Ethereum Foundation researcher Justin Drake has called on the blockchain industry to prepare for the possibility that a cryptography-breaking discovery could arrive soon. Such a discovery might not be announced at all: Drake suspects it could be kept quiet rather than published. AI, guided by researchers, has recently produced a run of new mathematical results. These results have led some researchers, Drake among them, to expect a breakthrough against today’s cryptography sooner than once thought.
For years, cryptographers have prepared for threats from quantum computers through a combination of migrating to new cryptographic primitives, such as lattices, and designing safety nets with hash functions while continuing to use elliptic-curve-based systems. The deadline to prepare for an active quantum attacker is projected for 2030. However, Drake warns that AI could break elliptic curves on existing hardware, in the worst case within months rather than years. He further argues that any primitive built on structured mathematics, whether elliptic curves, lattices or isogenies, may be at risk. Surprising breakthroughs are not unheard of: in 2022, SIKE, a post-quantum candidate in NIST’s standardization process, was broken by a classical attack that recovers keys in about ten minutes on a single core.
Vitalik Buterin responded and, like Drake, cautioned against rushing to move funds to fresh addresses. He also treats AI-accelerated mathematics as a real risk, and singled out lattice-based schemes, such as the ML-DSA signature standard, as a new area of concern. That concern reaches well beyond Ethereum: lattices underpin most of the post-quantum standards the industry has been migrating towards, including ML-KEM, which Logos uses to encrypt private accounts and messages.
At IFT, we take both known quantum risks and hypothetical AI risks seriously. In a previous forum post, we examined how the Logos tech stack is prepared for quantum attackers. How does it hold up against a break driven by AI? In this post, we examine LEE, RLN and LogosChat; we’ll address the Logos blockchain in a future post.
Two kinds of damage
A cryptographic break can do two kinds of damage:
- Permanent loss of privacy. Encrypted data recorded today can be decrypted after a future break: the harvest-now, decrypt-later attack.
- Containable loss of integrity. Forged signatures or proofs can take over accounts or bypass spam protection. A prepared network can reduce the impact.
Logos is private by default. Some components, such as LEE, also support public accounts, but each was designed from the start to protect against loss of privacy. That decision was made with quantum computers in mind, but it also pays off in Drake’s scenario: none of our protections against harvest-now, decrypt-later attacks rely on elliptic curves alone. Where they depend on anything beyond hash functions and symmetric ciphers, it is lattices, through ML-KEM. That makes the lattice concern raised by Drake and Buterin the one that matters most for privacy on Logos, and we address it below. Beyond that, most of the remaining work is in integrity.
LEE: keys rest on hashes, encryption rests on lattices
The Logos execution environment (LEE) is the privacy-agnostic execution environment that provides the protocol framework for the Logos execution zone (LEZ). LEZs are deployed as layer 2s on the Logos blockchain. LEE supports both public and private accounts, which can interact with each other through public and private transactions.
Public accounts are stored on-chain in plaintext and authorized with Schnorr signatures on secp256k1, the same curve as Bitcoin and Ethereum. A curve break would allow an attacker to recover the signing key and forge signatures. On Bitcoin and Ethereum, the signing key is the account’s only secret. In LEE, it is not: the Schnorr secret key is derived from a deeper secret key through a hash, and a curve break does not expose that deeper key.
This hash barrier was designed with quantum attackers in mind. LEE will eventually migrate from Schnorr signatures to a post-quantum signature scheme. At that point, the deeper secret key will take over authorization, so an exposed Schnorr key will no longer matter. That plan assumes there is time to migrate, which an abrupt AI-assisted discovery may not allow. We are working on incorporating bunker mode into LEE: an account’s public key stays hidden behind its hash until it is first used, and the signing key is rotated after each use. Bunker mode is planned for v0.4.0, so public accounts will be protected from the start of mainnet.
Private accounts work differently. They are updated off-chain in the RISC Zero zkVM; each update is posted on-chain as ciphertext, together with a commitment that binds the private account’s state and a nullifier that prevents earlier states from being reused. The validity of the update is attested to by a zero-knowledge proof that asserts the integrity of the underlying RISC Zero execution.
Control of private accounts rests entirely on hash functions. Many of the keys associated with a private account are derived with SHA-256 or HMAC-SHA512. Commitments and nullifiers are hash-based as well. This design is post-quantum secure and follows Drake’s recommendation of hash functions such as SHA-256.
The contents of private accounts are encrypted with ML-KEM-768 and ChaCha20 and stored on-chain. Neither depends on elliptic curves. Unlike LogosChat, LEE does not pair ML-KEM-768 with an elliptic-curve scheme: elliptic-curve encryption is expected to fail once quantum computers arrive, so LEE followed NIST’s guidance and adopted post-quantum encryption on its own.
