PoS smart-contract platform
Cardano ADA
Cardano scores 12/100 (Stage 2: Mitigation/Development), capped at 25 by the 'roadmap/proposal only; no public code, prototype, or testnet' Readiness & Risk Cap. The production network relies entirely on classical elliptic curve cryptography: Ed25519 for transaction signatures and KES, ECVRF (Ed25519-based) for Ouroboros leader election, and BLS12-381 for Mithril state proofs — all vulnerable to Shor's algorithm. No post-quantum code exists in any public repository, and no testnet, prototype, or mainnet PQ path is available. The eUTXO model provides a structural mitigation by hashing public keys in addresses until first spend, protecting never-spent UTXOs from long-exposure attacks, but spent and reused-address holdings remain fully exposed. Post-quantum work is active at the research and proposal level: CPS-0027 (merged May 2026) surveys PQ signature approaches for Plutus builtins, Vision 2026 WP1.2 targets TRL 1–4 with PQ VRF design work progressing, and Project Nightstream was announced (February 2026) as an IOG initiative for lattice-based PQ cryptography with research collaborators linked to Google and Microsoft. However, no formal CIP, governance proposal, code release, or public specification for Nightstream has been published. The project earns full credit for its public cryptographic inventory (IOG Cryptography Handbook), quantum threat assessment (CPS-0027, Vision 2026 WP1.2), and security governance infrastructure (Intersect Security Council, bug bounty program), but these do not constitute production protection. Cardano should be monitored for progress on CPS-0027 transitioning to a formal CIP, Vision 2026 H2 deliverables (prototypes and CIP-ready recommendations), and any Nightstream specifications or code releases.
Roadmap OnlyPartial ProtectioneUTXO Structural Mitigation
Category breakdown
QRI Factors
Algorithm & Implementation Assurance
2.75 / 20
Migration Mechanism, Governance & Ecosystem Coordination
2.25 / 15
Migration Status & Value-at-Risk
0.5 / 25
Production Cryptographic Protection
1.91 / 35
Security Assessment & Evidence Preparedness
5 / 5
Critical Quantum Blockers
- Active production spend authorization remains entirely Ed25519 (ECC) only — all transaction signatures are quantum-vulnerable to Shor's algorithm, enabling private key recovery and signature forgery.
- Consensus-critical authentication (ECVRF for leader election, KES for block signing) is entirely Ed25519-based and quantum-vulnerable, enabling a quantum adversary to predict/bias slot leader schedules and forge alternative chains.
- Mithril state proofs rely on BLS12-381 pairings for certificate aggregation, which are quantum-vulnerable; forged certificates could enable malicious state proofs for light clients and bridges.
- No PQ or hybrid-PQ code exists in any public Cardano repository (cardano-base, cardano-crypto, cardano-node) as of the evaluation date. All PQ work is confined to research papers, CPS documents, roadmap proposals, and founder announcements.
- No testnet, prototype, or mainnet PQ path exists; the most concrete deliverable (CPS-0027) is a problem statement surveying approaches, not an implementation or finalized CIP.
Key Risks
- All active transaction signatures are Ed25519-based and can be forged by a CRQC (cryptanalytically relevant quantum computer) using Shor's algorithm, enabling theft of any ADA in addresses with exposed public keys (spent UTXOs, reused addresses, stake pool keys, treasury keys).
- Ouroboros consensus leader election (ECVRF) and block signing (KES) are quantum-vulnerable; a quantum adversary recovering VRF keys can predict/bias slot leader schedules, and recovering KES keys from historical operational certificates can forge alternative chains for bootstrapping nodes.
- Mithril certificate aggregation uses BLS12-381 pairings, which are quantum-vulnerable; forged Mithril certificates could enable malicious state proofs for light clients and bridges.
- Material long-exposure quantum-vulnerable value exists in all spent UTXOs and reused addresses where public keys are visible on-chain; this value cannot be protected retroactively without migration to PQ keys, and no freeze, deprecation, burn, or migration mechanism exists.
- The gap between current research-stage work (TRL 1–4) and production deployment is unquantified and likely spans multiple years, while quantum computing advances may compress the available migration window.
- The transition from CPS-0027 (Problem Statement) to a formal CIP to mainnet deployment involves governance, engineering, testing, and ecosystem coordination steps that have not yet begun.
