BMIC vs Horizen (ZEN) 2026 —
Is BLS12-381 Quantum Safe?

Executive Summary

Horizen (ZEN) is a Zcash-derived blockchain launched in May 2017 (originally ZenCash) with ambitions to become a multi-sidechain ecosystem via the Zendoo protocol and Eon EVM sidechain. Despite its technical sophistication, every cryptographic layer Horizen uses is vulnerable to quantum attack via Shor's algorithm:

The multi-layer architecture that makes Horizen technically interesting also means it carries four simultaneous quantum attack surfaces — a combinatorial risk profile not shared by simpler single-layer ECDLP chains.

BLS12-381 Is Not Quantum Safe — The Misconception Explained

BLS12-381 is widely regarded by developers as a "newer" and "more secure" curve than secp256k1. This perception is partially correct in the classical sense — BLS12-381's main advantage is efficient signature aggregation via bilinear pairings, not improved security level. In the quantum context, BLS12-381 is no safer than secp256k1.

Why BLS12-381 Falls to Shor's Algorithm

BLS12-381 is a pairing-friendly elliptic curve defined over a prime field GF(p) where p is a 381-bit prime. It supports an efficient bilinear pairing e: G1 × G2 → GT, where G1 and G2 are elliptic curve subgroups and GT is a multiplicative subgroup of a finite field extension. BLS aggregate signatures work by computing g^(sk) ∈ G1 from a secret key sk ∈ Zr — recovering sk from the public key g^(sk) is the ECDLP on G1, which Shor's algorithm solves in polynomial quantum time.

Additionally, the bilinear pairing maps elements into GT — a subgroup of GF(p^12). The Discrete Logarithm Problem in GT is also quantum-vulnerable via Shor's algorithm. There is no component of BLS12-381 that relies on a lattice, hash, or other post-quantum hard problem.

The Zendoo Certificate Forgery Risk

Zendoo uses BLS12-381 aggregated signatures to anchor sidechain state to the mainchain. The aggregation is done by sidechain certificate submitters who sign batches of sidechain data using their BLS12-381 private keys.

The "More Secure Than secp256k1" Misconception

BLS12-381 offers approximately 128 bits of classical security — the same as secp256k1. The choice of BLS12-381 provides signature aggregation and pairing efficiency, not enhanced security against quantum adversaries. No elliptic curve — regardless of bit size, field characteristic, or pairing structure — resists Shor's algorithm. The quantum security of an ECDLP-based scheme is zero, not proportional to the classical security level.

Groth16 zk-SNARKs — Zero-Knowledge ≠ Quantum Resistance

Horizen's shielded transaction pool (inherited from Zcash Sapling) uses Groth16 — a pairing-based zk-SNARK proof system. Groth16 proofs are ~200 bytes and verify in milliseconds. But Groth16's security model is entirely classical.

What Groth16 Actually Protects

A Groth16 proof convinces a classical verifier that a prover knows a valid witness (e.g., a spending key) without revealing it. This protects transaction privacy from classical observers. However, Groth16 does not protect underlying secret keys from a quantum adversary who can solve the ECDLP directly — bypassing the proof system entirely.

Trusted Setup Quantum Vulnerability

Groth16 requires a trusted setup ceremony ("Powers of Tau") generating a Structured Reference String (SRS). The SRS consists of elliptic curve points computed using secret "toxic waste" values assumed destroyed after setup. The security of the SRS relies on the discrete logarithm problem being hard: given [α]₁ = α·G₁, recovering α requires solving ECDLP on G₁.

ZK Proofs as a Quantum Misconception

A common misconception is that zero-knowledge proofs provide quantum resistance because the proof "doesn't reveal information." This confuses two separate security properties: (1) zero-knowledge — a proof reveals nothing to a classical verifier about the witness; (2) soundness — a proof cannot be forged by a bounded adversary. A quantum adversary does not need to learn information from the proof — it attacks the underlying elliptic curve keys and SRS directly. The ZK property is orthogonal to quantum resistance.

Horizen HNDL Timeline — 9+ Years of Quantum-Vulnerable Data

How a CRQC Would Drain Horizen — Four Attack Vectors

Vector A: Transparent ZEN Wallets (secp256k1)

1. Harvest: Download all mainchain transparent transactions. Extract secp256k1 public keys from all outputs since May 2017.
2. Compute: Run Shor's ECDLP algorithm. Recover private keys for targeted wallets.
3. Drain: Broadcast transfers from victim wallets before countermeasures activate.

Vector B: Zendoo Certificate Forgery (BLS12-381)

1. Harvest: Collect all published BLS12-381 public keys from Zendoo certificate submitters (on-chain, publicly visible).
2. Compute: Solve ECDLP on BLS12-381 G1/G2. Recover sidechain certifier private keys.
3. Forge: Create fraudulent Zendoo cross-chain certificates claiming non-existent sidechain withdrawal proofs.
4. Drain: Submit forged certificates to mainchain, extracting ZEN from the sidechain withdrawal fund.

Vector C: Sapling Shielded Pool Trusted Setup (Groth16/BLS12-381)

1. Harvest: Download the published SRS from Horizen's Sapling trusted setup ceremony.
2. Compute: Solve ECDLP on BLS12-381 to recover SRS "toxic waste."
3. Forge: Generate valid Groth16 proofs for arbitrary fake shielded withdrawal proofs.
4. Drain: Submit forged proofs to drain the entire shielded pool — all existing shielded notes at risk of inflation attack.

Vector D: Eon EVM Wallets (secp256k1)

1. Harvest: Collect all secp256k1 public keys from Eon EVM transactions.
2. Compute + Drain: Recover private keys, drain Eon wallet balances and smart contract-controlled funds.

Why Horizen Migration Is Structurally Complex

Layer 1: Transparent Tx (secp256k1 → ML-DSA)

Feasible via hard fork. ML-DSA (Dilithium) signatures are ~2,420 bytes vs secp256k1's ~71 bytes — a 34× size increase. Migration race condition risk: old wallets vulnerable to CRQC before owners can migrate. Historical secp256k1 outputs permanently on-chain.

Layer 2: Zendoo BLS12-381 → PQC Aggregated Signatures

No NIST-standardised post-quantum signature scheme supports BLS-equivalent aggregation. NIST FIPS 204 (ML-DSA) signatures do not aggregate natively — replacing BLS in Zendoo certificates would require accepting O(N) certificate sizes or complete protocol redesign. This is an architectural redesign, not a parameter swap.

Layer 3: Groth16 SNARKs → PQC-Compatible ZK Proofs

No post-quantum replacement for Groth16 maintains equivalent proof size and verification speed. STARKs (hash-based ZK proofs) are quantum-safe but produce proofs of 40–200 KB vs Groth16's ~200 bytes — a 200–1000× size increase. Historical SRS points remain permanently on-chain and vulnerable to toxic waste recovery via CRQC.

Layer 4: Eon EVM (secp256k1 → ML-DSA)

Same migration challenge as Ethereum mainnet, plus the cross-chain bridge between Eon and mainchain must be migrated simultaneously to avoid bridge exploit windows during transition.

Technical Comparison: BMIC vs Horizen (ZEN)

Frequently Asked Questions

More BMIC Quantum Comparisons