Trezor CTO Tomas Susanka reports that SHRINCS, the community’s leading post-quantum signature candidate, forces wallet makers to choose between efficient but risky stateful signatures and safe but bulky stateless ones. Proposed by Blockstream Research Director Jonas Nick and cryptographer Mikhail Kudinov, the scheme uses a composite hash-based approach where users can sign transactions with either method. Stateful signatures are ten times smaller than their stateless counterparts, making them attractive for fee efficiency and speed. However, these compact signatures rely on a tree of one-time keys that expose funds to theft if reused beyond a specific signing budget. Reusing a key reveals enough cryptographic information for an attacker to forge a user’s signature and steal assets, creating a strict requirement for rigid state tracking.
The State Tracking Burden
Susanka argues that maintaining this count is a developer responsibility, not a user burden, because giving users an option to mess up is unacceptable. "It’s our job to make it in a secure way, right? It shouldn’t be the user’s job," he said during a recent episode of MARA Foundation TV. Trezor is considering making the heavier stateless signatures the default setting while hiding the riskier stateful option behind advanced settings to mitigate accidental misuse. The complexity deepens when users hold multiple devices with the same recovery seed, as sharing state between two Trezors is effectively impossible without introducing new vulnerabilities. Susanka admits he is "kind of torn" because the state maintenance burden is significant, yet the size advantage of stateful signatures makes him reluctant to discard them entirely. This trade-off means developers must design interfaces that prevent state desynchronization while preserving the performance benefits of smaller transaction data.
Hardware and Migration Realities
Hardware wallets also require physical upgrades because most current devices use quantum-vulnerable cryptography for firmware and device authentication. Users need "quantum-ready" devices that employ post-quantum cryptography for these internal security functions to ensure full protection. Trezor is already shipping products like the Safe 7 that support post-quantum wallet authentication, though transactions remain vulnerable until Bitcoin itself upgrades its protocol. Susanka warns that migrating potentially millions of users will take considerable time, so developers should not wait too long to provide migration options. He urges the industry to accept compromises rather than adhering to strict standards that stall progress, stating, "If we’re all going to be very strict on what can and cannot be done, we’re not going to get anywhere."
