Sui plans NIST post-quantum signatures, with native account support slipping to 2027

Sui says it will add two post-quantum signature schemes to the network, according to an announcement from the project reported by The Block on Aug. 7. The rollout is opt-in and staged over roughly 18 months, and nothing changes for existing accounts today.

The two schemes target different risk profiles. ML-DSA-65 — the lattice-based scheme standardized by NIST as FIPS 204 — will become a native protocol signature scheme for ordinary accounts, at NIST Level 3. SLH-DSA-SHA2-128s, the hash-based scheme standardized as FIPS 205, will run inside Move smart contracts for high-value vaults rather than at the protocol layer. Sui said the two rest on different mathematics so a weakness in one does not undermine the other, and that keeping the hash-based scheme in-contract lets it track whatever standards the industry settles on without a core protocol upgrade.

Sui said it chose Level 3 over the cheaper Level 1 parameters after a July incident in which an AI model halved the effective key strength of a different post-quantum candidate. It did not name the scheme, the researchers, or the publication. "While the finding does not affect ML-DSA, the speed of it is reason to carry margin rather than take the cheapest parameters on offer," the team said.

On migration mechanics, Sui said keys derive deterministically from a seed, so users can move to a quantum-safe key using their existing recovery phrase, and that address aliases — already live — let an account swap its authorization key without transferring assets. It also conceded a cost: post-quantum signatures and public keys are substantially larger than Ed25519's, which increases transaction size. No figures for that increase, or its fee impact, were given.

Key facts

• Schemes: ML-DSA-65 (NIST FIPS 204, Level 3) native; SLH-DSA-SHA2-128s (FIPS 205) in Move contracts — Sui announcement via The Block
• Vaults on mainnet: targeted this year — Sui
• Native ML-DSA-65 accounts on testnet: by end of 2026 — Sui
• Native account authentication on mainnet: targeted Q1 2027 — Sui
• Status: additive and opt-in, via the same rollout path as zkLogin and passkeys; "no application needs to do anything today" — Sui

The real-world read

Every technical claim, date and threat assessment here originates with Sui itself. The Block's report relays that announcement; no independent cryptographer, auditor or external benchmark appears anywhere in it. Treat the roadmap as a vendor roadmap.

The framing does real competitive work. Sui calls this "a routine protocol-feature update rather than a change to consensus," positioning itself against chains that would face a migration — an implicit dig that goes unnamed and unquantified.

Note what ships when. The near-term deliverable, the vaults, is contract-level and needs no protocol change. The genuinely hard piece — native post-quantum account authentication on mainnet — sits in Q1 2027, and is described as "targeted" and "planned," not committed.

The largest gap is the flip side of "opt-in." Sui's own harvest-now-forge-later argument says exposed public keys are a standing liability. If migration is voluntary, that liability persists for every user who never opts in — and no deprecation date for Ed25519 is offered.

Opinion, and whose

The claim that Sui's cryptographic agility makes this "the difference between a migration and a rebuild" is Sui's, about Sui. The judgment that the July AI result warrants extra parameter margin is also Sui's. Both are engineering positions from an interested party, not established findings.

Sources

• The Block, Danny Park (Aug. 7, 2026) — the report of Sui's schemes, security levels, timeline, migration mechanics and quotes. The Block's own disclosure states Foresight Ventures is its majority investor and that Bitget is an anchor LP for Foresight.
• Sui's project announcement — the primary source underlying the above, and the origin of all quotes and dates. It is the project describing its own roadmap and should be read as such, not as independent assessment.

Not financial advice.