A working group that includes Blockstream researchers has published the first draft of a Bitcoin Improvement Proposal specification for SHRINCS, a hash-based post-quantum signature scheme designed around Bitcoin’s block-space constraints. The SHRINCS specification combines a compact stateful signing path with a larger stateless fallback. The design prioritizes keeping quantum-resistant transactions practical without pretending that stronger cryptography comes free of operational or capacity costs.
SHRINCS has already moved beyond laboratory testing. Blockstream deployed SHRINCS signature verification on Liquid in March 2026, confirming post-quantum-signed transactions on the production sidechain through Simplicity. That deployment demonstrates that the underlying construction can be exercised in a live blockchain environment, but it does not make the new Bitcoin proposal production-ready. The draft still lists its formal security proof as unfinished, while its reference implementation is explicitly limited to demonstration and testing.
Smaller Signatures Target Bitcoin’s Block-Space Constraint
The draft specifies a 48-byte public key and stateful signatures ranging from 548 to 4,619 bytes, depending on key use, while the stateless fallback is 5,777 bytes. Even the smallest SHRINCS signature remains far larger than Bitcoin’s 64-byte Schnorr signatures, but the proposal is engineered to reduce the much steeper capacity penalty associated with some post-quantum alternatives.
That comparison matters because the National Institute of Standards and Technology (NIST) standardized SLH-DSA, the hash-based SPHINCS+ descendant used as the foundation for SHRINCS’ stateless component, in FIPS 205. SHRINCS uses those algorithms with a non-standard parameter set that reduces its stateless signature from 7,856 bytes under SLH-DSA-SHA2-128s to 5,777 bytes. The proposal therefore borrows from standardized post-quantum cryptography while deliberately changing parameters to better fit Bitcoin’s economic constraints.
Blockstream’s earlier throughput analysis estimated that a compact SHRINCS configuration could support roughly 3 transactions per second if used across Bitcoin, compared with around 0.36 TPS for SLH-DSA under the same assumptions. The central engineering trade-off is additional implementation complexity in exchange for materially less pressure on scarce block space. These estimates remain modeling assumptions rather than measured Bitcoin mainnet performance.
Stateful Signing Shifts Risk Toward Wallet Operations
SHRINCS achieves its smaller signatures partly by tracking state so one-time signing material is not reused. That requirement makes wallet design more demanding because implementations must preserve the correct state across signing activity, backups and device changes. The cryptographic efficiency therefore creates an operational dependency that Bitcoin’s current Schnorr signing model does not impose in the same way.
The stateless path is intended to preserve recoverability when signing state is unavailable, but at the cost of a 5,777-byte signature. The draft also warns that keys using certain optimization techniques may be incompatible with implementations that do not support them, potentially resulting in lost funds. For hardware-wallet vendors and custodians, implementation compatibility and state management could become as important as signature size itself.
The proposal remains explicitly marked Draft, with no BIP number assigned and comprehensive test vectors and an optimized implementation still unfinished. Bitcoin’s own BIP process also makes clear that publication of a proposal does not itself signal community consensus or adoption. SHRINCS is therefore best viewed as a concrete candidate entering technical scrutiny, not an agreed path for a quantum-resistant Bitcoin upgrade.
