Post-Quantum Nostr Proposed as Soft Fork: Quantum Signatures Packed into Legacy Envelopes
By embedding quantum-resistant keys and signatures within reserved event tags, clients and relays can transition asynchronously without breaking legacy software or requiring coordinated protocol upgrades.
In an architectural proposal published to the network Monday, developer nomadshiba outlined a pathway to prepare Nostr for the post-quantum cryptographic transition without fracturing the network or forcing coordinated relay migrations. As nomadshiba framed the proposal: Post-quantum signatures can be added to Nostr as a soft fork inside today's event format, so no client or relay has to upgrade at the same time.
Rather than replacing elliptic curve cryptography in a single disruptive break, the scheme packages two identities and two cryptographic commitments into each transmission: Every event is two events by two different authors, packed into one.
An outer legacy envelope preserves existing secp256k1 signatures and standard NIP-01 structures, allowing legacy relays and un-upgraded clients to route and render notes without modification. Within reserved tags, an inner quantum-resistant payload carries an independent public key and a post-quantum signature.
Upgraded clients query legacy relays using a single-letter index tag, rebuild the post-quantum event from the inner envelope, and verify both cryptographic proofs. Crucially, the approach separates relay readiness from client adoption: The goal for now isn't upgrading relays. It's making sure they already have the new forms, so they're ready to switch.
Relays that already store legacy events can extract and index the quantum forms at any point in the future.
The decoupling means migration happens on an individual timeline rather than an arbitrary flag day: Nobody has to agree on a date for this. Every client and relay switches when it wants, and each one is safe from the moment it does.
Should secp256k1 ever be broken by quantum computing hardware, clients already operating in dual mode can prune legacy envelopes entirely, preserving social graphs and identities that established their post-quantum keys ahead of time.