Logos, as a private-by-default project, takes privacy threats very seriously. While quantum computers capable of breaking cryptographic schemes are years away, it is essential for Logos to be ready for the threat they pose.
The quantum threat
Quantum computers are a threat to systems that rely on cryptographic assumptions through algorithms such as Grover’s algorithm and Shor’s algorithm. These algorithms weaken the security assumptions and guarantees that many cryptographic tools rely on, thus weakening the system as a whole.
Governmental agencies and other institutions have been developing new cryptographic tools that are secure against quantum computers. Such tools are referred to as post quantum (PQ) secure. By 2030, quantum computers are estimated to be powerful enough to breach the security of non-PQ tools that are used in practice; migration to PQ-secure tools should occur before then.
2030 is only the deadline for an active attack. This is not the only risk that quantum computers pose to Logos. Rather, a malicious entity can begin accumulating encrypted messages, now, with the expectation that a quantum computer in the future can decrypt the messages. This type of attack is called harvest-now and decrypt-later (HNDL).
At mainnet launch, HNDL is the most crucial threat for Logos to be secure against. This ensures that any private messages or transactions exchanged in the Logos ecosystem are secure now and in the future. Certain portions of the Logos techstack can rely on non-PQ tools provided these do not compromise confidential details later. These tools can be patched out of Logos’ techstack later, at which point Logos would be fully PQ secure.
Logos techstack
Logos blockchain
Logos blockchain is the layer 1 of the Logos ecosystem.
Logos blockchain utilizes a mixture of signatures and proofs in its Blend network and consensus algorithm (Cryptarchia). Logos blockchain has HNDL deficiencies in the Blend protocol for key exchange and message encryption. These issues are being handled in two phases by the Logos blockchain team to ensure that the blockchain is HNDL secure before mainnet.
Less crucially, Logos blockchain uses Ed25519 signatures which can be forged by an active quantum attacker. This does not open up any attacks prior to mainnet.
The hardest task for securing Logos blockchain against PQ attackers is migrating from Groth16 to a PQ-secure zk proof system. Groth16 is used for multiple proofs within Logos blockchain each of which will incur invasive message overhead increases from the change over. This is a necessary migration as Groth16 proofs can be forged by a quantum attacker. However, this is not essential before mainnet.
Migration to PQ-secure signature schemes and proof system are on Logos blockchain’s roadmap.
Logos execution environment
Logos execution environment (LEE) is a privacy agnostic execution environment that provides the framework architecture used by the Logos execution zone (L2 on Logos blockchain).
LEE consists of public and private states, each of which having their own accounts and key protocol. Public accounts are authorized through signatures (similar to other blockchain projects) and are entirely stored (in plain-text) on chain. Private accounts are updated and used off-chain within Risc0. Updates to a private account are emitted to the chain with a fresh commitment (hash of the account’s state), nullifier (cryptographic flag that prevents reusing a previous account state) and a zk proof attesting to the correctness of the program execution.
The main quantum attack vectors of LEE are public account signatures and the encryption techniques for private accounts.
LEE uses Schnorr signatures for public account authorization. Schnorr signatures are not PQ-secure and, often, a source of HNDL for other projects. LEE public account keys are designed with HNDL vulnerability in mind. LEE public account keys consists of a secret key, Schnorr secret key and a public key. The Schnorr secret key generates the public key and is used to generate signatures for the account. Thus, if a quantum attacker recovers the Schnorr secret key through use of HNDL. The Schnorr secret key is a hash of the secret key which is PQ-secure, thus the account secret key is not leaked.
In the future, LEE will migrate away from using the Schnorr signatures. After this update, Schnorr signatures will no longer be accepted by the sequencers. Thus, a quantum attacker cannot impersonate an account owner. Moreover, the protection of the secret key means that LEZ can have a long term account migration; users do not forfeit their account by being inactive during an upgrade window. Rather, the secret key can be used at any point to demonstrate ownership of their account without risk of a quantum attacker claiming their account.