However, Drake and Buterin raised concerns about cryptography that rests on structured mathematical assumptions, and lattices are among them. ML-KEM-768 is believed to be post-quantum secure, but AI could uncover an unknown vulnerability in lattices. Such a discovery would allow the history of all private accounts to be read. It would only compromise ciphertexts, though, not account usage or ownership. ML-KEM is NIST’s standardized post-quantum key encapsulation mechanism (FIPS 203), so this risk is shared by every system that has adopted it.
RLN: anonymity holds, spam protection is the exposure
RLN (rate-limit nullifier) is the spam-prevention mechanism for Logos. Each member of an RLN group can send a set number of messages per epoch, and any member who exceeds that limit is removed from the group. Members remain anonymous within the group as long as they keep to the limit. Each message carries a zero-knowledge proof attesting that the sender belongs to the group and is within their limit, without revealing which member sent it. Once a member exceeds the limit, anyone can recover their secret identity.
RLN uses Groth16 because of its small proofs. Groth16’s integrity relies on the infeasibility of reversing elliptic-curve arithmetic to recover a secret scalar, known as the discrete logarithm problem. Quantum computers can solve this problem efficiently with Shor’s algorithm, but no efficient classical algorithm is known. If one is found, Groth16 proofs can be forged, and RLN’s rate limit no longer holds: anyone could send unlimited messages without revealing an identity. Senders stay anonymous, however, because Groth16 proofs reveal no information about the sender.
A break of Groth16 would not let an attacker impersonate a specific member, so the damage is limited to spam. What differs between the known quantum threat and the hypothetical AI threat is the warning. Quantum computer development is public: companies such as Google and IBM announce their qubit milestones, so a migration can be planned in advance. An AI-assisted discovery could be announced publicly or kept secret, which makes it much harder to prepare for. Once a break is known, RLN services can pause to keep the network from being flooded with spam.
Groth16’s small proof size ensures that RLN does not add significant bandwidth overhead to messages. Proof size is therefore a serious constraint on any replacement: currently, no suitable alternative to Groth16 produces proofs this small.
LogosChat: messages are protected twice, accounts are the exposure
LogosChat is a private chat protocol that supports group conversations and direct messages. Each user has an account, and each of their devices holds a device-specific key. The device key is endorsed by the account and recorded in an append-only account log.
Messages are encrypted with X-Wing, which combines X25519 (elliptic curves) with ML-KEM-768 (lattices). X-Wing was selected to secure messages against harvest-now, decrypt-later attacks by a quantum attacker. An attacker must break both schemes to read a message. A curve break alone, whether from an AI-assisted discovery or from a quantum computer, leaves every conversation private.
Messages are signed with Ed25519. Drake’s recommendation of bunker mode is not suitable for messaging: a recipient needs the sender’s public key from the first message to check that it is valid, so the key cannot stay hidden behind a hash. A curve break would allow an attacker to impersonate a user by forging new messages in their name. However, this risk is different from that of a blockchain. On a blockchain, a forged signature can move funds or alter state that the whole network agrees on. Messages carry no historical consensus state, so there are no assets to steal and no ledger to rewrite.
Nor can an attacker inject messages into a chat history, because of forward secrecy: encryption keys for past messages are no longer valid, and a message that claims to be from the past fails a recency check and is discarded. This limits the attack surface of chat to current and future messages until LogosChat moves to a new signature scheme, and gives us time to make that switch.
Accounts are long-lived, so the ability to add or revoke keys on an account is more damaging than the ability to forge messages. Each device key is endorsed separately, and devices do not need to share a signature scheme: one could use Ed25519 and another a post-quantum scheme. If a scheme is compromised, the affected device keys can be revoked through the account log, provided the account root key is still sound.
The root key is the bigger risk. Currently, it is an Ed25519 key pair, and a curve break would allow an attacker to sign as the account, adding their own devices or revoking the owner’s. LogosChat plans to change the root key so that accounts survive such a break. In the longer term, the goal is to migrate to an identity model where users are not represented by key pairs, eliminating the risk that a new vulnerability in a signature scheme compromises an account at its root.
Summary
At IFT, we treat every threat to the cryptography behind Logos seriously, whether it comes from quantum computers or from an unexpected AI-assisted discovery. Logos was designed so that a curve break would not expose the history of its users, and the remaining exposures are being addressed: bunker mode for LEE public accounts before mainnet, a move away from key pairs for LogosChat accounts, and the ongoing search for a more suitable proof system for RLN. None of this requires action from users. We will keep monitoring new developments and adapting the Logos tech stack as the threat landscape changes.