Post-Quantum Lightning Network

An adversary records Lightning's encrypted traffic today and stores it.

Once a quantum computer exists, Shor's algorithm recovers the secp256k1 keys behind every recorded handshake.

The recorded sessions then open, and every payment inside them becomes readable.

The keys behind channel funds live inside Bitcoin transactions, so they wait for a Bitcoin consensus change.

Everything else lives in messages between Lightning nodes, so a software update can protect it.

PQLN protects all five of these off-chain surfaces.

Lightning has no certificate authority, so every node announces its ML-DSA and ML-KEM keys in its node_announcement.

Every PQLN node pins these keys on first sight.

A forged announcement with substituted keys does not match the pin, so the node rejects it.

In act one, the initiator encapsulates to the responder's pinned ML-KEM key, so only the real responder can finish the handshake.

In act two, the responder encapsulates to a fresh ephemeral key, which gives forward secrecy.

Act three stays unchanged, and the session keys now depend on five shared secrets.

An ML-DSA-44 signature is 2420 bytes, but a BOLT 11 tagged field holds at most 639.

PQLN splits the signature across four tagged fields, and vanilla decoders skip them as unknown fields.

The invoice grows to 4286 characters and still fits in one QR code, with 10 characters to spare.

An offer's payee often hides behind a blinded path, so gossip never shows its keys.

PQLN commits a fresh ML-DSA key in every offer, and the payer records that key.

The returned invoice must verify under exactly that key before any HTLC goes out.

One 1088-byte ML-KEM ciphertext would nearly fill the 1300-byte onion, so the onion keeps its format and only its per-hop secrets turn hybrid.

The ciphertexts ride beside the onion in a list of 20 slots, and dummies shaped like real ciphertexts fill the rest.

Each hop opens the front slot and rotates it to the back, so no hop can count the real entries or learn the route length.

The new cryptography is cheap. ML-DSA signing is the slowest new operation, and it takes 0.33 ms.

On a link with a 50 ms round trip at 10 Mbit/s, a payment gets 19 to 53 ms slower per hop.

Gossip carries the real cost, since a new node downloads about 10 times as much data, or about 4 times with FN-DSA-512.

Between PQLN nodes, a payment runs fully protected.

When a vanilla node sits on the route, the payment falls back to classical and still completes.

With a require flag on, the node refuses that downgrade before any HTLC moves.