Private account states are encrypted and posted on chain. Crucially, LEE uses a combination of ML-KEM-768 and Chacha to encrypt account data. This guarantees that private accounts are kept secure against HNDL attacks.
RLN
RLN (rate-limit nullifier) is a spam prevention mechanism used in anonymous systems. Every member of an RLN group can send up to a set number of messages per epoch. A member that sends more than that is removed from the group.
Members in an RLN group are accumulated in a Merkle tree. This tree is used by members to demonstrate their membership. Shamir’s secret sharing associates a member’s messages sent with a specific member number within an epoch. These components are bundled within a Groth16 proof.
RLN’s Merkle tree and commitments are built with the Poseidon hash function, chosen because it’s zk-friendly — it has an efficient representation as an arithmetic circuit. The number of security bits for Poseidon is effectively halved by Grover’s algorithm. RLN can be strengthened to use a version of Poseidon with more security bits. The concrete threat to RLN from a quantum computer powerful enough to crack a Poseidon’s hash is the ability to successfully impersonate another group member.
Groth16 emits a small proof. This property is crucial as RLN transmits a message with the corresponding proof throughout the group. Groth16 proofs stay HNDL secure because the private data behind them remains hidden even if the proof itself can eventually be forged. However, it is not PQ secure due to its use of group elements; Shor’s algorithm can be used to forge Groth16 proofs.
RLN is HNDL secure, but it is not PQ secure. A different proof system could be adopted to make RLN PQ secure. The primary hurdle for securing RLN against quantum attacks is the lack of a (known) PQ-secure proof system that emits a small proof.
LogosChat
LogosChat is a private chat protocol that supports 1:1 and group conversations. HNDL security is crucial for private messages. To achieve this, LogosChat uses X-Wing for encryption. X-Wing is a hybrid encapsulation method that combines classical key exchange with PQ-secure encapsulation (ML-KEM-768). X-Wing guarantees that messages are protected against a quantum attacker.
Currently, LogosChat uses Ed25519 signatures. This signature scheme is not PQ-secure. A forged signature enables a quantum attacker to impersonate another user. This is not a long term risk for LogosChat. Once LogosChat migrates from Ed25519 signatures to a PQ signature scheme, any new Ed25519 signatures will no longer be accepted, closing this impersonation risk.
Is Logos harvest-now and decrypt-later secure?
Logos has prioritized HNDL security, and, today, is mostly HNDL secure. An overly simplistic view is:
| fully HNDL secure | |
|---|---|
| blockchain | ✗ |
| LEE/LEZ |  |
| RLN | ✗ |
| LogosChat | |
Active research is being conducted to secure Logos blockchain’s blend protocol against HNDL. This plan consists of two phases which are projected to be completed before mainnet launch. RLN’s upgrade from Poseidon-128 to Poseidon-256 is necessary for RLN to be fully secure against HNDL attacks.
Logos will be HNDL secure before mainnet launch.
Is Logos fully PQ secure?
Not yet. Non-PQ tools are used by design. These instances are vulnerable against an active quantum attack, which is not the threat model that Logos operates under. There are plans to patch these tools out in the future, before quantum computers pose a credible threat.
The primary reason for Logos techstack not being fully PQ-secure is the lower resource requirements of using non-PQ signatures and Groth16 proofs. PQ signatures can be upgraded prior to a credible threat. Groth16 emits a small proof size that is significantly smaller than proofs generated by PQ-secure zk proof systems. Due to this, time is required to find a suitable replacement.
Conclusion
Logos is being built with a focus on privacy now and in the future. Logos is preparing for a reality in which quantum computers can be used to launch real-time attacks. By mainnet, Logos will be ready for harvest-now-decrypt-later attacks, ensuring that all transactions and messages exchanged within the Logos ecosystem are secure. Logos is committed to ensuring the integrity of the network both now and in the future.