Post-quantum posture: encrypted today, still encrypted after quantum
Celar's headline is precise on purpose: post-quantum confidentiality, classical anonymity and authentication. The confidential layer rests on lattice hardness and survives a quantum adversary; the identity, stealth, and shielded-pool layers are classical and do not. We publish exactly which is which rather than shipping an unqualified "quantum-safe" badge that would be false.
Layer by layer
| Layer | Primitive | Post-quantum status |
|---|---|---|
| Amounts, balances, contract state | TFHE / CGGI (LWE / RLWE) | Secure — already lattice-based |
| Threshold decryption & re-encryption | LWE-based threshold | Secure |
| Input proofs | (R)LWE ZKPoK | Secure |
| Hashing | Poseidon2, Keccak-256 | Secure — output sized with 2× margin |
| Identity & signatures | secp256k1 ECDSA | Broken by Shor → migrate to ML-DSA |
| Stealth addressing | secp256k1 ECDH | Broken by Shor → lattice KEM |
| Re-encryption target | X25519 | Broken by Shor → PQ KEM |
| Shielded-pool proofs | Groth16 / BLS12-381 | Broken by Shor → STARK / lattice SNARK |
Harvest now, decrypt later
The threat that matters for a confidentiality chain is an adversary who records chain data today and breaks it once a cryptographically-relevant quantum computer (CRQC) exists. Under that model the tiers diverge sharply:
- FHE-tier amounts and state stay hidden. They are lattice ciphertexts now; a future quantum computer does not open them. Data confidential today is confidential forever.
- Shielded-pool anonymity does not survive. Once BLS12-381 discrete log falls, recorded pool transactions can be retroactively de-anonymised. Amounts stay hidden; the transaction graph does not.
Signature migration is a different, more urgent clock
Harvest-now-decrypt-later is about confidentiality — data recorded now, opened later. Signature compromise is not an HNDL concern: a forged signature has no value after the fact, only in the present. But it is in one sense more urgent — the identity and signature layer must complete its migration before a CRQC exists at all, not merely before adversaries begin recording. There is no "harvest" grace period for authentication; the day the machine works, unmigrated signatures are forgeable.
How migration is engineered to be possible
Migrating the identity, signature, and ZK layers is a planned hard-fork track gated on NIST PQC maturity — not a launch deliverable, and not something to fake a date for. Crypto-agility is built where it counts: the versioned proof envelope admits a post-quantum proof system without a curve reversal, and the handle-based precompile ABI is scheme-agnostic, so the confidential backend can evolve without breaking contracts. The full per-layer analysis, including the migration triggers, is in §15.1 of the technical specification, shared with reviewers under NDA in the data room.