Sui is rolling out quantum-safe account security that lets users keep their current blockchain addresses while upgrading to post-quantum cryptography. The network will support ML-DSA-65 for standard accounts and SLH-DSA-SHA2-128s for high-value Move-based vaults, both designed to resist attacks from future quantum computers.
Address Aliases Enable Seamless Migration
Normally, switching cryptographic schemes requires creating a new address and moving all assets—a disruptive process for tokens, NFTs, identities, and smart contracts. Sui’s Address Aliases system avoids that entirely. An account can authorize a new post-quantum signer while the original blockchain address remains the transaction sender. Once native ML-DSA support is live, users simply authorize the new signer and later make it the sole authorized signer.
Users can also derive an ML-DSA-65 key from their existing recovery phrase via a fresh derivation path, eliminating the need for a separate backup. Sui cautions that wallet software must clearly communicate the authority granted when adding an alias.
Two Cryptographic Systems for Different Needs
Sui splits quantum protection across two NIST‑standardized schemes:
- ML-DSA-65 (FIPS 204, NIST Category 3) – a lattice‑based signature chosen for frequent transactions because it balances a strong security margin with practical verification speed.
- SLH-DSA-SHA2-128s (FIPS 205, Category 1) – a hash‑based system reserved for high‑value vaults, providing a different mathematical foundation so that a weakness in lattice‑based crypto does not compromise all assets.
This dual approach lets developers replace the vault authentication scheme via smart‑contract upgrades if future cryptanalysis reveals flaws in one family.
Larger Signatures Shape Deployment Timeline
Post‑quantum signatures are bulkier than Ed25519: ML-DSA-65 signatures are 3,309 bytes (public key: 1,952 bytes), while SLH-DSA‑SHA2‑128s signatures reach 7,856 bytes. Despite the size increase, Sui notes that ML-DSA verification performance is close enough to Ed25519 that per‑signature network costs need not rise.
The rollout is staged:
- Quantum‑safe vaults on Mainnet before end of 2026.
- Native ML-DSA-65 accounts on Testnet by late 2026 and Mainnet in Q1 2027.
- Wallet, SDK, and CLI support alongside independent audits and Testnet feedback.
No immediate action is required from existing users. The migration is additive and optional, with clear warnings about potential scams that ask users to move all assets to a new address.
Conclusion
Sui’s quantum‑safe upgrade uses ML-DSA-65 accounts and SLH-DSA vaults while preserving existing addresses via Address Aliases. Users need do nothing now; audits, testing, and phased deployment continue.