Is Aztec Quantum Safe?

Is Aztec quantum safe? It is a question worth taking seriously as quantum computing advances from theoretical threat to engineering reality. Aztec Network is one of the most cryptographically sophisticated projects in the Ethereum ecosystem, using zero-knowledge proofs to deliver private, scalable transactions. But sophisticated ZK cryptography and quantum resistance are not the same thing. This article breaks down exactly which primitives Aztec relies on, where quantum computers could compromise those primitives, what migration paths exist, and how purpose-built post-quantum wallet infrastructure differs from what Aztec currently provides.

What Cryptography Does Aztec Actually Use?

Aztec Network is built around a private smart-contract platform called the Aztec Sandbox (formerly Aztec Connect), powered by a proving system called Honk (an evolution of the earlier UltraPlonk). Understanding the quantum-safety question requires understanding each layer of that cryptographic stack.

Zero-Knowledge Proof System: Honk / UltraPlonk

Aztec's core privacy guarantee comes from zk-SNARKs. The current Honk proving system is based on the KZG polynomial commitment scheme, which relies on elliptic-curve pairings over the BN254 curve. This is important for two reasons:

• Elliptic-curve discrete logarithm (ECDL) hardness underpins the binding property of KZG commitments.
• Shor's algorithm, running on a sufficiently large fault-tolerant quantum computer, can solve the ECDL problem in polynomial time.

If a quantum adversary can break ECDL on BN254, they can forge proofs, potentially fabricating valid-looking transactions that the Aztec rollup would accept.

Account Keys and Signing

Like virtually every Ethereum-adjacent project, Aztec user accounts are ultimately anchored to ECDSA keys on the secp256k1 curve (or, in newer contexts, EdDSA on the Grumpkin curve for internal Aztec account abstraction). Both secp256k1-ECDSA and EdDSA are vulnerable to Shor's algorithm. A quantum attacker who harvests a public key can derive the corresponding private key and spend funds or impersonate an account.

Hash Functions

Aztec makes heavy use of the Pedersen hash and more recently Poseidon hash functions, both designed to be efficient inside ZK circuits. These are algebraic hash functions. Conventional hash functions (SHA-256, Keccak-256) have quantum security reduced by Grover's algorithm to roughly half their classical bit-security, meaning SHA-256 becomes ~128-bit secure. Algebraic hash functions like Pedersen have additional structural concerns in the quantum setting because their security relies on hardness assumptions over elliptic-curve groups.

---

Where Quantum Computers Pose the Greatest Risk

Not all quantum threats arrive simultaneously. Security analysts generally model Q-day risks in two tiers:

The most acute risk is live key extraction. Once a sufficiently powerful quantum computer exists, every address whose public key has been revealed on-chain (i.e., any address that has ever signed a transaction) is compromised. Aztec's privacy layer actually provides a partial mitigation here: because Aztec transactions are shielded, the public keys of internal Aztec accounts are not broadcast to Ethereum Layer 1 in the same way standard ETH transfers are. However, users deposit into and withdraw from Aztec via standard Ethereum transactions, exposing L1 keys. And the Grumpkin-curve keys used inside Aztec are still elliptic-curve keys susceptible to the same algorithmic attack.

The KZG Commitment Vulnerability in Depth

KZG polynomial commitments work by committing to a polynomial evaluated at a secret point `τ` (the "toxic waste" from a trusted setup). The security assumption is that given `g`, `g^τ`, `g^(τ²)`, ..., an adversary cannot compute `τ`. This is the discrete logarithm problem on an elliptic curve. Shor's algorithm solves it. A quantum attacker who recovers `τ` from the trusted setup transcript can construct arbitrary fake commitments and openings, meaning they can forge entire zk-SNARK proofs. This would allow them to:

1. Claim they own funds they do not own.
2. Prove the execution of arbitrary private transactions that never occurred.
3. Drain the Aztec rollup contract on Ethereum L1.

This is not a theoretical edge case. It is the structural consequence of building a proof system on elliptic-curve-based commitments.

---

Does Aztec Have a Quantum-Resistance Migration Plan?

As of mid-2025, Aztec Network has no publicly disclosed roadmap item specifically addressing post-quantum cryptographic migration. This is not unique to Aztec. The vast majority of ZK-rollup projects, including zkSync, StarkNet, Scroll, and Polygon zkEVM, are in a similar position.

What Would a Migration Require?

A credible post-quantum migration for Aztec would need to address at least three layers:

1. Replace KZG commitments with a quantum-resistant polynomial commitment scheme. Candidates include hash-based commitments (e.g., FRI-based, as used in STARKs) or lattice-based commitments. STARKs are particularly relevant here because they rely on collision-resistant hash functions rather than elliptic-curve discrete log, giving them much stronger quantum-resistance properties.

