal promoted “quantum resistance” to a headline priority, it turned a research adjective into an engineering commitment - and engineering commitments are checkable. So, patiently: what a sufficiently large quantum computer actually breaks, what it provably doesn’t, and what “migrating” means when the thing being migrated is a trust assumption.
The clean split
Everything reduces to which hard problem a construction leans on. Shor’s algorithm breaks the discrete-logarithm and factoring families - which takes down elliptic-curve signatures (every current wallet key) and, closer to this desk’s beat, pairing-based cryptography: Groth16 verification, PLONK with KZG commitments, and the KZG scheme securing blob data - the very parameters 141,416 people ceremonied into existence. Against hash functions, quantum computers get only Grover’s square-root speed-up, which a modest parameter bump absorbs. The split is that clean: pairings fall, hashes hold.
Why STARKs keep coming up
STARK-family systems commit with hash functions and need no trusted setup - so the construction this desk has repeatedly described as “paying in kilobytes for transparency” turns out to have bought post-quantum survival in the same purchase. The proof-size tax and the hash-conjecture caveats we have covered still apply; the quantum immunity is the third column in a trade-off table that suddenly matters more.
What migration actually means
Three different jobs hide inside the word, in ascending difficulty. Signatures: swap curve keys for hash-based or lattice schemes - conceptually ready (standards exist), operationally brutal, because every account must act. Proof systems: route proving through hash-based constructions - the live path, since the recursion techniques behind 2025’s real-time milestone can wrap a pairing-based proof inside a STARK today, and the Foundation’s own 2026 security targets are written in exactly this direction. Existing commitments: the genuinely hard one. Data already committed under KZG cannot be waved into a hash scheme; it must be provably re-committed, in flight, without a trust gap - which is why this desk called it the migration’s honest core in our rebuild coverage, and repeats it here where the mathematics lives.
The timeline question, handled like adults
No one can date the arrival of a cryptographically relevant quantum computer, and this desk will not pretend to. What is datable is the defensive logic driving the schedule anyway: harvest-now-decrypt-later means encrypted or committed data with a long shelf life is already exposed to a future adversary, and coordinated migrations of live billion-user systems take the better part of a decade - the 3-4 year horizon in the proposal is optimistic even if the threat stays theoretical throughout. Preparing early is not alarmism; it is arithmetic on coordination time.
GO DEEPER
- The two families - our SNARKs-and-STARKs explainer, whose trade-off table just grew a column.
- The ceremony - what the 141,416 built, and what a quantum adversary would unmake.
- The rebuild, scored - the Blockchain Desk’s shipped/scheduled/sketched reading of the full proposal.
