Quantum-Safe Sui: Post-Quantum Keys and Moving Your Account Without Changing Its Address

​Every Sui wallet today signs with keys (Ed25519, secp256k1, or the secp256r1 behind passkeys) whose security rests on mathematics that a large enough quantum computer could break. Nobody can do that yet, but blockchain accounts live for decades, and once a public key has appeared onchain an attacker only has to wait. Sui is preparing early. ML-DSA-65, the post-quantum signature standard NIST published as FIPS 204, now works on Sui devnet. Testnet is planned for the end of 2026 and mainnet is targeted for early 2027.

This session explains how post-quantum signing works on Sui and what it costs, then answers the question every wallet will face: how do you move an existing account to a quantum-safe key without moving a single asset? The answer is address aliases. You build Q-Wallet. It creates an ML-DSA-65 key in the browser and sends a transaction with it, then takes an existing Ed25519 or passkey account, adds the post-quantum key as an alias, signs as the same address and retires the old key. Same address, same assets, and a key a quantum computer cannot forge. We ran every step on devnet before class.

What You'll Learn

- Why quantum computers threaten signatures but not hashes, what an exposed public key means for a Sui address, and realistic timelines without the hype
- How ML-DSA-65 works at a builder's level: lattice-based signatures, key and signature sizes (a 1,952-byte public key and a 3,309-byte signature, against 64 bytes for an Ed25519 signature) and what that means for transaction size and gas
- Sui's rollout: the new signature scheme, the mldsa65_auth protocol flag that is on for devnet only today, and how to check any network yourself
- Signing with @mysten/sui: the MLDSA65Keypair, deriving the address, and what the SDK does not support yet, such as deriving keys from a seed phrase
- Migration with address aliases: adding a post-quantum key to an existing account, signing as that account, and removing the old key in the same transaction
- How to ship Q-Wallet: generate a post-quantum key, send on devnet, upgrade a classic account in place, and confirm on the explorer that the address never changed

Who Should Attend

- Wallet builders planning for the next decade, not the next release
- Teams that hold long-lived treasuries, protocol admin keys or upgrade capabilities
- Developers who joined the passkeys and address aliases session
- Anyone who wants to see quantum-safe cryptography working in practice rather than in a whitepaper

What to Bring

- Laptop with Node.js 22+ and pnpm, and @mysten/sui 2.39 or newer
- Nothing else to install: devnet SUI comes from a faucet button in the app
- Basic TypeScript. No cryptography background required

Join us at SuiHub to learn, build, and connect with fellow developers pushing the boundaries of the Sui ecosystem.