1. Replace account signing keys with post-quantum signature schemes. NIST finalised its first set of post-quantum cryptographic standards in 2024: CRYSTALS-Dilithium (lattice-based signatures, now called ML-DSA), FALCON (also lattice-based), and SPHINCS+ (hash-based signatures). Any of these could replace secp256k1-ECDSA in principle, though integrating them into ZK circuits at reasonable proving cost is a substantial research and engineering challenge.

1. Replace algebraic hash functions with quantum-conservative alternatives or increase their security parameters to compensate for Grover's speedup.

None of these migrations are trivial. Lattice-based signatures such as ML-DSA produce keys and signatures that are significantly larger than ECDSA equivalents, which adds proving overhead inside ZK circuits. The intersection of ZK-efficiency and post-quantum security is an active research area without production-ready solutions as of mid-2025.

STARKs vs. SNARKs: A Note on Relative Quantum Exposure

It is worth noting that STARKs (used by StarkNet) have a stronger quantum-security profile than SNARKs (used by Aztec). STARKs rely on the collision resistance of hash functions like BLAKE2 or Keccak, which Grover's algorithm weakens but does not break, given sufficient output size. They do not rely on elliptic-curve pairings. This means a quantum attacker cannot forge a STARK proof by solving a discrete logarithm. StarkNet is not fully quantum-safe either, but it is structurally more resilient than KZG-based SNARK systems at the proof layer. Aztec's choice of KZG/Honk places it at greater structural exposure.

---

Comparing Cryptographic Postures: Aztec vs. Post-Quantum Alternatives

---

How Lattice-Based Post-Quantum Wallets Differ

The wallet layer is often overlooked in quantum-threat discussions focused on protocol design. Even if Aztec migrated its proof system to a quantum-safe scheme, users holding assets in standard Ethereum wallets (MetaMask, hardware wallets, exchange wallets) would remain exposed, because those wallets are secured by secp256k1-ECDSA keys.

Lattice-based cryptography, specifically schemes aligned with NIST's post-quantum standards, provides a fundamentally different security guarantee. Lattice problems such as Learning With Errors (LWE) and Module-LWE (the basis of CRYSTALS-Kyber and CRYSTALS-Dilithium) are believed to be hard for both classical and quantum computers. This belief is grounded in decades of theoretical analysis and the absence of any efficient quantum algorithm for these problems.

A wallet built on lattice-based cryptography generates keys and signs transactions using these quantum-hard primitives. This means that even a large-scale fault-tolerant quantum computer running Shor's algorithm gains no advantage, because Shor's algorithm does not apply to lattice problems. BMIC.ai, for example, is building its wallet infrastructure specifically around NIST PQC-aligned, lattice-based cryptography, offering holders a credential layer designed to survive Q-day rather than simply hoping the timeline remains convenient.

The practical differences for an end user are:

• Larger key sizes (lattice keys are bigger than ECDSA keys, though protocols can compress them efficiently).
• Different signing performance (slightly slower on constrained hardware, but negligible on modern devices).
• Long-term security guarantee that standard wallets cannot currently offer.

---

What Should Aztec Holders Do Right Now?

Waiting for Q-day to arrive before taking action is a misunderstanding of the threat model. Harvest-now, decrypt-later attacks are likely already occurring at scale by well-resourced state-level actors. Data harvested today, including on-chain transaction records and public keys, will be decryptable once quantum hardware reaches sufficient scale.

Practical steps for Aztec users concerned about quantum exposure:

1. Minimise public-key exposure. Avoid reusing addresses. Each time you sign a transaction, your public key is revealed. Fresh addresses provide some protection by keeping the public key hidden until first use.
2. Monitor NIST PQC integration in the wallet and tooling ecosystem. Adoption of ML-DSA or FALCON in wallet firmware is the most impactful near-term change.
3. Watch Aztec's roadmap for any announcement related to proof system migration. A shift from KZG to hash-based commitments (FRI) would be a meaningful quantum-resilience upgrade.
4. Diversify custody. Holding assets across wallets with different cryptographic assumptions reduces concentration risk.
5. Engage with the Aztec community and governance. Quantum migration requires protocol-level decisions. Community pressure and developer attention can accelerate timelines.

---

The Broader ZK-Rollup Quantum Problem

Aztec is not an outlier. The entire current generation of ZK-rollup infrastructure, from the proof systems to the account models, was designed for classical adversaries. The urgent migration challenge is not whether quantum computers will eventually threaten these systems, but whether the ecosystem moves fast enough relative to quantum hardware progress. Credible estimates from NIST and academic research groups place the horizon for cryptographically-relevant quantum computers somewhere between 2030 and 2040, though timelines are genuinely uncertain and could compress.

The responsible analyst posture is to treat quantum migration as a medium-term engineering necessity rather than a distant hypothetical, and to evaluate projects partly on whether they have a credible plan to execute it.