New SHRINCS Bitcoin Improvement Proposal brings quantum resistance with notable compromises
A recently released Bitcoin Improvement Proposal for SHRINCS achieves a 13-fold reduction in hash-based post-quantum signature sizes, though implementation involves added complexity and important compromises.
Adam Back, CEO and co-founder of Blockstream, has earned a name for himself as someone skeptical about quantum computing, maintaining the view that this technology remains too underdeveloped to pose a realistic danger for many decades to come.
This makes it particularly intriguing that his organization stands among the frontrunners in investigating workable answers to this challenge. Earlier this year, Back shared with Cointelegraph that taking a proactive approach and preparing for this potential threat far ahead of time represents "the safe thing" to do.
Blockstream has already demonstrated that its experimental post-quantum signature methodology known as SHRINCS functions successfully in a production environment on its Liquid sidechain, and earlier today, a Bitcoin Improvement Proposal for SHRINCS received publication.
Jonas Nick from Blockstream Research characterized it as "the first concrete proposal for a post-quantum signature scheme designed specifically for Bitcoin." However, he noted that "SHRINCS is not intended to be Bitcoin's 'final' signature scheme, and it is not optimal along every axis.
"I do think it is a very good trade-off among the options we have now."
Though experts continue to vigorously debate the exact timeframe, there exists scientific consensus that quantum computers of sufficient advancement will possess the capability to derive private keys from their corresponding public keys, consequently compromising Bitcoin's fundamental security model and facilitating the theft of billions in value. This reality explains the urgent push to create methods for upgrading Bitcoin to protect it against such attacks.
Reducing post quantum signature dimensions
Among Blockstream's most encouraging research directions has been the optimization of post-quantum signature schemes tailored to Bitcoin's specific needs, allowing the blockchain to retain more of the fundamental characteristics that Bitcoiners value most.
The existing generation of post-quantum secure signature schemes based on hash functions and lattices that have received endorsement from the National Institute of Standards and Technology range from 38 to 123 times the size of Bitcoin's current ECDSA and Schnorr signatures.
Implementing any of these schemes within Bitcoin would potentially reduce the blockchain's throughput to below 1 TPS. The post-quantum development team working on Ethereum intends to address this challenge through signature aggregation utilizing a compact zero-knowledge proof for every block. This approach is also being evaluated for Bitcoin, and successful implementation would actually result in Bitcoin operating more quickly than its current state, since a single proof consumes less block space than multiple individual signatures. However, in the context of Bitcoin's ecosystem, incorporating zero-knowledge proofs would represent a considerably radical modification and would encounter substantial resistance in gathering sufficient community support for activation.
While Blockstream is evaluating that possibility as well, it has prudently decoupled this proposal from the significantly more acceptable alternative of determining methods to reduce the dimensions of NIST-approved hash-based post-quantum signatures by approximately 13.23 times.
Smaller signatures optimized for Bitcoin
During December 2025, Blockstream's research team members Jonas Nick and Mikhail Kudinov introduced the SHRINCS signature scheme, with the opcode proposal receiving publication in May. This hash-based post-quantum signature scheme features a minimum dimension of 548 bytes (in addition to the 48 byte public key) though it has the potential to expand to as much as 4,619 bytes.
"SHRINCS is the most Bitcoin-native post-quantum signature design anyone has produced," Marin Ivezic, who authors PostQuantum.com and founded Applied Quantum, explains.
"[It has] full BIP-39 seed recovery, and security resting on the same SHA-256 assumptions Bitcoin mining already depends on."
In his conversation with Magazine, he indicates the scheme remains in its early developmental phase and has not undergone formal auditing, nor has it received the benefit of years of public cryptanalysis that the NIST signatures have endured.
Yet he maintains that even in this preliminary stage, it represents a legitimate competitor.
"It is real code that has signed real transactions on Liquid mainnet, and I rate it the strongest answer yet to going post-quantum without wrecking Bitcoin's block economics."
Even though it's considerably more compact than the majority of post-quantum signatures, SHRINCS will nonetheless be approximately nine times the size of Bitcoin's present Schnorr signatures, which measure 64 bytes, or the earlier ECDSA signatures, which measure 70 bytes.
