Bitcoin, Ethereum and Solana all authorise transactions with elliptic-curve keys that a future quantum computer can reverse — and every public key ever revealed on-chain is permanent, copyable, and one day forgeable. Q-Stream adds a quantum-safe authentication and encryption layer across the wallet and the chain, built on single-use, information-theoretic keys that no later computer can unwind.
A blockchain’s security comes down to one assumption: only the holder of a private key can produce a valid signature. That assumption rests entirely on elliptic-curve cryptography being hard to reverse.
It is hard for today’s computers. It is not hard for a sufficiently large quantum computer. Shor’s algorithm solves the elliptic-curve discrete-logarithm problem in polynomial time, which means it can recover a private key directly from a public key. That single fact applies equally to Bitcoin and Ethereum’s ECDSA, Bitcoin’s newer Schnorr signatures, and Solana’s Ed25519 — they all stand on the same curve mathematics.
The threat does not wait for the hardware to arrive. It is called “harvest now, decrypt later.” A public key, once revealed on-chain, is recorded forever. An adversary can copy every exposed key today and forge its owner’s signatures the day a capable machine exists. On a blockchain you cannot simply rotate a compromised key after the fact — the history is immutable, and on some chains the address is the public key.
Hashes buy time, not safety. Bitcoin and Ethereum often keep a public key behind a hash until you first spend, and Grover’s algorithm only weakens hashes quadratically rather than breaking them. That delays exposure — it does not remove it. The moment you transact, or reuse an address, the key is in the open and permanently harvestable.
Q-Stream is a cryptographic protocol whose confidentiality is information-theoretic — its security does not rest on any problem being hard to compute, so no future computer, quantum or otherwise, can reverse it. It protects digital assets across two layers: the wallet, where keys are held and transactions are authorised, and the chain, where authority is verified and confidential data is exchanged.
Four building blocks do the work:
A wallet-unique, high-entropy block of key material — the shared root from which every single-use key is drawn.
A per-message rotating key (PDK). Every transaction is signed under a fresh, single-use key that is never repeated.
How the wallet and the verifier come to share the same Q-Block, and how it is refreshed before its key material runs out.
A zero-knowledge proof of authority. Proves you can spend without ever revealing a key that Shor’s algorithm could later break.
Together these mean a wallet can authorise and prove ownership without putting a breakable key on the chain, and any data it sends is encrypted under keys that capture cannot unlock — now or in the quantum era.
The Q-Block is the single source of all Q-Stream key material: a large block of genuinely random bits, generated once from a high-quality entropy source — in practice a quantum random number generator — and held privately by the wallet. Every single-use key the wallet will ever need is drawn from it. The block itself is never sent over any channel, and no region of it is ever reused.
Its security is information-theoretic, which means it rests on no problem being hard to compute. The foundation is Shannon’s result on perfect secrecy: if a message is combined with a truly random key that is used once and is at least as long as the message, the result reveals nothing about the message — to any adversary, with any amount of computing power, classical or quantum.
Take one message byte and one key byte drawn from the Q-Block.
Knowing only c = 0xDE, every one of the 256 possible plaintext bytes is equally likely — each corresponds to exactly one key byte, and all key bytes were equally probable. The ciphertext leaks nothing. Reuse that key byte for a second message, though, and the guarantee is gone — which is what the next mechanism prevents.
A wallet does not slice the Q-Block into fixed pieces. It walks a path through it. For each message a per-message path descriptor selects a fresh region of the block, producing a single-use key — the path-derived key (PDK). The path always advances, so the same key is never produced twice.
Both ends that share the Q-Block and the same path rule derive the identical key independently; nothing about the key crosses the wire. Choosing a traversal that visits each position once before any repeat — the same property a de Bruijn sequence has — keeps every key unique while using the block efficiently.
Single-use is the whole point. The perfect-secrecy result above, and the authentication below, hold only while each key is used exactly once. The path rule’s job is to guarantee that.
To authorise a transaction, the wallet authenticates it with a one-time message authentication code in the Carter–Wegman style: a hash drawn from a universal family (keyed from part of the key) is masked by a one-time pad (the rest of the key). An attacker’s chance of forging a valid tag is bounded by a tiny constant that does not depend on computing power.
The paths are disjoint, so k_p1 and k_p2 share no bytes. Capturing the first transaction tells an attacker nothing about the key behind the second — per-message forward secrecy, by construction.
Signing normally means publishing something only your key could produce — which means the key, or a value derived from it, ends up on a public, permanent ledger. Q-Stream takes a different route. Instead of signing with a breakable key, the wallet proves that it knows a secret path through the Q-Block, without revealing the path. This is the protocol’s zero-knowledge proof of authority (Q-Path).
It follows the classic three-move structure of an interactive proof — commit, challenge, response:
The secret is protected by path ambiguity: for the values the verifier sees, an enormous number of different paths are equally consistent. Observing valid proofs — even many of them — does not narrow down which path is the real one. Authority is established without ever exposing a value a quantum computer could reverse.
