PQ1™ Whitepaper

1Threat model: Q-Day

Q-Day is the moment a cryptographically-relevant quantum computer (CRQC) becomes capable of executing Shor's algorithm at the scale needed to break the secp256k1 elliptic curve used by Ethereum and every other EVM chain. Conservative estimates place Q-Day between 2030 and 2040; the harvest-now-decrypt-later threat is, however, already operative - adversaries are recording on-chain ECDSA signatures today to break them later.

PQ1™ is engineered to remain secure across this transition. Every transaction is signed with SPHINCS+ - a stateless hash-based signature scheme that NIST standardized as SLH-DSA in FIPS-205 in August 2024. PQ1™ uses a parameter set called C10 tuned for on-chain verification (4-KB signatures, SHA-256 hash function, 128-bit post-quantum security). There is one signature primitive in the wallet and one in the firmware-update path; no ECDSA, no hybrid fallback, no "just in case" classical signer that would be broken on Q-Day.

Hash-based signatures have the most conservative security assumption of any post-quantum family. Their security reduces to the security of the underlying hash function (SHA-256) - there is no number-theoretic assumption that could collapse the way isogenies did in 2022, when SIKE was broken on a single laptop after surviving four NIST rounds.

2Hardware architecture

PQ1™ is built around the STM32U585 (Cortex-M33 with Arm TrustZone) and two independently-sourced secure elements: an Infineon OPTIGA Trust M V3 and an NXP SE050, both CC EAL6+. The BIP-39 entropy is XOR-split across the two chips: neither chip alone reveals a single bit of the seed. PIN verification runs in the silicon of each secure element (not in MCU software), and a three-way lockstep counter - SE050 UserID, OPTIGA monotonic LUC, and an MCU flash page - bricks the device after ten wrong PINs.

All post-quantum signing runs in the STM32U585 TrustZone secure world. The secure elements provide encrypted seed-half storage, hardware PIN gating, and authenticated I2C tunnels (OPTIGA Shielded Connection and SCP03); the SPHINCS+ math itself executes on the STM32 with the on-die HASH peripheral accelerating SHA-256. The non-secure world never sees the PIN, the seed, or any signing key.

3Account-abstraction integration

Ethereum validators do not natively verify SPHINCS+ signatures. PQ1™ sidesteps this with an ERC-4337 v0.6 smart-contract wallet whose validateUserOp function calls an immutable, on-chain SPHINCS+-C10 verifier written in optimized Yul. The EntryPoint version is frozen at v0.6: the v0.6 address and ABI are baked into the wallet's initCode, so the same 24 recovery words produce the same wallet address on every EVM chain that has a v0.6 EntryPoint deployed.

From the user's perspective, transactions look exactly like normal Ethereum transactions - same UX, same explorers, same dApp compatibility. EIP-1271 and ERC-6492 are supported for off-chain signing, so PQ1™ works with Sign-In-with-Ethereum, CowSwap orders, Safe co-signing, and any dApp that uses Solady-style signature validation.

4Supply chain & reproducible builds

Every PQ1™ firmware release is built reproducibly: the binary running on your device can be byte-compared against a build you produce locally from the published source. The bootloader verifies firmware signatures against on-die root keys at every power-up, and the laser-etched tamper-evident seal is photographed and the photo's hash recorded on-chain at fulfillment time.

5References

1. NIST FIPS-205 - Stateless Hash-Based Digital Signature Standard (SLH-DSA, the SPHINCS+ family)
2. NIST FIPS-204 - Module-Lattice-Based Digital Signature Standard (ML-DSA)
3. ERC-4337 - Account Abstraction Using Alt Mempool
4. EIP-1271 - Standard Signature Validation for Contracts
5. ERC-6492 - Signature Validation for Predeploy Contracts
6. Infineon - OPTIGA Trust M V3 Datasheet
7. NXP - EdgeLock SE050 Datasheet