Sui SUI

Claim: Sui has published detailed cryptographic inventory covering all primitives (Ed25519, ECDSA secp256k1/r1, BLS12-381, Groth16, ECVRF, hashes) and quantum threat analysis including transition strategies, affected assets, attack assumptions, and NIST timeline references.

Coverage basis: Assessment/evidence preparedness

Implementation score: 0.75 · Evidence confidence: High

Issue classification: assurance-only caveat · Score treatment: confidence-only

Assurance: Threat model is a public blog post covering attack assumptions, affected assets, and layers substantively. Not a formal spec-level threat model document but comprehensive for assessment purposes.

Inventory is strong; threat model is credible and public. Slight deduction because the quantum threat model is a blog post rather than a formal security assessment document.

• https://docs.sui.io/develop/cryptography/
• https://www.sui.io/security
• https://blog.sui.io/post-quantum-computing-cryptography-security/

Claim: Open-source repos (MystenLabs/sui, fastcrypto), official docs, classical-crypto audits (Zellic, Common Prefix secp256r1), and benchmarks provide a reproducible evidence base. PQ-specific evidence limited to Aug 2026 announcement and blog.

Coverage basis: Assessment/evidence preparedness

Implementation score: 0.75 · Evidence confidence: High

Issue classification: none · Score treatment: not applicable

Assurance: Classical audits are scope-mismatched for PQ; PQ audits underway but not published. Strong evidence record for classical production; PQ evidence is announcement-level.

• https://github.com/MystenLabs/sui
• https://github.com/MystenLabs/fastcrypto
• https://www.sui.io/security
• https://docs.sui.io/develop/cryptography/

Claim: Mainnet user transactions signed exclusively with Ed25519, ECDSA secp256k1, or ECDSA secp256r1. No PQC or hybrid-PQC signature scheme is live on mainnet or public testnet.

Coverage basis: Classical ECC-only

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Quantum blocker: Active production spend authorization remains entirely ECC/BLS/EdDSA-only. No mainnet PQC/hybrid signature support as of 2026-08-16.

All three supported schemes (Ed25519, secp256k1, secp256r1) are vulnerable to Shor's algorithm.

• https://docs.sui.io/concepts/cryptography/signatures
• https://docs.sui.io/develop/transactions/transaction-auth/auth-overview

Claim: Addresses derived from classical public keys with scheme flags (0x00 Ed25519, 0x01/0x02 ECDSA). Transacted accounts expose public keys on-chain, creating long-exposure attack surfaces. No PQ address format or PQ key-derivation path live.

Coverage basis: Classical ECC-only

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Address aliases (already deployed) provide a future key-update path but are not yet usable with PQ keys. Deterministic key derivation from 32-byte seed will enable future PQ key generation.

• https://docs.sui.io/develop/transactions/transaction-auth/auth-overview

Claim: Validator protocol keys use BLS12-381 aggregated signatures with KOSK proofs for consensus and transactions. Worker keys use Ed25519 (marked 'to be migrated' in docs). Randomness beacon uses BLS12-381. All quantum-vulnerable.

Coverage basis: Classical BLS/EdDSA-only

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Quantum blocker: Validator consensus BLS12-381 with no published PQ replacement specification for Mysticeti batched-aggregation path.

Protocol key = BLS12381 (transactions/consensus), worker key = Ed25519 (consensus, 'to be migrated'), network key = Ed25519 (state sync), account key = Ed25519 (staking). Mysticeti v2 batches BLS signatures inside consensus blocks.

• https://mystenlabs.com/blog/cryptography-in-sui
• https://github.com/MystenLabs/sui/blob/main/docs/content/operators/validator/validator-tasks.mdx

Claim: State binding depends on validator BLS12-381 consensus signatures. Groth16 ZK proofs (BN254/BLS12-381) used where on-chain ZK verification applies. Hash-based commitments (object digests, tx digests) are quantum-safe but state-finality binding is not.

Coverage basis: Classical BLS/pairing-dependent

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Hash-based commitments (SHA-256/512) are quantum-safe for preimage resistance; consensus-dependent state binding via BLS12-381 is not.

• https://docs.sui.io/develop/cryptography/
• https://mystenlabs.com/blog/cryptography-in-sui

Claim: zkLogin uses Groth16 proofs over pairing-based curves (BN254/BLS12-381) with RSA-signed JWTs. No dedicated shielded/privacy pool exists on Sui. ZK layer is quantum-vulnerable.

Coverage basis: Classical pairing-dependent

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Groth16 over BN254 and BLS12-381 is pairing-based and vulnerable to Shor's algorithm. No PQ ZK proof system deployed or announced.

• https://docs.sui.io/develop/cryptography/
• https://github.com/MystenLabs/fastcrypto

Claim: Network keys for P2P state sync and peer authentication use Ed25519. No PQ for P2P node identity.

