ZCash and Algorand lack quantum resistance

Both Algorand and Zcash aren’t truly quantum-resistant from a strict cryptographic viewpoint, even though they sometimes pop up in casual talks about post-quantum tech. Algorand relies on Ed25519 signatures and a leader selection method using VRF, both of which are based on elliptic curve cryptography over Curve25519. Their Pure Proof-of-Stake system and how they pick validators don’t really change the main cryptographic principles at play. It ultimately hinges on the difficulty of the elliptic curve discrete logarithm problem, which is at risk once a quantum computer powerful enough comes along. Algorand actually admits this flaw: their current signature and VRF setups aren’t safe from quantum threats. They’ve rolled out Falcon-based state proofs for some cross-chain validations, but these don’t offer quantum safety for user accounts or validator signatures, which are still at risk. Zcash has its own unique vulnerabilities. Its shielded transactions use zk-SNARKs based on the BLS12-381 elliptic curve. These proofs are built around regular elliptic curve and pairing assumptions that can’t stand up to quantum attacks. zk-SNARKs give zero-knowledge and quick verification, but they still rely on the strength of elliptic curve problems. If those assumptions fail, it could compromise both privacy and correctness of the system, allowing for proof tampering and unauthorized note generation.

I do not know about zcash, it was only algo that Google said recently that is quantum resistant which caused the price of algo to increased to almost double at the time before falling back. But algo is planning on full quantum resistant cryptography https://pluang.com/en/news-feed/algorand-ungkap-peta-jalan-ketahanan-kuantum-2027

Thanks for sharing the link. I agree that Algorand having a roadmap is a positive thing, and it’s something worth recognizing. But there is a difference between having a migration plan and being quantum-resistant today. The roadmap itself acknowledges that the current cryptographic stack still relies on primitives that are not post-quantum secure. Algorand’s current security model still depends on Ed25519 signatures and an ECVRF construction based on elliptic curve cryptography. Those are well-tested schemes against classical attacks, but they are not designed to withstand a sufficiently powerful quantum computer running Shor’s algorithm. The Falcon-based state proofs are definitely an important development and show that Algorand is actively researching the problem. However, they do not make the entire network quantum-resistant. They are mainly focused on specific verification use cases, such as cross-chain proofs. User account keys, validator signatures, and the consensus layer still rely on traditional elliptic curve assumptions. The difficult part is not adding one quantum-resistant component, it is migrating the entire cryptographic foundation of a live blockchain. Replacing the signature scheme, VRF mechanism, and account structure while maintaining performance, compatibility, and decentralization is a major engineering challenge. Post-quantum alternatives, especially lattice-based systems, usually come with larger keys, larger signatures, and additional computational overhead. Regarding the Google/Falcon announcement: it was a meaningful step, but some coverage exaggerated what it meant. Implementing Falcon in a specific part of the ecosystem is not the same as making Algorand fully quantum-resistant. The same discussion applies to many major chains, including Bitcoin. Any network relying on ECDSA, EdDSA, or similar elliptic curve-based cryptography will eventually need to address this transition. Algorand deserves credit for recognizing the issue earlier than many projects, but awareness of the problem is not the same as having solved it. The projects that are quantum-resistant today are the ones that were designed around post-quantum cryptography from the beginning.

I think have to disagreed with you about Zcash was not quantum resistant. It's basically already a quantum resistant because it's already used the shielded transaction. The shielded transactions was already built on zcash construction since it's being created. So i believe to call it's not yet quantum resistant is not right. However, improvement to ensure it's will be quantum resistant is needed like doing implement post-quantum algorithm to its structure. As i know Zcash developers and its community are now focusing on post-quantum algo update. So it's likely we will see Zcash to be fully quantum resistant. As for Algorand, i don't see any urgent to implement quantum resistant update bcoz none uses it now.

Respectfully, I have to disagree here. Shielded transactions provide privacy, not quantum resistance,  these are not the same thing cryptographically. The zk-SNARKs underlying Zcash’s shielded pool are instantiated over elliptic curve pairings (BN-254/BLS12-381). Those pairing assumptions are broken by Shor’s algorithm just like any other ECDLP-based construction. The zero-knowledge property survives, but the soundness does not, meaning a quantum adversary could potentially forge valid proofs entirely. There’s also a second vector that rarely gets discussed: note encryption in shielded transactions uses ECDH key derivation, with the ephemeral public key recorded on-chain. That’s a textbook harvest-now-decrypt-later exposure, every shielded transaction recorded today is retroactively decryptable by a future quantum attacker with the recipient’s address. Tachyon is promising, but it’s a roadmap, not a deployment. Genuinely curious, what specific property of the shielded construction do you believe provides quantum resistance? Because from a strict cryptographic standpoint I don’t see it, and would love to be corrected if I’m missing something.

ZCash is currently not quantum resistant. Privacy provides benefits in some aspects, but it also makes other aspects worse. For example attacker with quantum computer will be able to secretly create new coins, because the ZK proofs are currently based on the vulnerable elliptic curve cryptography. And thanks to the privacy, no one could detect if/when that happens. And the transparent addresses face the same issues as other public chains, where quantum attacker can steal the coins from any wallet with exposed public keys (which become exposed when you send first transaction from your wallet). They are working on improvements, which is great, but all the users still need to manually migrate their coins eventually (after the PQ upgrade of the network is completed), and that is probably the most painful part of the whole process.

This is exactly the point I wanted to make. Many coins are trying to market themselves as quantum-resistant when, in reality, all of them are vulnerable. I’ll repeat it: the only truly quantum-resistant coins today are those that were founded that way from the start: QRL, Abelian, and Mochimo (if there are any others, let me know).