BMIC vs Secret Network (SCRT) — Quantum Security Comparison 2026

Why "Intel SGX = Quantum Safe" Is Wrong

Intel SGX (Software Guard Extensions) is a Trusted Execution Environment that creates isolated memory regions ("enclaves") on a processor. Code and data inside an enclave are protected from the host OS, hypervisor, and all other processes — even a root-privileged attacker on the same physical machine cannot read enclave memory in plaintext. This is a powerful classical security guarantee.

But quantum computers do not attack Intel SGX enclaves. A cryptographically-relevant quantum computer (CRQC) running Shor's algorithm attacks the mathematical keys that govern what data enters and exits those enclaves — not the enclave memory itself.

In Secret Network's architecture, data is encrypted by the client before being sent to the network using an x25519 Diffie-Hellman (ECDH) key exchange. The client generates an ephemeral x25519 key pair, uses DH to derive a shared secret with the network's consensus key, and encrypts the contract input under ChaCha20-Poly1305. The ephemeral public key is published on-chain as part of the transaction. It is permanently, publicly archived.

A CRQC applies Shor's algorithm to that archived ephemeral public key — solving the Curve25519 elliptic curve discrete logarithm problem (ECDLP) — and recovers the corresponding private key. This immediately yields the DH shared secret and, from it, the ChaCha20 decryption key for every input that used that ephemeral key. The SGX enclave that processed the contract never needed to be touched.

The enclave's confidentiality guarantee is meaningless once the key exchange is broken offline.

Secret Network's Four Quantum Attack Surfaces

1. x25519 Diffie-Hellman — Contract Input Encryption (ECDLP)

Every private transaction submitted to a Secret contract generates an ephemeral x25519 key pair. The client computes shared_secret = x25519(client_ephemeral_sk, network_consensus_pk) and encrypts the input under ChaCha20-Poly1305(key=HKDF(shared_secret)). The client_ephemeral_pk is stored permanently on-chain as part of the transaction record. Shor's algorithm on a CRQC solves client_ephemeral_sk = Curve25519-DL(client_ephemeral_pk) in polynomial time, yielding shared_secret and decrypting the entire input. Every ephemeral key in the six-year on-chain history is a distinct CRQC target. This is a pure HNDL attack — no real-time access to the network required.

2. secp256k1 ECDSA — Cosmos Wallet Transaction Signing

All SCRT token transfers, delegation, undelegation, IBC transfers, and governance votes are signed with standard Cosmos SDK secp256k1 ECDSA private keys. Cosmos wallet addresses are derived from secp256k1 public keys via SHA-256 + RIPEMD-160 + Bech32 encoding. Every Cosmos address that has ever sent a transaction exposes its secp256k1 public key on-chain. Shor's algorithm recovers the private key from the public key, enabling the CRQC holder to forge any transaction signed by that account — draining SCRT balances, undelegating staked tokens, or submitting governance votes.

3. ed25519 Tendermint Validator Keys (Curve25519 ECDLP)

Secret Network uses Tendermint BFT consensus with ed25519 validator consensus keys. Ed25519 is based on the Edwards form of Curve25519 — the same elliptic curve underlying x25519 DH. Shor's algorithm solves the Curve25519 discrete logarithm for ed25519 keys with the same complexity as for x25519. A CRQC recovering a validator's ed25519 consensus key can forge arbitrary BFT votes — vote, prevote, precommit — enabling equivocation (double-signing), liveness attacks, or manipulation of finality for any Secret Network block. This is a protocol-level threat beyond individual account theft.

4. Network Consensus Key — HKDF Master Key (x25519)

The Secret Network consensus nodes share a master x25519 key (the "consensus_io_exchange_pubkey") used as the long-term DH counterpart for all contract input encryption. While this key is managed inside SGX enclaves and is never directly exposed, it is derived from secp256k1 or ed25519 keys in the node's key management chain. A CRQC that compromises the underlying key derivation chain could potentially recover the master x25519 key — enabling bulk decryption of all historical encrypted contract state across all contracts simultaneously, not just per-transaction targets.

HNDL Timeline — Secret Network's Encrypted Corpus at Risk

4-Step CRQC Attack Path Against Secret Network

Technical Comparison Table: BMIC vs Secret Network

Migration Complexity: Why SCRT's PQC Path Is Particularly Hard

For most blockchains, a post-quantum migration means replacing one cryptographic layer — the transaction signing key (e.g., secp256k1 → ML-DSA). Secret Network must replace at least three independent cryptographic layers, each with distinct engineering challenges:

Layer 1 — Contract Input Encryption Protocol (x25519 → ML-KEM)

Replacing x25519 DH with ML-KEM (FIPS 203) for contract input encryption requires redesigning the entire Secret contract communication protocol. The current design is tightly coupled to x25519 ECDH's ephemeral key pair model — a symmetric approach not available in ML-KEM's KEM (Key Encapsulation Mechanism) framework. A new protocol must be specified, implemented inside SGX enclaves (which constrains available SGX-compatible PQC implementations), audited, and deployed. This is a breaking change to the Secret contract ABI — existing contracts must be redeployed. Migration cannot be backward-compatible: the old x25519 interface must be deprecated simultaneously to prevent hybrid downgrade attacks.

Layer 2 — Cosmos SDK Wallet Keys (secp256k1 → ML-DSA)

The Cosmos SDK ecosystem (which Secret Network inherits) has no official ML-DSA key type. Replacing secp256k1 in Cosmos requires upstream SDK changes, new address formats (ML-DSA-65 public keys are 1,952 bytes vs 33 bytes for secp256k1 compressed — a 59× increase), new transaction envelope formats, a coordinated hard fork, and a migration window during which old secp256k1 addresses remain functional (elevated risk period). Every user must generate new PQC addresses and sweep funds — inactive accounts with no key owner available remain permanently stuck on secp256k1.

Layer 3 — Tendermint Validator Consensus Keys (ed25519 → ML-DSA)

Tendermint's consensus protocol is architected around ed25519 for vote signing. Replacing ed25519 with ML-DSA-65 in Tendermint core requires changes to the Tendermint consensus engine (or CometBFT, the current Cosmos consensus layer), new block header formats, validator key migration, and re-evaluation of safety thresholds under increased signature size. Validator key migration must be coordinated across the entire active validator set — any validator running old ed25519 keys after the cutoff creates a consensus safety risk.

The Historical HNDL Problem Cannot Be Solved

Even a perfect three-layer migration leaves the historical HNDL corpus permanently exposed. Every encrypted contract input, every SNIP-20 private token balance query, every Secret NFT bid, and every private DeFi position submitted between September 2020 and the migration date is forever archived on-chain with its x25519 ephemeral public key. No migration can retroactively delete on-chain history. A CRQC arriving after the migration still decrypts all pre-migration private data. For SCRT users who submitted sensitive financial, medical, or identity data to private contracts, this is a permanent disclosure risk — not a temporary one.

Compare Other Blockchains vs BMIC

Secret Network is not alone in carrying quantum risk. Explore our full comparison library: