Hedera Publishes Post-Quantum Migration Roadmap as NIST Finalizes PQC Standards

Hedera released a detailed post-quantum cryptography migration roadmap in April 2026, outlining a phased transition from Ed25519 and ECDSA to NIST-standardized quantum-resistant algorithms. With expert surveys placing odds of a cryptographically relevant quantum computer at over 50% by the late 2030s, the timeline for migration is tighter than many networks acknowledge.

Last updated: April 17, 2026·Reviewed by: Autheo Intelligence

AI Analysis

Trend Correlation

Hedera's PQC roadmap directly parallels the bitcoin-bip361-quantum-migration-coin-freeze-april-2026 signal, which addressed Bitcoin's approach to protecting against quantum threats through BIP-361. While Bitcoin's approach focuses on coin-freeze mechanisms for vulnerable UTXOs, Hedera is targeting a phased cryptographic migration at the protocol and user-key level. The two approaches represent the spectrum of strategies available to established networks: Bitcoin prioritizing coin safety for existing holders, Hedera prioritizing operational continuity through gradual algorithm replacement.

Autheo Relevance

Autheo's QSDAG consensus architecture and the QIES (Quantum-Immune Encryption Standard) component are explicitly designed for this threat environment. Autheo's post-quantum cryptography stack isn't a retrofit; it's a design-time decision that gives the network a structural advantage over chains that are now planning migrations. The QSDAG layer provides quantum-resistant consensus signing, while QIES covers data encryption at the storage layer managed by ABW34. AutheoID can integrate FN-DSA or ML-DSA key types natively, enabling users to generate post-quantum identities from day one rather than migrating existing keys. For developers building on DevHub, Autheo's native PQC support removes the need to implement migration logic that chains like Hedera are spending years engineering.

Quantified Impact

Post-quantum signatures ranging from 1,280 to 4,627 bytes represent a 20x to 72x increase over Ed25519's 64-byte signatures. For a network processing 10,000 transactions per second, this translates to an additional 12.8MB to 45.3MB per second in signature data alone, requiring substantial increases in bandwidth and storage provisioning. Networks that plan for this now can architect for it; those that delay will face emergency infrastructure scaling. Autheo's QSDAG approach, which uses DAG-based consensus rather than linear block signing, is structurally more efficient at handling larger signature payloads because signature aggregation can occur across the graph rather than serially per block.

Full Analysis

Quantum computing's threat to blockchain isn't hypothetical anymore. It's a planning problem with a deadline.

Hedera published a post-quantum cryptography migration roadmap in April 2026 that lays out exactly how the network intends to transition away from Ed25519 and ECDSA, the signature schemes that secure virtually every blockchain in production today. Both are vulnerable to Shor's algorithm on a cryptographically relevant quantum computer (CRQC). The question isn't whether that computer will exist; it's when.

Expert surveys by Mosca and Piani (2024) place the probability of a CRQC existing by the late 2030s at over 50%, with meaningful probability as early as the mid-2030s. The NSA's CNSA 2.0 guidance requires federal systems to complete PQC migration by 2030 to 2035. The message from both government and academia is consistent: you need to start now, because migration at scale takes years.

NIST finalized three post-quantum cryptography standards in August 2024: FIPS 203 (ML-KEM, from CRYSTALS-Kyber) for key encapsulation, FIPS 204 (ML-DSA, from CRYSTALS-Dilithium) for digital signatures, and FIPS 205 (SLH-DSA, from SPHINCS+) as a hash-based backup with different security assumptions. A fourth standard, FIPS 206 (FN-DSA, from Falcon), is in progress with a final version anticipated around early 2027.

The size difference between current and post-quantum signatures is significant. Ed25519 produces 64-byte signatures. ML-DSA-87, the highest security level option, produces 4,627-byte signatures, more than 70 times larger. FN-DSA-1024 offers a middle path at 1,280 bytes, roughly 20 times Ed25519's size, which is why Hedera has selected it as the preferred migration target once FIPS 206 is finalized.

Hedera's roadmap proceeds in four stages: post-quantum TLS for node-to-node communication first, then post-quantum TLS for client connections, then hybrid signing using both classical Ed25519 and FN-DSA for consensus events, and finally a new post-quantum key type for users through HAPI. The user key migration is targeted for 2027. Existing Ed25519 and ECDSA keys continue working throughout; users rotate on their own schedule. Maximum transaction sizes will increase to accommodate the larger signature payloads.

Hedera already uses SHA-384 for hashing rather than SHA-256, giving it a degree of quantum resistance in its hash layer that most networks don't have. Symmetric encryption via AES-256 is similarly post-quantum safe against Grover's algorithm.

No major distributed ledger has completed a full migration to post-quantum signatures. Hedera's roadmap is one of the most detailed public commitments to a specific migration sequence that any blockchain project has published. That transparency sets a useful benchmark for the rest of the industry.

Key Facts

NIST finalized three post-quantum cryptography standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). ML-DSA-87 produces 4,627-byte signatures compared to Ed25519's 64 bytes, a size increase of over 70 times.

Hedera Blog→

Expert surveys (Mosca and Piani, 2024) place odds of a cryptographically relevant quantum computer existing by the late 2030s at over 50%, with meaningful probability as early as the mid-2030s. NSA's CNSA 2.0 mandates federal system migration by 2030 to 2035.

Hedera Blog→

Hedera's migration roadmap targets FN-DSA (FIPS 206) as its preferred post-quantum signature scheme, producing 1,280-byte signatures versus Ed25519's 64 bytes, with user key migration targeted for 2027 once the standard is finalized.

Hedera Blog→