A Line in a Draft
Last week I spent four hours trying to explain to a friend why a single line in a draft document on GitHub mattered more than anything announced on a conference stage this year. The line was ordinary. It said that a framework could make post-quantum security economically viable on Ethereum. My friend, who has farmed more points programs in the past eighteen months than he has read white papers, shrugged and asked me whether there was a token.
There is no token. There is no airdrop. There is no founder with a podcast circuit. There is just an Ethereum Improvement Proposal, a frame type, and a mathematical claim about what it costs to prove that a signature is real. And yet, sitting in that quiet hour before the Asian session opened, I found myself more interested in this document than in anything with a market cap attached to it.
I have learned to listen to the silence between market cycles. Right now the silence is not in the price charts. It is in the infrastructure layer, where a small number of people are quietly deciding what Ethereum will be made of in 2030. This is one of those decisions.
What Ethereum Is Actually Signed With
To understand why EIP-8288 exists at all, you have to understand what a wallet actually does when you press send, and how little of that process most holders have ever interrogated.
When you sign an Ethereum transaction today, your wallet is performing an elliptic curve digital signature using an algorithm called ECDSA over a curve called secp256k1. Your private key is a 256-bit number. Your signature is a pair of numbers, r and s, that together take up 64 bytes and carry a mathematical proof: that whoever produced this signature knew the private key corresponding to a specific public address, without revealing it. For a decade, this scheme has been the load-bearing wall of the entire network. It is fast, it is compact, and it is cheap enough that the base fee usually dwarfs the signature verification cost itself.
The crucial detail is this: ECDSA's security rests on the difficulty of the elliptic curve discrete logarithm problem. That problem is hard for a classical computer. It is not hard for a sufficiently large quantum computer running Shor's algorithm. When people say Ethereum has a quantum problem, this is what they mean, and it is not a metaphor.
Ethereum's developers have known this for years. What they have not had, until recently, is a plausible answer to the cost question. Post-quantum signature schemes exist, and several of them are standardized. The problem is that they are enormous. A single ML-DSA signature, one of the schemes standardized by NIST in August 2024, runs somewhere between two and five kilobytes depending on the security level. SLH-DSA, the hash-based standard, is larger still. Ethereum's current signature occupies 64 bytes. Replacing one with the other is not a software patch. It is a change in the physical economics of the chain, because every byte a transaction adds is a byte that every node must store, propagate, and eventually discard or keep forever.
So the naive path to quantum resistance on Ethereum is also the path to a chain that costs dramatically more to use. That is the trap EIP-8288 is trying to step around.
The proposal introduces what it calls a frame type, and the framing matters. Ethereum already has a precedent for this kind of extension. EIP-2718 introduced typed transaction envelopes years ago, letting the protocol carry different classes of transaction without breaking the ones already in flight. A frame type is a further generalization: a container that can hold a new kind of cryptographic authorization without forcing the rest of the stack to understand it immediately. The frame carries two things — a post-quantum signature, and a STARK proof that aggregates it with others.
That is the whole idea in one sentence, and like most one-sentence ideas in cryptography, the difficulty lives entirely in the second half.
Why Post-Quantum Signatures Are Expensive
I want to be precise here, because the marketing version of this story is much simpler than the engineering version.
Post-quantum cryptography is not one thing. It is a family of approaches, each resting on a different hardness assumption, each with different tradeoffs. Lattice-based schemes, which include ML-DSA and ML-KEM, are the most commercially mature. They rely on the difficulty of problems like module learning with errors, which appear to resist both classical and quantum attack. Hash-based schemes like SLH-DSA rely on nothing more exotic than the collision resistance of a hash function, which makes their security assumptions unusually conservative, and which makes Grover's algorithm — the quantum search algorithm — only a quadratic speedup rather than a catastrophic break. Code-based and multivariate schemes exist too, with their own histories and their own scars.