- Project Nightstream (lattice-based PQ cryptography) has been announced as an IOG initiative but has no formal CIP, governance proposal, code release, or public specification as of the evaluation date.
- No formal quantum-specific incident-response playbook exists; while general security governance is in place, the unique challenges of a quantum attack (e.g., retroactive key recovery, simultaneous multi-target attacks) are not specifically addressed.
Assurance Notes
- No independent cryptographic audit exists for any PQ implementation because no PQ implementation exists in production, testnet, or prototype form within the Cardano ecosystem.
- Classical Ed25519/ECVRF/KES implementations have some historical audit coverage (Kudelski Security Icarus wallet audit, cardano-c audit findings remediation) but these are stale and scope-limited relative to the full current production cryptographic surface.
- The IOG Cryptography Handbook provides thorough official specifications for Ed25519, KES, and VRF primitives, confirming the classical-only production posture with high documentation quality.
- CPS-0027 ('Approaches to Post-Quantum Signatures') was merged as a Cardano Problem Statement in May 2026 and provides a thorough survey of NIST PQC candidates (ML-DSA, SLH-DSA, Falcon, SQIsign, FAEST) and their trade-offs for Plutus builtins, but no algorithm selection has been formalized.
- Vision 2026 WP1.2 (Post-Quantum Security) is at TRL 1–4 (research to prototype); the mid-year report confirms PQ VRF design work progressed in H1 2026 but no public prototype code or testnet deployment exists as of the evaluation date.
- Project Nightstream was announced by Charles Hoskinson at Consensus Hong Kong on February 13, 2026 as an IOG initiative for lattice-based PQ cryptography with research collaborators linked to Google and Microsoft. No formal CIP, governance proposal, code release, or public specification exists as of the evaluation date.
- Intersect Security Council and bug bounty program provide a structured vulnerability disclosure and incident response framework with defined roles, timelines, and a $300K budget, but no quantum-specific incident-response playbook has been published.
- No formal performance benchmarks with Cardano-specific integration parameters (block size, mempool, validation-time constraints) have been published for PQ transition.
- Mithril's current production certificate aggregation uses BLS12-381 signatures (quantum-vulnerable); SNARK-based aggregation prototyping is underway but is a separate infrastructure component, not core consensus.
- No exchange or custody migration attestations exist, consistent with the absence of any PQ migration path.
- A March 2026 paper from Google Quantum AI ranked Cardano as the second-most quantum-ready blockchain (after Algorand) among major chains evaluated. This ranking reflects relative preparedness assessment, not production PQ protection.
Non-Scoring Caveats
- The eUTXO model provides structural protection for never-spent UTXOs by hashing public keys (Blake2b-224) in addresses until first spend. This is a genuine architectural advantage over account-based models where public keys are exposed on first outgoing transaction. However, it does not constitute quantum resistance — spent UTXOs, reused addresses, and all consensus/state-proof layers remain fully exposed.
- Cardano's core ledger state integrity uses Blake2b-256 hashing, which is quantum-safe against Shor's algorithm (only Grover-amenable). This is an inherent hash-function property, not a PQ implementation.
- KES (Key Evolving Signatures) provides forward security for block signing keys within classical assumptions, limiting the window of compromise for any single key epoch. This is a classical property and does not protect against quantum attacks on the underlying Ed25519 curve.
- Cardano's type-class-based cryptographic abstractions (DSIGN, KES, VRF classes) provide theoretical parameter agility that could facilitate future PQ migration, but this has not been tested or implemented for any PQ primitive.
- The Vision 2026 research program is community-funded (₳32.916M) with specific PQ deliverables (PQ VRF construction, Ouroboros security proof, migration strategy SIP), but all target TRL 1–4 and none are publicly available as of August 2026.
- Project Nightstream was announced as an IOG initiative for lattice-based PQ cryptography with research collaborators linked to Google and Microsoft (February 2026). No formal CIP, governance proposal, code release, or public specification has been published. This is an IOG initiative, not yet a governance proposal.
- Mithril's SNARK-based aggregation prototype (developer network, April 2026) could eventually provide quantum-safe state certificate aggregation, but production Mithril uses BLS12-381 (quantum-vulnerable) and this does not address core consensus or spend authorization.
- No production ZK privacy layer exists on Cardano mainnet, so quantum-vulnerable proof systems (Groth16, PLONK) are not a current production concern for the evaluated L1 scope.
