BIP SHRINCS

2026-08-26T22:26:00+00:00

We published BIP SHRINCS, the first concrete proposal for a post-quantum signature scheme designed specifically for Bitcoin. The draft BIP turns what began as a rough idea into exact algorithms with an executable reference implementation. The discussion can now focus on analyzing, criticizing, and improving a concrete proposal.

The BIP makes choices ranging from major design questions, such as whether to support flexible XMSS and how to balance signature size against verification time, to the many smaller decisions involved in saving a byte here or there. All of these choices are up for debate.

A lot more work lies ahead:

The draft BIP specifies only the cryptography. Using SHRINCS in Bitcoin Script will require a separate BIP.
We are working on a security proof for the exact construction and parameters.
Wallet integration and user experience, for example around backups and recovery after state loss, are still at an early stage.

SHRINCS is not intended to be Bitcoin’s “final” signature scheme, and it is not optimal along every axis. I do think it is a very good trade-off among the options we have now.

Thanks to Mike Casey, conduition, Ethan Heilman, Mikhail Kudinov, Oleksandr Kurbatov, Boris Nagaev, and remix7531 for their contributions. The announcement is on the bitcoin-dev mailing list.

Background

SHRINCS combines a stateful and a stateless hash-based signature scheme. The signer primarily uses the stateful scheme and falls back to the stateless scheme when the signing state is unavailable, for example after seed recovery. In the current version of the draft BIP, stateful signatures are 548 to 4,619 bytes, depending on the shape of the signer’s tree and how often the key has signed, and stateless signatures are 5,777 bytes. These numbers may still change.

The stateful scheme is limited to a single device. SHRIMPS addresses multiple devices: assuming an upper bound on the number of devices initialized from the same seed (e.g., 1024), any of them creates signatures of about 2.5 KB, three times smaller than SLH-DSA. Combined, the primary device signs with SHRINCS and backup devices with SHRIMPS, all from the same static seed backup.

At OP_NEXT 2026, I presented a toy proposal for hash-based signatures in Bitcoin that includes SHRINCS (video, slides). remix7531 and I also published libshrincs, a proof-of-concept C implementation of WOTS+C, the one-time signature used by SHRINCS. Its machine-checked proofs connect the C implementation to an unforgeability theorem, which does not yet give a full post-quantum security bound.

Hash-Based Signatures for Bitcoin

2025-12-09T14:59:00+00:00

Mikhail Kudinov and I at Blockstream Research published Hash-based Signatures for Bitcoin, an analysis of post-quantum signature schemes. The paper is a gentle introduction to hash-based schemes and explores how to optimize them for Bitcoin.

Hash-based signatures are conceptually simple and rely solely on hash functions, a primitive Bitcoin already trusts. NIST has standardized SLH-DSA (SPHINCS+), but the paper investigates alternatives that are better suited to Bitcoin’s needs. It explores in detail how optimizations and parameter choices affect size and performance. Signatures can be reduced to about 3–4 KB, which is comparable to the lattice-based ML-DSA.

The paper also discusses:

trade-offs between stateless and stateful schemes,
compatibility with HD wallets,
limitations of current approaches for multi- and threshold signatures,
security targets.

We welcome feedback, particularly on hardware performance requirements and standardization choices. The scripts that generate the parameter analysis are on GitHub.

Category: post-quantum | nickler's

BIP SHRINCS

Background

Hash-Based Signatures for Bitcoin