Chain profile
Proposed SLH-DSA-SHA2-128s for transaction signatures as an opt-in scheme, accepting signatures 82 times larger than Ed25519 in exchange for minimal new security assumptions.
No, not today. Aptos accounts sign with Ed25519, which a sufficiently large quantum computer would break. Aptos has proposed adding SLH-DSA-SHA2-128s, the hash-based signature scheme standardised by NIST as FIPS 205, for transaction signatures. The proposal is unusually candid about the cost: signatures would be 7,856 bytes, roughly 82 times larger than an Ed25519 signature, and verification takes about 294 microseconds, roughly 4.8 times slower. The compensating argument is conservatism, because SLH-DSA relies on SHA-256, a hash function blockchains already depend on heavily, so adopting it introduces very few new cryptographic assumptions. Existing Ed25519 accounts would continue to work normally, with the post-quantum scheme offered to those who opt in.
Ed25519 for account authentication
SLH-DSA-SHA2-128s proposed for transaction signatures, offered opt-in alongside Ed25519
FIPS 205 (SLH-DSA), finalised August 2024
Tier 3: Committed. A funded roadmap with public dates and active research exists, but no post-quantum signature is live on mainnet.
| No. | Dimension | Score | Weight | Contribution |
|---|---|---|---|---|
| 1 | Signature scheme | 0 | 30% | 0.0 |
| 2 | Deployment stage | 5 | 25% | 12.5 |
| 3 | NIST alignment | 9 | 15% | 13.5 |
| 4 | Migration path | 6 | 15% | 9.0 |
| 5 | Exposure | 2 | 10% | 2.0 |
| 6 | Verification | 7 | 5% | 3.5 |
| Hardy Score | 40.5 | |||
Aptos transactions are signed with Ed25519 today and nothing post-quantum protects live APT. The SLH-DSA scheme is a proposal rather than a deployed mainnet feature. source
Tier 3: Committed. A specific scheme with published performance characteristics has been proposed and is under active work, with nothing post-quantum live on mainnet. source
SLH-DSA-SHA2-128s is a parameter set of FIPS 205, a final NIST standard published in August 2024, not a candidate awaiting publication. Choosing a hash-based standard also means the security rests on SHA-256, which the chain already depends on. source
Existing Ed25519 accounts keep working and the post-quantum scheme is offered opt-in, which avoids a forced migration. The deductions are that protection is therefore not automatic for existing holders, and that the proposal had not been adopted on mainnet at the time of writing. source
Aptos is an account-model chain and an account's authentication key is published on-chain when it first transacts, so effectively all economically active supply has an exposed key and is harvestable today. source
The proposal is public and states its own costs precisely, including signature size and verification time, which is a form of honesty that is easy to check and easy to get wrong. Aptos is open source. The deduction reflects that this is a proposal rather than shipped and audited code. source
The deployment dimension is not a separate judgement. It is Tier 3 expressed as a number. See the tier mapping.
NIST finalises SLH-DSA as FIPS 205, giving Aptos a published standard to propose against. source
Aptos proposes SLH-DSA-SHA2-128s for transaction signatures, with 7,856-byte signatures and roughly 4.8 times slower verification, offered opt-in while existing Ed25519 accounts continue to work. source
Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.
Aptos publishes an account's authentication key on-chain once the account transacts, so in practice every economically active account has an exposed key that can be recorded today against a future quantum computer. Aptos accounts do support key rotation, which is a useful primitive for a future migration because it lets an account change its authentication key without moving funds to a new address, but rotation does not undo the exposure of a key that has already been published.
What this rating means for you
Aptos has a funded roadmap but no post-quantum signature protecting funds on mainnet yet. Until it ships, your exposure is the ordinary one, and the steps that reduce it cost nothing.
Editorial guidance from the Hardy Index. Nothing on this profile is sponsored and nothing on it is an affiliate link. The guides carry disclosed affiliate links, which never affect a rating. How we make money.
No. Aptos accounts authenticate with Ed25519, which a sufficiently large quantum computer would break. Aptos has proposed adding SLH-DSA-SHA2-128s as an opt-in post-quantum signature scheme, but that proposal is not live on mainnet.
Because it minimises new assumptions. SLH-DSA is hash-based and relies on SHA-256, a function blockchains already depend on heavily, so adopting it adds very little new cryptography to trust. The cost is size and speed: signatures of 7,856 bytes, about 82 times larger than Ed25519, and verification roughly 4.8 times slower.
Not under the proposal as published. Existing Ed25519 accounts would continue operating normally, with SLH-DSA offered only to holders who opt in. That avoids forcing a migration, but it also means existing accounts are not protected by the upgrade itself.
Its algorithm choice is among the strongest, because SLH-DSA is a final NIST standard and hash-based schemes carry the most conservative security assumptions in the set. Its weakness is the same as its peers: nothing is live on mainnet, so the signature dimension, which carries 30 per cent of the score, earns nothing.
This is a security-readiness assessment, not investment advice.