- Hoskinson public statements (Consensus Miami, May 2026) reference >50% probability of commercially viable quantum computers before 2033, aligning with urgency of migration planning but not constituting production protection.
- The annual hard-fork cadence provides a regular upgrade window that could accommodate PQ migration once primitives are ready, but no hard-fork for PQ has been scheduled or proposed.
- A March 2026 paper from Google Quantum AI ranked Cardano as the second-most quantum-ready blockchain (after Algorand) among major chains evaluated. This reflects relative preparedness, not production PQ protection.
- CPS-0027 is a Problem Statement, not a CIP (Cardano Improvement Proposal); transitioning from CPS to CIP to implementation requires governance processes that have not yet begun.
Evidence record
Claims and Caveats
Production Cryptographic Protection
Spend authorization / transaction signatures
Claim: Cardano production transaction signatures use Ed25519 (EdDSA over Curve25519) exclusively; no PQ or hybrid signature implementations exist in any public repository.
Coverage basis: PQ/hybrid usage — classical ECC-only spend authorization with no PQ implementation
Implementation score: 0 · Evidence confidence: High
Issue classification: quantum-critical vulnerability · Score treatment: score-reducing
Quantum blocker: Active production spend authorization remains entirely Ed25519 (ECC) only — all transaction signatures are quantum-vulnerable to Shor's algorithm.
Assurance: Confirmed by IOG Cryptography Handbook official specification, cardano-base source code, and cardano-crypto crate documentation. No PQ algorithms present in any public branch. DSIGN class also supports EcdsaSecp256k1 and SchnorrSecp256k1 for interoperability, all classical.
Primary source verification from official specs and code repositories confirms classical-only posture. CPS-0027 discusses PQ signature approaches but is a problem statement only, not an implementation.
Production Cryptographic Protection
Account, address, public-key exposure, and key-derivation design
Claim: Cardano's eUTXO model hashes public keys (Blake2b-224) in addresses until first spend, providing structural protection for never-spent UTXOs. Spent and reused addresses expose public keys permanently.
Coverage basis: PQ/hybrid usage — design-level structural mitigation for unspent addresses only, no PQ controls
Implementation score: 0.25 · Evidence confidence: High
Issue classification: quantum-critical vulnerability · Score treatment: score-reducing
Quantum blocker: Spent UTXOs and reused addresses expose Ed25519 public keys on-chain, creating long-exposure quantum-vulnerable value with no migration path.
Assurance: The eUTXO hashing design is a genuine structural advantage over account-based models (e.g., Ethereum) where public keys are exposed on first outgoing transaction. However, this is not quantum resistance — it only delays exposure for never-spent addresses. Material value remains in exposed keys.
Implementation Score of 0.25 reflects the design-level structural mitigation (public specification/documented design) that partially reduces the long-exposure attack surface, but no PQ controls exist.
Production Cryptographic Protection
Consensus-critical authentication (validator signatures, VRFs, randomness, block certificates)
Claim: Ouroboros uses ECVRF (Ed25519-based) for leader election and KES (Ed25519-based key-evolving signatures) for block signing. Both are quantum-vulnerable.
Coverage basis: PQ/hybrid usage — classical ECC-only consensus authentication with no PQ implementation
Implementation score: 0 · Evidence confidence: High
Issue classification: quantum-critical vulnerability · Score treatment: score-reducing
Quantum blocker: Consensus-critical authentication (VRF for leader election, KES for block signing) is entirely Ed25519-based and quantum-vulnerable.
Assurance: Confirmed by IOG Cryptography Handbook VRF specification and cardano-crypto crate documentation. KES provides forward security within classical assumptions but does not protect against quantum attacks on the underlying curve. Vision 2026 WP1.2 specifically identifies PQ VRF construction as the most significant research challenge due to proof size and verification time constraints.
Vision 2026 mid-year report confirms PQ VRF design work progressed in H1 2026 but no public deliverable exists.
Production Cryptographic Protection
State-integrity and data-availability mechanisms
Claim: Core ledger uses Blake2b-256 hashing for UTXO commitments and block headers (quantum-safe against Shor's). Mithril certificate aggregation uses BLS12-381 (quantum-vulnerable). Script authorization uses Ed25519 (quantum-vulnerable).