This diversity is healthy for the ecosystem and miserable for a blockchain. Ethereum is a system where every byte is priced, where state growth is a governance problem, and where the difference between 100 bytes and 4,000 bytes is the difference between a transaction that millions of people can afford and a transaction that only institutions can.
Let me put numbers on the table, because abstractions hide the cost. Verifying an ECDSA signature on Ethereum costs roughly 3,000 gas through the ecrecover precompile. A transaction currently sits around 21,000 gas at its cheapest. Signature verification is a rounding error next to the base cost. Now imagine a world where a single post-quantum signature requires hashing operations measured in the tens of thousands, and where each signature carries kilobytes of data that must be published to calldata or blobs. The per-transaction cost does not go up by 10 percent. It goes up by an order of magnitude or more, and it does so exactly when the network is most congested, because congestion is when data is scarcest.
This is the reason post-quantum migration has lingered in the "we will get to it" bucket for so long. It is not that nobody cares. It is that the naive migration takes the cheapest and most accessible settlement layer in the world and makes it expensive. A security upgrade that prices out its own users is not a security upgrade; it is a migration to a different network wearing the old one's name.
That sentence is the reason EIP-8288 matters. The proposal is not trying to make post-quantum signatures free. It is trying to make them amortized.
STARK Aggregation: Turning Many Into One
The second half of the proposal is where the real intellectual work sits, and it is also the part that most coverage will skip.
A STARK, short for Scalable Transparent Argument of Knowledge, is a type of zero-knowledge proof system. Its two defining properties are transparency and scalability. Transparent means it requires no trusted setup — no ceremony, no toxic waste, no small group of people who must be trusted to destroy a secret and then prove they did. Scalable means its verification time grows polylogarithmically with the size of the computation being proven, which is a fancy way of saying that proving a very large amount of work costs only slightly more to check than proving a small amount. And there is a third property that matters enormously here: STARKs are post-quantum secure in their own right, because their soundness rests on hash functions rather than on elliptic curves or pairings. A STARK is not broken by Shor's algorithm. It is only weakened, mildly, by Grover's.
So the architecture of EIP-8288 becomes legible. Instead of asking every node to verify every post-quantum signature individually, the network verifies one STARK that attests to the validity of many signatures at once. The expensive part — the tens of thousands of hash operations per signature — happens once, off the critical path, inside a prover. The cheap part — verifying the resulting proof — happens on-chain, where gas is priced.
This is a well-understood pattern. It is the same logic that lets a rollup compress ten thousand transactions into a single proof. It is the same logic that lets a bridge attest to a state transition without replaying the whole chain. What is new here is the application: not state, but signatures. Not execution, but authorization.
And this is where the economics get genuinely interesting, because aggregation is not a linear discount. It is a curve. When you aggregate two signatures into one proof, you have not halved the cost — you have moved a fixed setup cost onto a slightly larger payload. The savings scale with the batch size, which means the design has to answer a question that no white paper can answer in advance: what is the typical batch?
If the batch is one, the scheme is strictly worse than the naive approach. If the batch is a thousand, the per-signature cost can fall below the ECDSA baseline entirely, and the post-quantum signature becomes not merely viable but cheaper than what it replaced. Somewhere between those two numbers is the reality of Ethereum's mempool, and that reality is uneven. During quiet hours, batches are small. During a bull market, they are enormous. The proposal is, in effect, a bet that Ethereum's future is busy — and a hedge against the possibility that it is not.
I want to flag a subtlety that gets lost in the excitement. Aggregation does not eliminate the data cost. The signatures still have to exist somewhere, or the proof has nothing to attest to. What aggregation changes is who pays for verification and when. It converts a per-transaction cost into a per-batch cost, which means it converts a fee market into a coordination problem. Someone has to run the prover. Someone has to decide which signatures go into which batch. Someone has to be compensated for the compute. That someone is not the protocol. The protocol just defines the frame.
That is a design choice, and I will return to it, because it is where I think the proposal is most vulnerable.
