Existing Wallet Chips Meet a Quantum-Signature Test
Blockstream says benchmark implementations of several hash-based post-quantum signature schemes ran on four widely used hardware wallet families. The result does not settle the whole quantum-migration problem for Bitcoin, but it challenges the narrower claim that existing signing devices cannot produce post-quantum signatures. The remaining questions are mostly engineering questions: latency, caching, optimization and wallet security design.What Blockstream Tested
Blockstream tested whether current hardware wallets can generate hash-based post-quantum signatures on-device. The research covered Jade, Trezor, Ledger and BitBox02, using benchmark implementations available for each device and the same reference C libraries with device-specific adaptations.The candidates included Classic SLH-DSA-128s under FIPS 205, a reduced SPHINCS+ variant with a 2^40 signature budget, two UXMSS variants connected to SHRINCS designs, and XMSS. That mix matters because the schemes differ sharply in signature size, state handling and runtime. Blockstream framed the work as a feasibility study rather than a ranking of wallet brands, and said wallet teams may be able to beat the reported numbers with device-specific optimizations.
The Main Finding Is Feasibility, Not Speed
The central result is that all tested wallet families produced hash-based post-quantum signatures. Blockstream says this weakens the concern that existing self-custody devices are inherently unable to run post-quantum signing schemes.The timings still show a wide performance range. Blockstream reported SLH-DSA signatures taking about 53 seconds to 120 seconds, while its reduced SPHINCS+ 2^40 candidate was described as a little faster. UXMSS for SHRINCS-B took 22 seconds to 42 seconds. UXMSS for SHRINCS-L was much slower with overgrinding, at about 226 seconds to 573 seconds, but took just over 3 seconds when overgrinding was removed. XMSS took 58 seconds to 118 seconds per signature in cold mode. For Bitcoin cold storage, that can be inconvenient but not disqualifying; for interactive payment use cases, latency and caching become more important.
Wallet Architecture Makes Direct Ranking Unsafe
Blockstream cautioned that the benchmark should not be read as a league table of wallet quality. The devices run code differently, expose different cryptographic primitives, use different toolchains and have CPU frequencies ranging from 70 MHz to 240 MHz.Ledger was tested through an app running inside the secure element and its operating system, although the researchers used a custom SHA-256 implementation to reduce syscall overhead. Jade runs on a general-purpose chip. Trezor and BitBox02 run custom firmware on their main microcontrollers, while their secure elements protect PINs and secrets rather than doing the signing math. Those differences affect performance and make the study more useful as a boundary test: can these devices sign at all under comparable reference code? Blockstream says they can.
Cold-Mode Timings Point to Caching as the Next Lever
The reported figures are cold-mode results, meaning work is recomputed from scratch for each signature. Blockstream said all presented numbers were averages after 100 executions of the relevant operation, which gives the study a consistent measurement basis even if it is not a final product benchmark.Hash-based signatures repeatedly use similar computations, so caching intermediate work could reduce signing time in future implementations. Blockstream specifically identified optimization, latency, caching and hash acceleration as the practical problems left after basic feasibility. This is the most useful implication for wallet makers: the question is less whether post-quantum signing can fit on existing hardware, and more how much user waiting time, persistent state and memory use a real wallet can safely tolerate.
The Scope Leaves Major Migration Questions Open
The study is deliberately narrow. Blockstream said it focused on generating signatures on the device and only on hash-based schemes. It did not address post-quantum firmware verification, lattice-based schemes or isogeny-based schemes, with those areas left outside the benchmark.That boundary is significant for Bitcoin planning. A full post-quantum transition would involve wallet firmware, protocol design, address formats, verification cost, state management and user-experience decisions. The benchmark does not prove that a particular scheme should be deployed, and it does not make a commercial wallet post-quantum ready. It does, however, gives developers a firmer starting point: current hardware appears capable of producing the relevant class of signatures, so future debate can focus on engineering trade-offs rather than a presumed hardware impossibility.
Conclusion
Blockstream's benchmark is a measured but important data point for Bitcoin self-custody. It shows that Jade, Trezor, Ledger and BitBox02 devices can run hash-based post-quantum signature generation under the tested conditions, while avoiding the stronger claim that every post-quantum primitive or migration path is solved.For users, there is no immediate action implied by the research and it should not be treated as investment advice. For wallet vendors and protocol researchers, the practical agenda is clearer: reduce latency, study caching, harden state handling, and decide which schemes offer the best balance between signing cost, verification complexity and long-term security.
Sources
Editorial Team - CoinBotLab