Coverage basis: PQ/hybrid usage — mixed: hash-based core integrity is quantum-safe; Mithril BLS and script Ed25519 are vulnerable
Implementation score: 0.25 · Evidence confidence: High
Issue classification: quantum-critical vulnerability · Score treatment: score-reducing
Quantum blocker: Mithril state proofs rely on BLS12-381 pairings for certificate aggregation, which are quantum-vulnerable.
Assurance: Core ledger hash-based integrity is verifiable from code. Mithril BLS dependency is confirmed in official documentation. Mithril team prototyping SNARK-based aggregation (devnet, April 2026) but not in production. Future Leios/Peras consensus upgrades also introduce BLS-based aggregate signature certificates.
Partial credit for hash-based core ledger integrity. Mithril is a separate infrastructure component (certificate aggregation for light clients and bootstrapping), not core consensus, but is applicable as a state-proof layer. The Mithril SNARK prototype could eventually address BLS vulnerability but does not affect L1 spend-authorization or consensus.
Production Cryptographic Protection
Privacy and proof layers
Claim: Cardano L1 does not have a native privacy layer, shielded transactions, or confidential asset protocol in production.
Coverage basis: N/A — no privacy layer in production
Implementation score: 0 · Evidence confidence: High
Issue classification: none · Score treatment: not applicable
N/A for core L1 protocol. Application-layer privacy solutions (e.g., Midnight sidechain) are outside the evaluated scope.
Production Cryptographic Protection
P2P transport, node identity, and peer authentication
Claim: Cardano node P2P communication uses standard TLS and classical cryptography for transport and peer authentication. No PQ protection for P2P layer.
Coverage basis: PQ/hybrid usage — classical ECC-only for P2P identity
Implementation score: 0 · Evidence confidence: Medium
Issue classification: assurance-only caveat · Score treatment: note-only
Assurance: P2P node identity is not directly consensus-critical or spend-critical. A quantum compromise of P2P transport would primarily affect network-layer security (eclipse attacks, transaction censorship) rather than asset ownership or consensus safety directly. This is an assurance-only caveat per QRI spec because it does not create a plausible current path for quantum-enabled theft, forgery, or consensus compromise.
P2P transport is applicable but is the least critical layer. The primary quantum risks are in spend authorization and consensus authentication.
Production Cryptographic Protection
Critical wallet, custody, HSM, signer, and hardware-wallet workflows
Claim: No PQ wallet, custody, HSM, or hardware-wallet support exists for Cardano. All user-facing key management is Ed25519-only.
Coverage basis: PQ/hybrid usage — no PQ wallet or custody support
Implementation score: 0 · Evidence confidence: High
Issue classification: quantum-critical vulnerability · Score treatment: score-reducing
Quantum blocker: No PQ wallet, custody, or hardware-wallet workflows exist; all user-facing key management is Ed25519-only.
Assurance: Vision 2026 WP1.3 (Node Security) includes assessing HSM providers and key management architectures capable of supporting PQ primitives, but this is research-stage only. Wallet/custody PQ support is downstream of protocol-level PQ support — since no PQ primitives exist at the protocol level, wallet support cannot exist.
Security Assessment & Evidence Preparedness
Public cryptographic inventory and quantum threat model
Claim: Cardano has published a comprehensive cryptographic inventory (IOG Cryptography Handbook) and quantum threat assessment (CPS-0027, Vision 2026 WP1.2) covering affected primitives, layers, and attack assumptions.
Coverage basis: Classical inventory complete; PQ threat model documented in proposals and research program
Implementation score: 1 · Evidence confidence: High
Issue classification: none · Score treatment: not applicable
Assurance: Inventory is thorough and publicly verifiable. CPS-0027 explicitly identifies quantum vulnerabilities and surveys NIST PQC candidates. Vision 2026 WP1.2 documents the research roadmap. The threat model is documented across these sources though not consolidated in a single formal threat model document.
Full credit for assessment quality; this does not imply any production protection exists. CPS-0027 is a confirmed Problem Statement surveying approaches, not a formal threat model with quantified timelines.
Security Assessment & Evidence Preparedness
Public evidence record supporting the assessment
Claim: Code references (cardano-base, cardano-crypto repos), official specs (IOG Handbook), governance documents (CPS-0027), and research proposals (Vision 2026) provide reproducible evidence supporting the quantum risk assessment.
