Today marks the 12th anniversary of the Tezos white paper, and today, Nomadic Labs, Trilitech, and other contributors are proud to unveil the upcoming preview net for a fully post-quantum version of Tezos. This previewnet is currently being tested internally and will be made publicly available during September.

Simply speaking, like every other blockchain, Tezos is secured with cryptographic techniques. These cryptographic techniques typically use a mathematical object known as an “elliptic curve”. As far as we know, classical computers cannot break these techniques without a literally astronomical amount of computation. However, once quantum computers become sufficiently large, they will be able to break them with ease. Fortunately, not all cryptographic techniques are vulnerable to quantum computers. So-called “post-quantum cryptography” uses algorithms that remain out of reach of quantum computers. These techniques haven’t been widely adopted yet because they are typically a bit more costly in terms of computer usage, and there hasn’t been a pressing need for them. This is changing.

When Tezos began in 2014, quantum computers were a distant concern. Back then, the most advanced quantum computing experiments operated with just a few qubits. Researchers demonstrated, for instance, quantum error correction on a five-qubit superconducting device. NIST had not even begun its post-quantum cryptography standardization process, which formally began in 2016.

However, from its inception, the project saw the need to evolve as critical for resilience. The Tezos position paper explicitly anticipated having “new cryptographic primitives included in the scripting language as the need develops”, while the white paper emphasized that Tezos protocols could evolve by amending their own code.

Quantum computing is now in a completely different state than it was 12 years ago. Google’s Willow processor holds 105 physical qubits and has demonstrated below-threshold quantum error correction: as the size of its encoded logical qubits increased from 3×3 to 5×5 to 7×7 physical qubits, the logical error rate halved each time. Willow by itself doesn’t present a threat to cryptography, but it shows that scalable error correction is a real, experimentally demonstrated phenomenon.

At the same time, the estimated resources required to attack elliptic-curve cryptography have been falling sharply. In March 2026, Google published quantum circuits for solving the 256-bit elliptic-curve discrete logarithm problem using fewer than 1,200 logical qubits and 90 million Toffoli gates, or fewer than 1,450 logical qubits and 70 million Toffoli gates. Under Google’s hardware assumptions, this corresponds to fewer than 500,000 physical qubits, roughly a 20-fold reduction from its previous estimate.

Google has set a 2029 deadline for itself to fully migrate to post-quantum cryptography. In its own words, “We’re setting a timeline for post-quantum cryptography migration to 2029.” This is just around the corner.

The first step to make Tezos post-quantum was taken with the Ushuaia protocol amendment, activated on June 30, 2026, which introduced testnet-only support, behind a feature flag, for tz5 accounts using ML-DSA-44, the NIST-standardized form of CRYSTALS-Dilithium under FIPS 204.

As I’ve said before, allowing users to start safeguarding their funds with a post-quantum key is priority number one, as this can take a long time. Most people who hold cryptocurrencies do not regularly monitor technological changes, and they cannot easily be contacted. Hopefully, as progress in quantum computing becomes increasingly mainstream, more people will pay attention and take the necessary steps. Fortunately, the vast majority of keys used on Tezos are derived from seed words. If users fail to use a post-quantum key by a fencepost date, the protocol may still require submission of a post-quantum zero-knowledge proof of knowledge of the seed words.

But the challenges of moving to post-quantum cryptography do not stop at user keys. The Tezos protocol relies on quantum-vulnerable primitives for at least five different functions. These are:

• The computation of a VDF, as a source of randomness, which uses class groups.
• The aggregation of consensus operations (attestations), which saves crucial space in blocks and depends on BLS signatures.
• The KZG polynomial commitments and proofs used by the DAL, or Data Availability Layer.
• The Michelson primitive for confidential transactions, which uses the Sapling circuit.
• The Michelson primitive for timelock puzzles.

Today, Tezos core developers are unveiling a previewnet for a post-quantum version of Tezos.

Confidential transactions have already been addressed by TzEL, and this will likely see further iterations. Timelock puzzles are an interesting primitive, but they are currently unused, so they haven’t been a priority; there are, however, various ways of providing a post-quantum version of that primitive.

The VDF was an addition to the protocol that hardened our RANDAO / commit-reveal mechanism. While there are STARK-based candidate post-quantum VDFs, we instead opted to simply remove randomness from the protocol using a smooth weighted round-robin, which guarantees fairness.

The biggest pieces of the puzzle were the aggregation of consensus operations and the DAL. For the former, we turned to the LeanEthereum project, which has developed a very efficient post-quantum STARK that can aggregate hash-based signatures extremely fast. On an M4 Max, its published CPU-only benchmark processes 1,426 XMSS signatures per second in its “proven regime”, producing a 327 KiB proof. It is particularly efficient on hardware with high memory bandwidth, such as Apple’s M4-family chips.

In this previewnet, we are using a version that uses Poseidon hashes, but we will soon migrate to the new version being pushed by the LeanEthereum project, leanVM-b, which operates over a 192-bit binary field and uses the standard BLAKE2s hash function. In its current published benchmark, also on an M4 Max, it aggregates 900 XMSS signatures in 0.797 seconds, or about 1,129 signatures per second, producing a 295 KiB proof that verifies in 16.5 milliseconds. The project currently describes this implementation as highly experimental.

For the DAL, after looking at several options, we opted for ZODA. ZODA is a data-availability protocol built on two-dimensional tensor codes that is plausibly post-quantum secure (an understatement) and extremely efficient. The ZO stands for “Zero Overhead”: the protocol is designed to add essentially no communication overhead beyond the underlying encoding. It was developed by Alex Evans, Nicolas Mohnblatt, and Guillermo Angeris at Bain Capital Crypto.

And there we have it: the pieces are in place and will be submitted over time as protocol amendments for Tezos to become fully post-quantum. This is a piece of protocol development we knew would come and, 12 years after the white paper, it’s finally time!

We encourage bakers, enthusiasts, and all Tezos fans to stay tuned for the previewnet, coming this September. It remains experimental software and will likely break in a variety of interesting ways, but that’s precisely why we need it.