BMIC vs Internet Computer (ICP) 2026
Is ICP Quantum Safe?

ICP's Two Cryptographic Exposure Points

• Chain-Key Layer (BLS threshold signatures): All subnet consensus, canister authentication, and cross-chain messages are signed using BLS threshold cryptography. BLS relies on the computational Diffie-Hellman assumption in bilinear pairing groups — directly broken by Shor's algorithm. A CRQC could forge subnet signatures, impersonate canisters, and fabricate cross-subnet messages.
• User Account Layer (secp256k1 / Ed25519 / P-256): ICP user wallets and Internet Identity accounts use WebAuthn (typically secp256k1 or P-256) or Ed25519 keys. Every transaction permanently exposes the corresponding public key on-chain. Shor's algorithm can derive the private key from the public key, enabling retrospective account takeover for any address that has ever transacted.

What Makes This Unique to ICP

Most chains have only one quantum vulnerability surface: the user key layer. ICP has two: the user key layer and the chain-level consensus/authentication layer. A successful CRQC attack on ICP's BLS threshold signatures would not just compromise individual wallets — it could forge canister responses, fabricate cross-subnet calls, and undermine the integrity of the entire chain-key architecture that ICP's security model depends on. This systemic risk is qualitatively different from a simple wallet-key compromise.

What Is BLS and Why Is It Used on ICP?

BLS (Boneh-Lynn-Shacham) was selected by DFINITY for ICP's chain-key cryptography because of a key property: BLS signatures are aggregatable. Multiple validators (node machines in an ICP subnet) can each sign the same message and their partial signatures can be combined into a single compact threshold signature using bilinear pairings. This enables ICP's subnet architecture — a subset of nodes (the threshold) can sign on behalf of the whole subnet without requiring every node to participate in every signature operation.

This is architecturally elegant. But BLS security depends entirely on the computational Diffie-Hellman problem in pairing-friendly elliptic curve groups (specifically, ICP uses BLS12-381). Shor's algorithm solves the discrete logarithm problem — the foundation of BLS security — in polynomial time on a CRQC.

What a CRQC Attack on ICP's BLS Layer Would Enable

• Forge subnet consensus signatures: An attacker with a CRQC could derive the private keys underlying any ICP subnet's threshold signature and forge valid-looking subnet-level signatures — appearing to be the entire subnet.
• Fabricate canister responses: Canister smart contract responses carry BLS chain-key signatures to prove authenticity. A CRQC could forge these signatures, making fraudulent canister outputs appear legitimate to light clients and dApps.
• Compromise cross-subnet messaging (XNet): XNet calls between ICP subnets are authenticated with BLS. Forging XNet call signatures would allow an attacker to send fabricated inter-subnet messages — potentially draining DeFi pools, issuing fraudulent token transfers, or corrupting replicated state across subnets.
• Attack the NNS (Network Nervous System): The NNS governance canister itself relies on BLS-based chain-key cryptography. A CRQC attack at the BLS layer could potentially compromise NNS governance votes and parameter changes.

Internet Identity and Wallet Key Vulnerability

ICP user accounts interact with the chain through one of two paths:

• Internet Identity (II): Uses WebAuthn. The authenticator (device Secure Enclave, TPM, passkey) generates either a P-256 (prime256v1/secp256r1) key pair or a secp256k1 key pair. Both P-256 and secp256k1 are elliptic curve schemes — Shor's algorithm breaks both by solving the elliptic curve discrete logarithm problem.
• Direct wallet integrations (Plug, Stoic, NNS dapp): These wallets use Ed25519 (EdDSA over Curve25519) or secp256k1. Both are Shor-vulnerable.

Every transaction on ICP broadcasts the sender's public key to the chain, permanently. Adversaries harvesting ICP chain data today build a growing corpus of public keys that become privately-derivable once a CRQC is operational.

Harvest-Now-Decrypt-Later at ICP Scale

ICP launched mainnet in May 2021. That means more than 5 years of user public keys, subnet BLS signatures, and cross-subnet message authentication data are permanently archived on-chain and accessible to any observer — including state-level and well-resourced adversaries running HNDL (Harvest-Now-Decrypt-Later) operations today.

The ICP ecosystem hosts significant value: ICP-native DeFi (ICDex, ICPSwap), the SNS (Service Nervous System) token launchpad, ckBTC and ckETH wrapped assets, and enterprise dApps. All of this value is secured by cryptographic primitives that a future CRQC would compromise retrospectively — meaning past transactions' confidentiality and authenticity guarantees would evaporate at CRQC emergence.

FIPS 203 — ML-KEM (Key Encapsulation)

ML-KEM (Module Lattice-based Key Encapsulation Mechanism, standardised from CRYSTALS-Kyber) provides quantum-resistant key exchange. Based on the Module Learning With Errors (MLWE) problem — no known quantum algorithm achieves better than exponential time against MLWE. Replaces ECDH/ECIES-style key exchange used in legacy chains including ICP's encrypted canister state access patterns.

FIPS 204 — ML-DSA (Digital Signatures)

ML-DSA (Module Lattice-based Digital Signature Algorithm, standardised from CRYSTALS-Dilithium) provides quantum-resistant digital signatures for all BMIC transactions and authentication. Based on the Module Short Integer Solution (MSIS) and MLWE problems. Directly replaces the role that BLS threshold signatures and secp256k1/Ed25519 play in ICP's authentication stack.

FIPS 205 — SLH-DSA (Hash-Based Backup)

SLH-DSA (Stateless Hash-Based Digital Signature Algorithm, standardised from SPHINCS+) provides a stateless backup signature scheme based solely on hash function security assumptions. Unlike lattice-based schemes, hash-based security assumptions have decades of cryptanalytic confidence behind them. BMIC's three-standard architecture means no single assumption failure can compromise the system — defence in depth at the cryptographic layer.

ERC-4337 Account Abstraction — Reducing HNDL Surface

BMIC uses ERC-4337 (account abstraction) to separate transaction authorization from on-chain key exposure. Unlike standard externally-owned accounts (EOAs) where every transaction broadcasts the public key, ERC-4337's signature-hiding patterns reduce the public key material exposed per transaction — directly limiting the HNDL corpus available to adversaries even before a CRQC exists.