Coverage basis: Primary source code, official documentation, and merged governance proposals
Implementation score: 1 · Evidence confidence: High
Issue classification: none · Score treatment: not applicable
Assurance: Evidence is verifiable from primary sources: official specifications, open-source code repositories, and merged governance proposals. The classical-only posture is confirmed by direct code inspection and documentation review.
Migration Status & Value-at-Risk
Percentage of economically relevant value-at-risk protected
Claim: No PQ protection exists for any ADA value. 0% of economically relevant value is protected from quantum key-recovery attacks. eUTXO hashing provides structural protection for never-spent UTXOs only.
Coverage basis: Migrated value — no PQ protection; classical-only
Implementation score: 0 · Evidence confidence: Medium
Issue classification: quantum-critical vulnerability · Score treatment: score-reducing
Quantum blocker: Material long-exposure quantum-vulnerable value exists in all spent UTXOs and reused addresses with no migration, freeze, or recovery path.
Assurance: Precise quantification of long-exposure vulnerable value (spent UTXOs, reused addresses) is not available in the evidence dossier. The eUTXO model means that never-spent addresses are structurally protected from long-exposure attacks, but any address that has ever sent a transaction has an exposed public key. Coverage is effectively <25% per Section 9.3.1 thresholds.
Coverage is effectively 0% for PQ protection. The eUTXO structural mitigation is a design property, not a PQ protection mechanism. It reduces but does not eliminate the quantum-vulnerable surface.
Migration Status & Value-at-Risk
Critical wallets migrated, protected, or inherently PQ-native
Claim: No critical wallets (treasuries, exchanges, custodians, bridges, foundations, major protocols) have migrated to PQ keys because no PQ migration path exists.
Coverage basis: Migrated value — no PQ migration possible
Implementation score: 0 · Evidence confidence: Medium
Issue classification: quantum-critical vulnerability · Score treatment: score-reducing
Quantum blocker: No critical wallet migration has occurred or is possible; all treasury, foundation, exchange, and protocol-controlled ADA remains in Ed25519-only addresses.
Assurance: No exchange or custody migration attestations exist, consistent with the absence of any PQ migration path. This is a downstream consequence of the protocol-level gap.
Critical wallet migration cannot occur until protocol-level PQ support exists. This subfactor reflects the current state, not a failure of coordination given available tools.
Migration Status & Value-at-Risk
Legacy vulnerable pools/accounts/UTXOs/contracts identified, measurable, deprecated, migrated, frozen, or proven not to exist by design
Claim: The eUTXO model inherently distinguishes between exposed-key UTXOs (spent/reused) and unexposed-key UTXOs (never spent). No formal deprecation, freeze, or migration mechanism exists for quantum-vulnerable UTXOs.
Coverage basis: Migrated value — design-level identifiability only, no operational mechanism
Implementation score: 0.25 · Evidence confidence: Medium
Issue classification: quantum-critical vulnerability · Score treatment: score-reducing
Quantum blocker: No mechanism exists to deprecate, freeze, burn, or migrate quantum-vulnerable exposed-key UTXOs.
Assurance: The eUTXO model provides inherent identifiability of exposed vs unexposed keys, which is a design advantage for future migration planning. However, no formal measurement, deprecation policy, or migration mechanism has been proposed. Vision 2026 discusses ZK-proof-based wallet address migration as a potential future path.
Implementation Score of 0.25 reflects the design-level identifiability (public specification) of vulnerable vs protected UTXOs, but no operational mechanism exists.
Migration Mechanism, Governance & Ecosystem Coordination
Public migration or protection roadmap with sequencing, activation criteria, and dependencies
Claim: Vision 2026 WP1.2 provides a research roadmap with specific deliverables (D1.1 PQC building blocks, D1.2 novel PQ VRF, D2.1 Ouroboros security proof, D2.2 prototype, D3.1 migration strategy SIP). CPS-0027 surveys PQ signature approaches. Project Nightstream was announced as an IOG initiative for lattice-based PQ cryptography. No concrete production migration timeline with activation criteria exists.
Coverage basis: Research-level roadmap (TRL 1–4); no production deployment timeline
Implementation score: 0.25 · Evidence confidence: Medium
Issue classification: none · Score treatment: not applicable
Assurance: Roadmap is well-documented but at research level only. Mid-year report indicates H2 2026 will produce prototypes and CIP-ready recommendations. Timeline from TRL 4 to production hard-fork is measured in years. Nightstream has no formal CIP, governance proposal, or code release.