Coverage basis: Classical EdDSA-only

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

P2P identity is not consensus/spend/bridge-critical but remains a quantum-vulnerable network layer.

• https://mystenlabs.com/blog/cryptography-in-sui
• https://github.com/MystenLabs/sui/blob/main/docs/content/operators/validator/validator-tasks.mdx

Claim: No production PQ signing path exists. Wallet, SDK, and CLI PQ support planned to arrive alongside future testnet/mainnet rollouts. Hardware/custody workflows remain classical.

Coverage basis: Classical-only workflows

Implementation score: 0 · Evidence confidence: Medium

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

AWS KMS and Android 17 Keystore now offer ML-DSA signing; external ecosystem support is emerging but not integrated into Sui workflows.

• https://www.sui.io/blog/making-sui-quantum-ready

Claim: 0% of on-chain value protected by PQ spend authorization. Coverage <25% → negligible protection per QRI 9.3.1.

Coverage basis: Native circulating value unprotected

Implementation score: 0.05 · Evidence confidence: Medium

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Assurance: Value-at-risk not independently quantified; treated conservatively as fully unprotected. No PQ signature scheme accepted by the protocol.

Coverage threshold <25% maps to 1 earned point (weight 20) per QRI 9.3.1.

• https://docs.sui.io/concepts/cryptography/signatures

Claim: No treasuries, exchanges, custodians, bridges, foundations, or major protocols evidenced as PQ-protected on-chain.

Coverage basis: No critical-wallet migration

Implementation score: 0 · Evidence confidence: Medium

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Assurance: No PQ signature scheme available on mainnet, making migration impossible at this time.

Address alias mechanism will facilitate future migration without asset transfer.

Claim: Classical accounts are the norm. The quantum threat model blog identifies vulnerable primitives and transition strategies (address aliases, PQ-signed PreQ key, 1-of-2 multisig with expiration). No live deprecation, freeze, or migration of vulnerable pools.

Coverage basis: Identified but not migrated

Implementation score: 0.25 · Evidence confidence: Medium

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Vulnerable pools are identified and transition strategies designed; address aliases provide a key-update mechanism but are not yet usable with PQ keys.

• https://blog.sui.io/post-quantum-computing-cryptography-security/

Claim: Aug 2026 announcement details: SLH-DSA-SHA2-128s vaults targeted for mainnet end-2026; ML-DSA-65 native accounts targeted for testnet end-2026 and mainnet Q1 2027. Activation gated on independent audits and testnet feedback.

Coverage basis: Roadmap/prototype

Implementation score: 0.5 · Evidence confidence: Medium

Issue classification: none · Score treatment: not applicable

Assurance: Timelines are targets, not guarantees. Official statement: 'reflects current direction, not a finished, fully audited release.' No dated milestones for consensus-layer PQ replacement.

Sequencing and dependencies documented; roadmap covers spend authorization and vaults but omits consensus authentication, ZK proof system, and P2P identity migration timelines.

• https://www.sui.io/blog/making-sui-quantum-ready
• https://blog.sui.io/post-quantum-computing-cryptography-security/

Claim: PQ accounts planned as additive/opt-in via zkLogin/passkey rollout path. Wallet/SDK/CLI support arrives alongside future rollouts. No user-facing PQ account creation, tooling, or migration prompts live.

Coverage basis: Roadmap, not live

Implementation score: 0.25 · Evidence confidence: Medium

Issue classification: operational/product caveat · Score treatment: note-only

Assurance: Design for migration is strong: deterministic key derivation, address aliases for in-place key rotation. But no PQ paths available yet.

No default PQ account creation; no migration prompts; no PQ wallet tooling live for users.

• https://www.sui.io/blog/making-sui-quantum-ready

Claim: No enforcement mechanisms announced. PQ will be opt-in with no mandatory migration deadline. No deprecation of classical signing paths. No exchange, custody, bridge, or wallet coordination evidenced.

Coverage basis: No enforcement

Implementation score: 0 · Evidence confidence: High

Issue classification: operational/product caveat · Score treatment: note-only

Opt-in approach preserves user choice but leaves quantum-vulnerable fallback paths open indefinitely.

• https://www.sui.io/blog/making-sui-quantum-ready

Claim: General security bug bounty (HackenProof) exists. Epoch-based protocol versioning provides upgrade coordination mechanism. No quantum-specific incident-response playbook documented.

Coverage basis: General security process only

Implementation score: 0.25 · Evidence confidence: Medium

Issue classification: assurance-only caveat · Score treatment: confidence-only

Assurance: General bounty exists; quantum-specific IR playbook absent. Absence does not create a Readiness & Risk Cap by itself per spec.