Every accepted proof is equally explainable by a huge set of paths, so the transcript carries no information about the wallet’s actual secret. On-chain, the verifier runs only the cheap Check(C, e, z) step — and no curve key is ever published.
Single-use, information-theoretic keys only work if both ends hold the same Q-Block and never exhaust it. Provisioning is the process that makes that true: generate the block, deliver it once, and refresh it before its key material is used up. It is the operational heart of the system.
The capacity of a block is simple to reason about: a block of B bytes supports about B / L authenticated messages, where L is the key material consumed per message.
Post-quantum schemes such as ML-KEM (key exchange), ML-DSA / Dilithium and Falcon (signatures) are the right answer where no key material can be pre-shared: they replace the elliptic-curve problem with a lattice problem believed to resist quantum attack. They remain computationally secure — secure under the belief that the lattice problem is hard. Q-Stream removes the hard-problem dependency altogether, in exchange for needing a pre-shared, refreshed Q-Block. The practical consequences show up on the wire and in the processor.
The trade is explicit. PQC needs nothing shared in advance but ships kilobyte-scale objects and runs heavy lattice arithmetic on every operation. Q-Stream ships an eight-byte tag and does little more than a table walk and a one-time hash — but it must hold and refresh a shared Q-Block. For wallets and devices that can be provisioned once and refreshed, that is a favourable exchange; where no provisioning is possible, lattice PQC remains the appropriate tool.
Stated plainly. Ethereum and Solana can verify a Q-Stream proof on-chain today, through account abstraction and programs that already exist. Bitcoin’s base layer cannot — native verification there would need a soft fork. Until then Q-Stream protects Bitcoin holdings at the custody and authorisation layer and through Taproot script paths.
Most asset loss is not a broken curve — it is a stolen seed, a reused key, or a signed transaction an attacker captured and replayed. The wallet layer closes those gaps first, and is quantum-safe by construction.
Authorisation only counts if the chain accepts it. The on-chain layer is where Q-Stream’s proof is checked and where confidential data is carried — using verification machinery each network already provides.
A smart account on Ethereum (ERC-4337 or EIP-7702) or a program on Solana contains the verification logic: it accepts a transaction only when the accompanying Q-Stream tag and Q-Path proof check out. The account’s authority is bound to the Q-Block, not to a raw elliptic-curve key — so even a fully exposed on-chain identity gives an attacker nothing to forge against. On Bitcoin, the same intent is expressed through Taproot script paths and co-signing vaults until a soft fork allows native verification.
Transaction memos, off-chain channel messages, and any confidential metadata are encrypted under the same single-use keys. They are readable only by the intended holder, and they stay unreadable even if recorded and stored against a future quantum computer. A captured message exposes one message — never the channel.
Everything above is easy to assert and hard to believe without seeing it. So the four building blocks are implemented here and run live: the Q-Block, the path-derived single-use key, the one-time authentication tag, and the proof of authority. The numbers shown are produced on this page by the same code — nothing is pre-baked or faked.
Read the full security analysis & proofs → — preconditions, worked examples, formal definitions, and theorems with proofs for both operations, written to be checked independently.
The wallet holds one private block of true randomness. For each transaction it walks a secret path through the block, reading out a single-use path-derived key (PDK). The path always advances, so no key is ever produced twice — and a second party holding the same block and path rule derives the identical key with nothing crossing the wire.
wallet-demo-0001 · tx#1 · cursor 0221,68,247,174,91,29,110,78,15,169,212,17,147,67,31,133b3589bae7909b90835dc10f4d80de27eThe 8-byte tag is a symmetric authenticator: it is produced from the transaction and from one-time key material drawn from the Q-Block, and checking it requires that same key material. So the party that verifies the tag is one that shares the Q-Block — your second device, a custody or co-signing service, a payment counterparty — not the public blockchain, which holds no secret of yours. This is the wallet-layer check, and it is where most real-world theft is actually stopped: a transaction altered in flight, or a correctly-signed one captured and re-submitted later.
It stops them for two structural reasons. First, the tag is computed over every byte of the transaction, so changing any field — the amount, the destination — yields a completely unrelated tag; there is no “close enough.” Second, the key is consumed once and the wallet’s path then advances, so a recorded (transaction, tag) pair cannot be replayed: the next valid tag is computed from key material the attacker has never seen and cannot derive.
And the strength here rests on nothing being hard to compute. The masking value mixed into the tag is uniformly random and used exactly once, so an adversary — with any amount of computing power, classical or quantum — has at best about a one-in-261 chance of guessing a valid tag for a transaction they did not author. That is information-theoretic security: it is a property of the randomness, not a bet on a problem staying difficult.