Implementation Score of 0.25 reflects the roadmap/proposal level: public documents exist acknowledging the need and outlining research direction, but no concrete migration plan with activation criteria has been published.
Migration Mechanism, Governance & Ecosystem Coordination
Migration accessibility and defaults
Claim: No PQ account creation, wallet tooling, transaction paths, custody paths, user-facing warnings, education, or migration prompts exist.
Coverage basis: PQ/hybrid usage — no PQ migration tooling available
Implementation score: 0 · Evidence confidence: High
Issue classification: quantum-critical uncertainty · Score treatment: score-reducing
Quantum blocker: No PQ migration accessibility exists; users cannot create PQ accounts or migrate to PQ keys.
Assurance: This is a direct consequence of no PQ primitives existing at the protocol level. Wallet tooling, custody paths, and user education cannot exist without underlying protocol support.
Implementation Score of 0.0 reflects no implementation at any level.
Migration Mechanism, Governance & Ecosystem Coordination
Migration enforcement and coordination
Claim: No enforcement mechanisms exist for deprecation, freeze, disabled legacy signing, restricted withdrawals, or unsafe-path blocking. No exchange, custody, bridge, wallet, or infrastructure coordination for PQ migration exists.
Coverage basis: PQ/hybrid usage — no enforcement or coordination for PQ migration
Implementation score: 0 · Evidence confidence: High
Issue classification: quantum-critical uncertainty · Score treatment: score-reducing
Quantum blocker: No migration enforcement or ecosystem coordination mechanisms exist.
Assurance: Enforcement and coordination mechanisms are downstream of protocol-level PQ support. The absence is expected given the research-stage status of PQ work.
Implementation Score of 0.0 reflects no implementation.
Migration Mechanism, Governance & Ecosystem Coordination
Emergency disclosure, incident-response, or governance process for quantum-related vulnerabilities
Claim: Intersect Security Council and bug bounty program provide general vulnerability management infrastructure with defined roles, response timelines, and a $300K budget. No quantum-specific incident-response playbook exists.
Coverage basis: PQ/hybrid usage — general IR infrastructure exists; no quantum-specific process
Implementation score: 0.5 · Evidence confidence: Medium
Issue classification: assurance-only caveat · Score treatment: note-only
Assurance: The Intersect Security Council provides structured vulnerability disclosure, triage, and incident response with defined roles (Security Manager, Responders), response timelines, and a bug bounty program. The process has been operationally tested (network partition incident). However, no quantum-specific playbook addresses the unique challenges of quantum attacks. Per QRI spec, the absence of a quantum-specific playbook is an assurance-only caveat because the vulnerability exists in the cryptography itself, not in the response process.
Implementation Score of 0.50 reflects prototype-level: general incident response infrastructure exists and has been operationally tested, but quantum-specific procedures have not been developed.
Algorithm & Implementation Assurance
Uses NIST-standardized, standards-track, or broadly reviewed PQC/hybrid-PQC algorithms
Claim: CPS-0027 surveys NIST PQC candidates (ML-DSA/Dilithium, SLH-DSA/SPHINCS+, Falcon, SQIsign, FAEST) and their Cardano-specific trade-offs. No algorithm selection has been made. No PQ algorithms are implemented.
Coverage basis: PQ/hybrid usage — no PQ algorithm implementation; survey/research only
Implementation score: 0.25 · Evidence confidence: Medium
Issue classification: none · Score treatment: not applicable
Assurance: CPS-0027 provides a thorough survey of NIST-standardized and standards-track candidates with Cardano-specific trade-off analysis. However, no formal algorithm selection has been made, and no reference implementation has been integrated into cardano-base or any other repository.
Implementation Score of 0.25 reflects the proposal/research level: NIST candidates have been surveyed and evaluated in the Cardano context, but no selection or implementation exists.
Algorithm & Implementation Assurance
Independent cryptographic and implementation audit for quantum-critical scope
Claim: No independent audit exists for any PQ implementation because no PQ implementation exists. Classical implementations have some historical audit coverage (Kudelski Icarus wallet audit, cardano-c fixes).
