Post-quantum cryptography
Arrekta uses NIST post-quantum standards for everything a quantum computer would break.
| Use | Algorithm | Notes |
|---|---|---|
| Transaction signatures | ML-DSA-65 (FIPS 204), scheme 0x01 | default; public key 1952 B, signature 3309 B |
ML-DSA-87 (FIPS 204), scheme 0x02 | higher security level; key 2592 B, signature 4627 B | |
FN-DSA-512 (Falcon, FIPS 206), scheme 0x03 | reserved, not active until FIPS 206 is final | |
| Hashing | SHA3-256 with domain-separated tagged hashes | TH(tag, x) = SHA3-256(varbytes("ARRK/" ‖ tag) ‖ x) |
| P2P transport | X25519 + ML-KEM-768 hybrid key exchange, ChaCha20-Poly1305 frames | secure if either primitive holds |
| Proof of work | SHA-256d (merged with Bitcoin) | Grover only halves hash security; the quantum risk lives in signatures |
| State commitment | LtHash16 (lattice-based homomorphic hash) | instead of MuHash, which relies on discrete logs |
| Checkpoints, releases, webhooks | ML-DSA | checkpoint context ARRK-CHECKPOINT-v1; releases co-signed with ML-DSA-65 |
Keys and signatures
- A private key is a 32-byte ML-DSA seed (FIPS 204
ξ). - A serialized public key is
scheme_id ‖ raw_public_key; locks commit tokey_hash = TH("pubkey", serialized_pk). - Transaction signatures use the ML-DSA context string
"ARRK-TX-v1". Signing may be hedged (randomised), so verifiers never assume deterministic signatures. - Wallet key derivation (not consensus) uses HMAC-SHA3-512 with hardened-only paths
m/9000'/0'/account'/change'/index'. Post-quantum keys have no xpubs, so co-signers register derived public keys in signed batches.
Crypto-agility: scheme schedules
Every network defines, per scheme, an activation height, an optional no_new_outputs_height and
an optional retire_height (§8).
| Phase | New outputs | Spends |
|---|---|---|
| active | yes | yes |
| sunset | no | yes (holders migrate) |
| retired | no | no |
Retiring a weakened scheme only restricts the rules, so it is a soft fork; it must be announced a full migration window ahead and the sunset phase lasts at least 6 months of blocks. Locks publish their scheme byte or mask, so wallets and explorers can show exposure precisely. Today ML-DSA-65 and ML-DSA-87 are active from height 0 on every network, with no sunset.
The cost: size
A signed 1-input, 2-output payment with ML-DSA-65 is about 5.5 KB, which puts the mainnet ceiling at about 12 TPS (8 MB blocks every 120 s). FN-DSA-512 would make payments about 3× smaller; it will be activated through the scheme schedule once FIPS 206 is published. Longer term, STARK signature aggregation could arrive as a soft-fork lock kind. See Security layer design.