Sui has demonstrated ability to coordinate protocol upgrades through epoch-based versioning with high validator participation.

• https://hackenproof.com/programs/sui-protocol
• https://www.sui.io/security

Claim: ML-DSA-65 (FIPS 204) selected for native accounts at NIST Level 3; SLH-DSA-SHA2-128s (FIPS 205) for Move smart-contract vaults. Both NIST-standardized. Core implementation built and benchmarked (prototype stage).

Coverage basis: Prototype implementation

Implementation score: 0.5 · Evidence confidence: Medium

Issue classification: none · Score treatment: not applicable

Assurance: Algorithm selection is appropriate and NIST-standardized. Level 3 chosen over Level 1 following July 2026 HAWK incident. Dual-scheme provides mathematical diversity. Not yet deployed in production.

ML-DSA-65 Level 3 chosen; SLH-DSA provides hash-based diversity. Two rest on different mathematics so weakness in one does not undermine the other.

• https://www.sui.io/blog/making-sui-quantum-ready

Claim: PQ audits are underway per Aug 2026 announcement; none published as of evaluation date. Existing classical audits (Zellic, Common Prefix secp256r1) are scope-mismatched for PQ.

Coverage basis: No published PQ audit

Implementation score: 0.25 · Evidence confidence: Low

Issue classification: assurance-only caveat · Score treatment: confidence-only

Assurance: PQ audits underway but not published; classical audits are scope-mismatched. Confidence capped at Medium for PQ claims. Audit absence does not create a Readiness & Risk Cap since PQ is not yet in production.

• https://www.sui.io/security
• https://www.sui.io/blog/making-sui-quantum-ready

Claim: Sui and fastcrypto are open-source for classical crypto. PQ core implementation announced as built but not confirmed merged in public main repos as of evaluation date.

Coverage basis: Open-source platform, PQ code unverified

Implementation score: 0.25 · Evidence confidence: Low

Issue classification: assurance-only caveat · Score treatment: confidence-only

Assurance: PQ code not independently verifiable in public repos; platform is open-source. fastcrypto README lists Ed25519, ECDSA, Groth16 — no ML-DSA/SLH-DSA confirmed in main branch.

Third-party project (pq-cybarg/sui-pq) demonstrates SLH-DSA on a local validator fork with Lean 4 formal verification, but this is not official Mysten Labs code.

• https://github.com/MystenLabs/sui
• https://github.com/MystenLabs/fastcrypto

Claim: Sui's flag-byte signature dispatch supports adding new schemes without protocol overhaul, demonstrated by post-launch addition of secp256r1. Cryptographic agility is a core design principle. Address aliases enable key rotation.

Coverage basis: Documented and demonstrated agility

Implementation score: 0.75 · Evidence confidence: High

Issue classification: none · Score treatment: not applicable

Assurance: Agility demonstrated in production through successful post-launch scheme addition. Flag-byte system well-documented.

Unified flag-byte + enum wrapper supports multiple coexisting schemes. secp256r1 added post-launch via protocol upgrade, proving the agility path is real.

• https://docs.sui.io/develop/cryptography/
• https://www.sui.io/blog/making-sui-quantum-ready

Claim: Chosen schemes (ML-DSA-65, SLH-DSA-SHA2-128s) are stateless, so anti-reuse/state-discipline concerns not applicable. Side-channel, fault-injection, and hardware-wallet hardening not yet evidenced; audits underway.

Coverage basis: Stateless schemes selected; side-channel unaddressed

Implementation score: 0 · Evidence confidence: Low

Issue classification: assurance-only caveat · Score treatment: confidence-only

Assurance: Stateless schemes avoid XMSS/LMS-style state-management risks. Side-channel/fault-injection hardening not yet demonstrated for PQ implementations.

Stateful-signature safety N/A for stateless ML-DSA/SLH-DSA. Side-channel and hardware-wallet considerations remain open.

• https://www.sui.io/blog/making-sui-quantum-ready

Claim: fastcrypto benchmarks classical schemes publicly. PQ announcement reports core implementation benchmarked; blog provides ML-DSA size/verification comparison (1312 B pubkey, 2420 B sig, ~0.5x Ed25519 verification). Full production throughput, storage, and fee-market impact not yet quantified.

Coverage basis: Benchmarked prototype

Implementation score: 0.5 · Evidence confidence: Medium

Issue classification: operational/product caveat · Score treatment: note-only

Assurance: Benchmarks claimed for prototype; production impact (throughput, storage, fees) not fully analyzed.

ML-DSA-65 verification cost reported as close to Ed25519; signature/public-key size increase is the main production concern. Sui's transaction size limits and programmable transaction blocks are said to absorb the increase.

• https://github.com/MystenLabs/fastcrypto
• https://www.sui.io/blog/making-sui-quantum-ready