Trezor says quantum-resistant bitcoin wallets face a state-tracking problem

What happened

Hardware wallet manufacturers are working through the practical consequences of a post-quantum signature scheme that Bitcoin researchers are converging on, with Trezor's chief technology officer describing how much of the burden will fall on device makers rather than users. Tomáš Sušánka made the remarks in a recent appearance on MARA Foundation TV, as reported by Decrypt and Unchained.

The scheme at the center of the discussion, SHRINCS, lets users sign transactions in one of two ways. The stateful route relies on a tree of one-time signatures that are small and efficient but must never be signed with twice; a second use exposes enough cryptographic material for an attacker to forge the user's signature and take the funds. The stateless route avoids that hazard but produces much larger signatures, which can affect fees and signing speed.

Because the stateful path depends on precise bookkeeping of how many signatures remain, Sušánka argued that error-proofing belongs with the people building the wallets. Giving users a choice they can mishandle is a risk his company intends to design around, he said, adding that keeping the state correct should not be the customer's responsibility.

One option Trezor is considering is to make the slower, larger stateless signatures the default for everyone and expose the smaller stateful signatures only through advanced settings. Sušánka said he remains uncertain about the choice, since the stateful signatures are roughly ten times smaller than their stateless counterparts but come with the difficulty of maintaining state across devices.