One might reasonably conclude that a signature nine times the size of current ones would necessitate Bitcoin's block size expanding nine times to maintain throughput, but Ivezic clarifies this isn't accurate because of Bitcoin's Segregated Witness.
"Under SegWit, signature bytes fit in the witness and take a quarter as much as other transaction data," he says.
Based on calculations published in Blockstream's previous research (utilizing marginally different parameters), Bitcoin has the potential to operate at 6.5 transactions per second if all users adopted Taproot's Schnorr signatures (currently about 80% of users don't). The blockchain's throughput would decline to 0.5 TPS if Bitcoin implemented the NIST-approved lattice-based signature ML-DSA and to merely 0.36 TPS utilizing the NIST-approved hash-based signature SPHINCS+.
However, by deploying SHRINCS, the blockchain would be capable of running at 3 TPS, which closely resembles current performance.
SHRINCS underwent production testing on the Liquid sidechain during March this year — they even embedded a copy of the Bitcoin white paper. Therefore if it functions in production settings, everything is resolved and Bitcoin's quantum challenges are addressed, correct?
What are the drawbacks of SHRINCS?
According to the BIP's warning, "a security proof is TODO" indicating that while the research shows promise, it does not yet constitute a cryptographically mature proposal that has undergone complete validation.
It also brings additional layers of complexity to Bitcoin.
Each signature employs a fresh one-time key, and among the factors making SPHINCS+ so large is its wrapping of all those one-time keys within a multi-layered hash tree structure that renders the scheme stateless.
SHRINCS eliminates all of that structure to conserve space, and simply maintains a record of used keys on your device (which is referred to as stateful) enabling rapid verification that keys aren't being reused. The disadvantage is that signatures expand by 16 bytes with each use, and should you lose your device, it necessitates a substantially large "stateless fallback" transaction of approximately 5,777 bytes for recovery.
Yoon Auh, who founded BOLTS Technologies, observes that in minimizing the size, SHRINCS' creators introduced "statefulness, compact signing paths, fallbacks, assumptions about how many times a seed is initialized, and rules for when devices must switch to larger stateless signatures."
"That may be pragmatic engineering, but it is also complexity and fragility introduced largely to maximize throughput and minimize computation cycles. In Bitcoin, every new consensus rule becomes a permanent maintenance obligation, and every wallet-side assumption becomes a possible user failure mode."
Improving SHRINCS and incorporating SHRIMPS
Throughout 2026, Blockstream has conducted research and performed optimizations on the scheme. Only last week, it showed that SHRINCS, along with a variety of other post quantum signature schemes, can efficiently operate on commonly available hardware wallets. The BIP includes a warning however that this carries certain risks:
SHRINCS keys generated using hypertree pruning for the stateless component are not compatible with SHRINCS implementations which do not support hypertree pruning. In fact, importing a key across such incompatible implementations may result in lost funds.
During March, the laboratory released a complementary scheme designated SHRIMPS, intended for use alongside SHRINCS to allow backup devices initialized from identical seeds to possess transaction signing capability. The SHRIMPS designation has since been retired for the BIP, with the scheme now incorporated as an integrated stateless path utilizing the same 48 byte public key. Optimization has been achieved with a non-standard parameter set resulting in approximately 26% size reduction compared to alternatives.
Blockstream has additionally been testing lattice-based signature schemes, which typically offer smaller sizes than hash-based schemes but are regarded as less thoroughly proven and less dependable. The organization is also evaluating the implementation of ZK proof aggregation for signatures. Its calculations suggest that if ZK proofs are deployed together with SHRINCS, Bitcoin's throughput could potentially double to 6.7 TPS.
Blockstream has strategically separated the signature selection decision from questions surrounding block size increases or ZK proof aggregation implementation, as bundling them together could potentially derail SHRINCS adoption. Every post quantum upgrade proposed for Bitcoin will generate controversy and face difficulties in assembling adequate support for activation.
"The binding constraint in Bitcoin's quantum migration isn't cryptography, it's governance," says Ivezic. "Between BIP-360, BIP-361, SHRINCS and STARKs, the engineering menu is filling up fast. What Bitcoin lacks is a mechanism for choosing from it before the clock runs out."