Frame Types and the Plumbing
The frame type abstraction is easy to underestimate because it is boring, and boring is exactly what you want in a consensus-adjacent change.
Ethereum has learned, painfully, that the safest way to extend itself is through envelopes rather than surgery. Typed transactions let the network adopt EIP-1559 fee mechanics, access lists, and blob-carrying transactions without forking the meaning of every existing transaction. The envelope says: here is a new shape of thing, and here is how to read it. Nodes that understand the shape process it. Nodes that do not can still propagate it. The change becomes additive rather than disruptive.
EIP-8288 applies that pattern to signatures. A frame is a container that declares its type, carries a post-quantum signature, and carries an aggregation proof — or a reference to one — that binds it to a set of other frames. The execution layer does not need to know which lattice scheme produced the signature. It needs to know that the proof verifies and that the frame's declared sender is the one the proof authorizes. Everything else is hidden behind the abstraction.
This matters for three reasons. First, it lets post-quantum adoption be gradual. An account can migrate to a post-quantum key without forcing every counterparty to understand it. A contract can accept both classical and post-quantum authorizations during the transition period, which is likely to last years. Second, it lets the cryptographic primitives be upgraded. If ML-DSA is later found to have a weakness — and I want to be clear that no such weakness is currently known — the frame type can carry a different scheme without changing the protocol's fundamental contract with users. Third, it separates concerns. The quantum question is answered at the frame layer. The gas question is answered at the aggregation layer. The privacy question, which nobody expected to be part of this, is answered as a side effect of both.
There is a cost to this elegance, and it is governance. Every new frame type is a new consensus rule, and every consensus rule is a potential source of disagreement. The EIP process is deliberately slow, and it is slow for good reasons. Post-quantum migration is a decade-scale project. A decade-scale project run through a process designed for caution is a project that will arrive late, and late is a word that means different things depending on who is asking.
Which brings me to the estimate I cannot shake.
The best public analyses of quantum resource requirements put a cryptographically relevant attack on 256-bit elliptic curves at something on the order of millions of physical qubits, with optimistic error-correction assumptions and a runtime measured in hours. That is not a laptop. It is not a nation-state's side project either, though it is plausibly within the reach of one within the next ten to fifteen years. Estimates vary, and I hold them loosely. But there is a second timeline that people routinely ignore, and it is the one that actually matters for signatures: the migration lead time.
If a quantum computer capable of breaking ECDSA arrives in 2035, the migration does not need to finish in 2035. It needs to finish before 2035, because the lead time for a protocol as large as Ethereum — from proposal to testnet to mainnet to wallet support to user migration — is measured in years, not months. Ethereum's quantum problem is not a 2035 problem. It is a 2025 problem wearing a 2035 costume. EIP-8288, whatever its fate, is evidence that some people understand this.
The Layer Two Borrowing Problem
I spent three months in 2020 mapping liquidity flows between Uniswap and Aave, trying to correlate on-chain capital movement with Federal Reserve balance sheet expansion. The thing I learned that stuck with me longest was not about liquidity. It was about how quickly a good primitive gets borrowed.
Nothing in EIP-8288 is specific to layer one. The aggregation logic is a general compression technique. The frame abstraction is a general envelope. If the proposal demonstrates that post-quantum authorization can be batched cheaply, every rollup on the network has an incentive to implement something equivalent, because rollups are even more sensitive to per-byte costs than the base chain is. A rollup that posts compressed data to blobs pays for every byte it publishes. A rollup that can prove a thousand post-quantum signatures with one proof has a structural cost advantage over one that cannot.
Whether this produces a coherent ecosystem or another round of fragmentation is an open question, and I hold a view on the answer that will not surprise anyone who reads my work. The omnichain application narrative, the idea that users care how many chains a contract is deployed on, has never been more than a way to sell infrastructure to people who will never use it. Users care that transactions settle, that fees are predictable, and that their keys are not compromised. Post-quantum aggregation is one of the few infrastructure stories where the benefit reaches the user directly, because the benefit is denominated in gas and in the size of the security margin behind their address.
