Paper 2026/352 Original: eprint.iacr.org/2026/352 ↗

Post-Quantum Migration for Bitcoin and Ethereum: Hidden-Key Proofs, Finalization, and Enforcement

Abstract

Quantum computers threaten the elliptic-curve signatures used by Bitcoin and Ethereum once a public key appears on-chain. Hidden-key credentials, including those controlling Bitcoin P2PKH/P2WPKH outputs and unused Ethereum EOAs, have a different risk profile: their public keys are hidden behind hash-derived addresses, but classical spending reveals them. We propose a migration design that separates revealed-key and hidden-key credentials. Revealed-key credentials may use hybrid classical/post-quantum authorization only while the legacy signing secret remains uncompromised; after quantum recovery of that secret, an independent rescue policy or pre-committed recovery credential is required to distinguish the owner from an attacker. Hidden-key credentials use STARK-verifiable ownership relations that bind a legacy identifier to a commitment to a post-quantum public key without explicitly publishing the legacy elliptic-curve public key as a public value. Complete enrollment opens the commitment and verifies post-quantum key possession. The design adds one-way migration-registry semantics, quantum hash-security analysis, scenario-based network-capacity evaluation, and an SP1-based prototype. We distinguish Groth16/PLONK wrapping, which is only a current-EVM compatibility path, from an intended quantum-era transparent verification path; the exact post-quantum security of a concrete SP1 deployment depends on the pinned SP1 version, proof mode, and all cryptographic subarguments used by that configuration.