Canton Post-Quantum Migration: Roadmap Status, Mechanisms, and Holder Options

Canton post-quantum migration is a question gaining traction among enterprise blockchain users as the quantum computing threat moves from theoretical to engineering reality. Canton Network, the privacy-preserving blockchain built on Daml smart contracts and developed by Digital Asset, has attracted serious institutional adoption, making its long-term cryptographic security a material concern. This article examines what is publicly known about Canton's post-quantum posture, what a full migration would technically require, and what holders and enterprise deployers can do in the interim.

What Is Canton Network and Why Does Post-Quantum Matter?

Canton Network is a privacy-first, permissioned blockchain designed for regulated financial institutions. Built on Digital Asset's Daml smart-contract language, it uses a synchronisation protocol that allows independent sub-ledgers (called "domains") to interoperate while keeping data compartmentalised. Major financial infrastructure providers, including Goldman Sachs, BNP Paribas, and the Depository Trust & Clearing Corporation (DTCC), have participated in Canton pilots or live deployments.

That institutional footprint is precisely why post-quantum security is not a theoretical edge case. Institutions hold long-lived assets and records on Canton — settlement finality records, tokenised securities, and custody proofs. The adversarial model that matters most here is harvest-now, decrypt-later (HNDL): a threat actor records encrypted traffic today and decrypts it once a cryptographically relevant quantum computer (CRQC) becomes available. Analysts at NIST and the NSA have consistently warned that any data requiring confidentiality beyond 10-15 years should be considered at risk under current public-key schemes.

Canton's current cryptographic foundation relies on standard elliptic-curve digital signature algorithms (ECDSA / Ed25519) and RSA for key exchange in TLS layers. Both families are vulnerable to Shor's algorithm running on a sufficiently powerful CRQC. Grover's algorithm also weakens symmetric primitives, though doubling key length (e.g., AES-128 to AES-256) largely addresses that.

---

Canton's Post-Quantum Roadmap: What Is Publicly Known?

As of mid-2025, Digital Asset has published no formal, dated post-quantum migration roadmap for Canton Network. There is no public whitepaper, GitHub milestone, or developer blog post committing to specific NIST PQC algorithm integrations or a timeline for deprecating ECDSA/Ed25519.

This is not unusual among enterprise blockchain platforms at this stage. Hyperledger Fabric, R3 Corda, and most permissioned chains are in similarly early positions. The NIST PQC standardisation process only reached final standards in August 2024 (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA), giving vendors a concrete specification target that did not exist until recently.

What *can* be inferred from public sources:

• Daml's abstraction layer is an asset. Because Daml separates business logic from the underlying ledger infrastructure, cryptographic primitives could in principle be swapped at the infrastructure layer without rewriting application-layer smart contracts. This is a meaningful architectural advantage over chains where signature verification is hardcoded into the VM opcode set.
• Digital Asset's enterprise focus means compliance with NIST and FIPS standards is likely a roadmap requirement, driven by customer procurement criteria rather than community governance.
• TLS/transport layer upgrades to post-quantum key encapsulation (likely ML-KEM, formerly CRYSTALS-Kyber) are the most tractable near-term step and could arrive independently of on-ledger signature changes.

Until Digital Asset publishes an explicit roadmap, users should treat Canton's post-quantum posture as unspecified but architecturally plausible to upgrade.

---

What a Full Canton Post-Quantum Migration Would Technically Involve

A genuine post-quantum migration on a production network like Canton is not a single software patch. It is a multi-layer programme spanning cryptographic primitives, key management infrastructure, consensus participation, and client tooling.

1. Algorithm Selection and Standardisation Alignment

The migration baseline is the NIST PQC suite finalised in 2024:

For a Canton deployment, ML-DSA is the primary candidate for replacing Ed25519 in transaction and participant-node signing. ML-KEM replaces Diffie-Hellman in the TLS handshake between domain nodes. SLH-DSA may be preferred for long-lived signing keys where key size is less constrained than signature verification speed.

2. Key Migration for Existing Participants

Every participant node on a Canton domain holds a signing key pair that authenticates its identity within the topology. Migrating to post-quantum keys requires:

1. Generating new ML-DSA or FALCON key pairs at each participant node.
2. Certifying the new public keys through Canton's topology management protocol, which governs which keys are authorised to sign transactions on a given domain.
3. Running a hybrid transition period in which both legacy (Ed25519) and new (ML-DSA) signatures are accepted, preventing service disruption while participants rotate keys.
4. Deprecating and revoking legacy keys once all participants have migrated.

The hybrid approach is specifically recommended by NIST and the IETF (see RFC drafts for hybrid key exchange in TLS 1.3) as a hedge: if a post-quantum algorithm is later found to have weaknesses, the classical layer still provides protection.

