Blockchain Quantum Readiness Index / Sui
L1 · Move
Sui
Native post-quantum accounts (ML-DSA, a NIST lattice signature) are announced and run on devnet, with mainnet targeted for Q1 2027. Mainnet accounts and validators still use elliptic-curve keys, and the official native bridge is secured by elliptic-curve committee keys.
Last reviewed 2026-10-19
Is Sui quantum safe?
Not yet. Sui is at Stage 2 (Code merged) in LimeChain's Blockchain Quantum Readiness Index, with a progress score of 20/100. Post-quantum accounts are in the core code but not yet running on a public network. Still exposed or unproven: bridges & messaging.
What Sui needs for Stage 3: Testnet
- Stage 3 needs PQ user accounts on a public testnet or mainnet (U is: in-dev)
Caps and adjustments
- cap 40: users cannot hold and spend funds under a production PQ mechanism on mainnet
- cap 60: consensus PQ not even on testnet
Rosette slices
| Slice | State | Points | Weight | Reason & evidence |
|---|---|---|---|---|
| U User keys | In development At rest: Hidden until first spend A Sui address is BLAKE2b-256(flag || public key), and the public key is only published inside a transaction signature (flag || sig || pk), so an address that never signed keeps its Ed25519/secp256k1/secp256r1 key hidden. Address aliases (feature flag address_aliases = true on mainnet, protocol version 138, measured 2026-10-13 via GraphQL) let an address drop itself from its alias set and authorize a different address, i.e. rotate to a fresh key that stays hidden until it signs. ML-DSA (flag 0x07) is not enabled on mainnet, so there is no `pq` option. |
4/10 | 25 | ML-DSA-65 (flag 0x07) is merged and enabled on devnet (protocol version 139) but explicitly rejected on testnet and mainnet (testnet runs protocol 139 with mldsa65_auth off); Mysten reported the first native ML-DSA-65 devnet transaction on 2026-10-13; Sui targets mainnet native account authentication for Q1 2027 and independent audits are still underway. |
| C Consensus | Discussed | 1/10 | 20 | Validators sign with Ed25519/BLS12-381 today; Sui's transition essay lists BLS12-381 (randomness beacon, signatures) among classical primitives that would need migrating. Sources 7 |
| P Proof system | Not applicable | — | — | L1 with no validity or fraud proof system. no evidence |
| B Bridges & messaging | Exposed | 0/10 | 15 | The canonical native bridge is secured by a bridge committee of validators that register secp256k1 ECDSA bridge keys (sui_bridge uses ecdsa_k1, including ecdsa_pub_key_to_eth_address); Sui's essay says the native bridge would need PQ alternatives, and no PQ bridge work is shipped. |
| A Admin & upgrade keys | Not applicable | — | — | No admin/upgrade keys: protocol-config and framework (system package) upgrades take effect when 2/3 or more of validators vote for the new version. Sources 10 |
| M Migration & recovery | Planned | 2/10 | 15 | Sui states users will move to a quantum-safe key with their existing recovery phrase, and live address aliases let an account update its authorization key without moving assets; the PQ-key update itself is not live yet. Sources 1 |
Stage gates
| Requirement | Status | Details & evidence |
|---|---|---|
| Current audit of the deployed PQ signing code (Stage 5) | Not met | not claimed |
| Admin timelock of at least 30 days with a PQ override (Stage 6, alternative to PQ admin keys) | Not met | not claimed |
| Ratified migration plan with an activation date (Stage 6) | Not met | not claimed |
| New accounts PQ or hybrid by default (Stage 6) | Not met | not claimed |
| ECC sunset enforced (Stage 7) | Not met | not claimed |
PQ adoption published, not scored
There are no PQ accounts on mainnet yet. Having PQ accounts does not mean people move to them. This tracks the share of value and accounts that actually moved, over time.
Measured exposure
No on-chain probe run yet. Bitcoin, Solana, Cosmos and Substrate probes are planned.
Evidence and sources (10)
Every non-zero rating above cites at least one of these public sources.
- sui.io/blog/making-sui-quantum-ready
- github.com/MystenLabs/sui/pull/27810
- github.com/MystenLabs/sui/pull/28257
- docs.sui.io/develop/transactions/transaction-auth/auth-overview
- docs.sui.io/develop/transactions/transaction-auth/address-ali…
- graphql.mainnet.sui.io/graphql
- sui.io/blog/post-quantum-computing-cryptography-security
- docs.sui.io/references/framework/sui_bridge/crypto.md
- docs.sui.io/references/framework/sui_bridge/committee.md
- docs.sui.io/develop/sui-architecture/protocol-upgrades
Source: chains/sui.json. Reproduce: python3 score.py chains/sui.json
Building on Sui?
LimeChain helps teams plan their post-quantum migration: what is exposed, what to change first, and the engineering to get there.
Talk to usOpen, repeatable scoring. Non-zero ratings need public evidence; missing evidence means unknown. Methodology v0.4 · mechanism registry 2026-10-13.