Coverage basis: PQ/hybrid usage — no PQ implementation to audit
Implementation score: 0 · Evidence confidence: Medium
Issue classification: assurance-only caveat · Score treatment: note-only
Assurance: Classical Ed25519 implementations have some audit history: Kudelski Security audited the Icarus wallet (including Ed25519 API), and cardano-c audit findings were remediated. However, these audits are stale, scope-limited (wallet-specific, not full protocol), and do not cover the current cardano-node/cardano-base/cardano-crypto production implementations comprehensively. No audit exists for the quantum-critical scope because no PQ implementation exists to audit.
Implementation Score of 0.0 for PQ audit scope because no PQ implementation exists. The classical audit coverage is noted but does not affect the PQ-specific score.
Algorithm & Implementation Assurance
Open-source, reproducible implementation
Claim: Classical Cardano cryptographic implementations are open-source in cardano-base and cardano-crypto repositories. No PQ implementation exists.
Coverage basis: PQ/hybrid usage — classical code is open-source; no PQ code exists
Implementation score: 0 · Evidence confidence: High
Issue classification: none · Score treatment: score-reducing
Assurance: Classical code is open-source and publicly available. The absence of PQ code means this subfactor cannot receive credit for PQ-specific implementation.
Implementation Score of 0.0 for PQ scope. Classical open-source status is acknowledged but does not contribute to PQ assurance.
Algorithm & Implementation Assurance
Parameter agility and future upgrade path
Claim: Cardano's DSIGN, KES, and VRF type-class abstractions provide theoretical parameter agility. The annual hard-fork cadence provides a regular upgrade window. CPS-0027 discusses algorithm selection criteria including upgradeability.
Coverage basis: PQ/hybrid usage — design-level parameter agility via type-class abstractions
Implementation score: 0.25 · Evidence confidence: Medium
Issue classification: none · Score treatment: not applicable
Assurance: The type-class-based cryptographic abstractions (DSIGN class for signatures, KES class for key-evolving signatures, VRF class) provide a clean interface for swapping underlying primitives. However, this agility has never been tested with PQ primitives, and the practical challenges of integrating PQ algorithms (signature sizes, verification times, state management) may require interface changes beyond simple substitution.
Implementation Score of 0.25 reflects the design-level (specification) parameter agility. CPS-0027 discusses algorithm selection criteria including upgradeability, but no PQ parameter agility has been implemented or tested.
Algorithm & Implementation Assurance
Stateful-signature safety, side-channel, fault-injection, state-management risks
Claim: KES provides key-evolving signatures with forward security, offering a design precedent for stateful signature management. No PQ-specific stateful-signature safety analysis exists.
Coverage basis: PQ/hybrid usage — no PQ signatures deployed; KES provides classical stateful-signature precedent
Implementation score: 0.25 · Evidence confidence: Medium
Issue classification: none · Score treatment: not applicable
Assurance: KES provides forward security within classical assumptions, which is a relevant design precedent for stateful signature management. However, this is a classical property and does not address PQ-specific stateful-signature challenges (e.g., XMSS/LMS state management, anti-reuse controls). Vision 2026 WP1.3 includes HSM-backed key management prototypes for PQ primitives but is research-stage only.
Implementation Score of 0.25 reflects the design-level KES precedent for stateful signature management, but no PQ-specific analysis exists.
Algorithm & Implementation Assurance
Performance and resource-impact analysis
Claim: CPS-0027 discusses PQ signature sizes qualitatively (Falcon ~666 bytes, Dilithium ~2420 bytes, SPHINCS+ ~8080 bytes). Vision 2026 includes performance benchmarking as a deliverable. No formal Cardano-specific performance analysis exists.
Coverage basis: PQ/hybrid usage — qualitative proposal-level discussion only
Implementation score: 0.25 · Evidence confidence: Low
Issue classification: none · Score treatment: not applicable
Assurance: The performance analysis in CPS-0027 is qualitative rather than quantitative with Cardano-specific block size, mempool, and validation-time constraints. No empirical performance analysis with Cardano-specific integration parameters has been published. Vision 2026 WP1.2 includes performance benchmarking as a deliverable but results are not yet available. Hoskinson warned that naive PQC implementation could reduce throughput by 10x without hardware acceleration.
Implementation Score of 0.25 reflects the proposal-level discussion of performance implications. Evidence confidence is Low because the analysis is qualitative and not Cardano-specific.
Report metadata