3. On-Ledger Smart Contract and Data Implications

Daml contracts that reference party keys or signature verification logic would need review. In most Daml applications, party identity is managed by the ledger infrastructure, not by application-layer code, which limits the blast radius. However, any bespoke Daml templates that embed key formats or verification routines explicitly would require auditing.

Archive records (completed contracts stored on-ledger) pose a separate concern: they are signed with legacy keys. Retroactively re-signing historical records is operationally complex and may conflict with audit and legal finality requirements. The practical outcome is likely that historical records remain under legacy signatures, with a hard cutover point from which all new records carry post-quantum signatures.

4. Performance and Bandwidth Trade-offs

Post-quantum signature schemes carry larger key and signature sizes compared to Ed25519:

For Canton, where high-frequency settlement traffic is a design target, the size increase of ML-DSA is material. FALCON-512 offers a better size profile but involves more complex implementation requirements (Gaussian sampling). Benchmarking against Canton's domain throughput targets will be a non-trivial engineering exercise.

---

Interim Options for Canton Holders and Deployers

While a formal migration roadmap remains unpublished, there are concrete steps that enterprises and individual participants can take now.

Assess Your Data Sensitivity Horizon

Classify the data and assets held on your Canton domain by confidentiality lifetime. Tokenised securities with settlement finality in T+1 carry far lower HNDL risk than long-lived custody proofs, identity records, or regulatory audit trails. Prioritise post-quantum hardening for the latter category.

Upgrade Transport Security First

TLS post-quantum hybrid key exchange (combining X25519 with ML-KEM-768) is already available in OpenSSL 3.x, BoringSSL, and Cloudflare's implementations. Canton infrastructure administrators can configure domain-node TLS to use hybrid PQC key encapsulation today, ahead of any on-ledger changes. This addresses the HNDL risk on data in transit.

Demand Contractual Commitments from Digital Asset

Enterprise Canton deployers are in a position to include post-quantum migration milestones as contractual requirements in their service agreements. Given NIST's finalised standards, requesting a vendor roadmap with specific dates for ML-DSA support is a reasonable procurement posture.

Monitor the Daml Open-Source Repository

Digital Asset open-sources portions of the Daml SDK on GitHub. Watching for cryptographic library upgrades, dependency changes toward PQC-capable libraries (e.g., liboqs, Bouncy Castle PQC), or topology-protocol extensions is a practical early-warning signal of migration activity.

Consider Custody-Layer Diversification

Holders of Canton-issued digital assets face a compound risk: the Canton network itself and the custody solution used to hold private keys. Diversifying into wallets and custody services that already implement post-quantum key protection adds a layer of resilience independent of the network's own migration timeline. Projects designed from inception around lattice-based and NIST PQC-aligned cryptography, such as BMIC.ai, represent a reference point for what a purpose-built post-quantum custody posture looks like, and illustrate the contrast with platforms still running on classical ECDSA foundations.

---

Comparing Post-Quantum Readiness Across Enterprise Blockchains

Canton is not alone in its current position. A comparison of where major enterprise chains stand helps contextualise the urgency and the relative risk.

The pattern is consistent: enterprise blockchain platforms have the NIST standards in hand but have not yet published migration commitments. The window before practical quantum threat is measured in years, not decades, which means planning cycles beginning now are appropriate rather than premature.

---

What a Realistic Migration Timeline Might Look Like

Given the engineering complexity and the absence of an official roadmap, the following is a scenario-based view, not a forecast:

• 2025-2026: Transport-layer hybrid PQC (ML-KEM in TLS) deployed across Canton domain nodes. Key-generation tooling updated in the Daml SDK to support ML-DSA key pairs in test environments.
• 2027-2028: Pilot post-quantum participant onboarding on Canton Network, with hybrid signature acceptance in select domains. Enterprise customers begin key rotation programmes.
• 2029-2031: Full deprecation of Ed25519 signing for new transactions across production domains. Legacy key sunset policy published. Historical archive signature treatment resolved.

This timeline is broadly consistent with the US government's own migration target, which sets 2030 as the deadline for federal systems to complete PQC transitions for most cryptographic uses.

---

Key Takeaways

• Canton Network has no publicly published post-quantum migration roadmap as of mid-2025.
• Its Daml-based architecture provides meaningful flexibility for a future migration, but flexibility is not the same as readiness.
• The primary near-term risk is HNDL on data in transit; TLS hybrid PQC can be deployed now at the infrastructure level.
• On-ledger signature migration is a multi-year programme involving key rotation, hybrid transition periods, and performance trade-offs.
• Enterprise deployers should begin data-sensitivity assessments, engage Digital Asset through procurement channels, and monitor the open-source repository for early signals.