The single-use key produces a compact 8-byte tag over the transaction using a Carter–Wegman one-time MAC. Forging a tag without the key succeeds with probability about one in 261 — not because anything is hard to compute, but because the masking key is random and used once. Edit the transaction and watch the tag move; try to tamper or replay and watch it be rejected.
r = 0x13589bae7909b90d a = 0x15dc10f4d80de27f1f6414fcffde6b49This is the part worth understanding properly, because it is not obvious how an untrusting public ledger, which never sees your Q-Block, can decide that a spend is authorised. It works because authority is anchored in public, one-way commitments, and the proof is welded to the exact transaction.
At provisioning the account publishes a set of anchors, each one a hash aₕ = H(sₕ) of a secret sₕ that is itself derived from the Q-Block. Because a hash is one-way, the anchors give away nothing about the secrets — they can sit on an immutable ledger forever in perfect safety. (Contrast an ordinary elliptic-curve public key, which a quantum computer can run backwards into the private key. There is no such reversible object here.)
To authorise a transaction T, the wallet first computes a challenge c = H(T). Because the challenge is the hash of the transaction itself, the resulting proof is bound to T alone — it cannot be peeled off and reused on a different transaction. That challenge then deterministically selects a subset of the anchors, and the wallet responds by revealing exactly the secrets for that subset.
Now the verification is something any node can do with public data only: recompute c = H(T), recompute which anchors c selects, and check that each revealed secret hashes to its published anchor — H(sₕ) = aₕ. If every check passes, the spender has demonstrated possession of the Q-Block-derived secrets the account was built from — the right to spend — and the chain has confirmed it while holding no secret and trusting no one. A forger has no way through: to pass they would need to produce preimages of specific 256-bit anchors that the transaction itself chose, and inverting a hash is infeasible. This is the one place the on-chain proof relies on a computational assumption — hash preimage-resistance — and it is precisely the assumption that survives quantum attack (Grover’s algorithm only halves the exponent, leaving 256-bit anchors at about 128-bit security).
Two honest footnotes. The live demo above reveals the selected secrets directly — a transaction-bound, hash-based commit–challenge–response, in the family of hash-based signatures. The production Q-Path additionally blinds each response so the revealed values themselves leak nothing, making the proof fully zero-knowledge; the reason the chain can verify is identical either way. And because each authorisation discloses part of the secret set, the wallet rotates to fresh anchors as its path advances through the Q-Block — so no secret is ever exposed twice, and every proof stays one-time.
At provisioning the wallet publishes anchors (hashes of secrets bound to the Q-Block) — that is the on-chain identity. To authorise a transaction it answers a challenge derived from the transaction by revealing only the secrets that challenge selects. A verifier checks them against the anchors. Someone without the Q-Block can only guess, and is caught.
c08e6f6064806fbee93ad46213ad3f86e8243ec036c14b3e1d46c9a501f693949cf279de7bbc788865e206b73411df4a…0, 1, 5, 11, 18, 19, 30, 31The same three building blocks apply to every chain. What differs is where the proof is verified and how much of the transaction the tag binds. Each card below shows a representative transaction and the real 8-byte tag the demo key produces over it.
Tag binds inputs, outputs and amounts; enforced at the wallet, multisig vault and Taproot script path. Native consensus checking awaits a soft fork.
tag = 0364198500b55095 verified: custody / TaprootAn ERC-4337 / EIP-7702 account verifies the tag and Q-Path proof in-contract before execution. Authority is bound to the Q-Block, not a raw EC key.
tag = 096e432942cc3770 verified: on-chainA verifier program accepts the instruction only when the tag and proof check out against the account’s anchored authority — checked by the network itself.
tag = 143610244ab44367 verified: on-chain| Property | ECDSAsecp256k1 | SchnorrBIP-340 | Ed25519Curve25519 | Q-Streamprotection layer | Q-Stream advantage |
|---|---|---|---|---|---|
| Used by | BTC, ETH | BTC (Taproot) | Solana | layer across all three | One model, every chain |
| Security rests on | EC discrete-log | EC discrete-log | EC discrete-log | information-theoretic | No hard problem to break |
| Shor’s algorithm | Broken | Broken | Broken | Immune | Quantum-safe by construction |
| Harvest-now-decrypt-later | Vulnerable | Vulnerable | Vulnerable | Immune | Nothing to harvest |
| Public key on-chain | On first spend | On first spend | From creation | Never required | No forgeable target left |
| Per-message forward secrecy | No | No | No | Yes | Compromise can’t cascade |
| Capture exposure | Key → all funds | Key → all funds | Key → all funds | One message | Blast radius of one |
| Authentication overhead | ~71–72 B sig | 64 B sig | 64 B sig | 8 B tag+ amortized Q-Block | Smaller on-wire footprint |
The takeaway. The keys are already on the chain, and on an immutable ledger you cannot take them back. Q-Stream gives a wallet a way to authorise and prove ownership without ever exposing a key a quantum computer could break — across Bitcoin, Ethereum and Solana, through machinery the chains already understand.