That is the difference between real infrastructure and the manufactured kind. Real infrastructure lowers costs for everyone who touches it. Manufactured infrastructure lowers costs for the people selling it and asks everyone else to call that innovation.
There is a related dynamic worth naming. The blob market introduced by EIP-4844 created a new fee environment where data availability is cheap in bursts and expensive in scarcity. Post-quantum signatures are data-heavy. Aggregation is a data-compression technique that happens to also be a verification technique. If EIP-8288 or anything like it lands, it will interact with the blob market in ways that nobody has modeled, because the models assume a chain where signatures are small and fixed-size. They are not, and they will not be.
Privacy as a Side Effect
Here is the part of the proposal that I suspect will end up mattering more than the quantum argument, and the part that will get the least attention.
When you aggregate signatures, you break the one-to-one relationship between a transaction and a proof. The proof attests that some set of valid authorizations exists. It does not, by itself, reveal which authorizer corresponds to which action — unless the frame design leaks that mapping, which is a design decision rather than a mathematical necessity. Done carefully, aggregation is a linkability-reduction tool. Done carelessly, it is a new surveillance vector, because a prover that sees all the inputs to a batch sees something a validator never did.
Ethereum has always had a weak privacy story at the base layer. Addresses are pseudonymous, not anonymous. Linkage analysis is a mature discipline, and the assumption that on-chain activity is private has always been false for anyone with a block explorer and patience. A signature scheme that reduces the number of distinguishable cryptographic events per block is, almost incidentally, a small step toward a chain where the default is less revealing.
I have been a vocal critic of projects that promise privacy and deliver a dashboard. I have been equally critical of the audit culture in this industry, which is mostly theater performed for a compliance checkbox. I once spent a summer auditing early token contracts and found reentrancy bugs that would have drained six figures from people who trusted the code because it had a logo. The lesson was not that code is dangerous. The lesson was that verification you cannot inspect is not verification, and that the industry's tolerance for unverified claims about reserves, about audits, and about proofs is its most persistent vulnerability.
That is why the transparency property of STARKs matters more to me than their scalability. A SNARK-based aggregation scheme would require a trusted setup, and a trusted setup is a place where trust can be misplaced quietly, at scale, by a small number of people. STARKs remove that room. The proof is checkable by anyone who can run the verifier. The security assumption is the collision resistance of a hash function, which is the most conservative assumption available in modern cryptography. A system that is merely economically viable but requires you to trust a ceremony is not quantum-safe in any sense that survives contact with adversarial reality.
This is a place where I want to be genuinely humble. STARKs are not free of assumptions. They rest on the soundness of the underlying proof system and on the field arithmetic and on the implementation. A mathematical proof of security says nothing about whether the code that implements it is correct, and the history of this industry is a long list of correct papers implemented incorrectly. EIP-8288 is at the proposal stage. There is no audited implementation. There is no testnet deployment. There is no measurable gas reduction to point at. What exists is a design and an argument, and both deserve to be read carefully before anyone treats them as settled.
The Decoupling Nobody Wants to Admit
Now let me say the thing I actually think, which is less comfortable than the technical story.
The quantum argument is not the reason this proposal matters. It is the reason the proposal is fundable, discussable, and publishable. The quantum argument gives people permission to work on a problem whose real value is different from its stated value, and that is not cynicism. It is how large systems change. You rarely get to do the thing you need to do unless you can attach it to a threat that makes the funding committee move.
What EIP-8288 actually does, stripped of its framing, is reduce verification costs and, as a consequence, reduce linkability. Quantum safety is the passenger. Gas economics and privacy are the drivers. And the market is pricing this at zero because the market prices the stated value, not the real value.
This is not unusual. It is the normal condition of infrastructure. The reason I keep watching infrastructure rather than trading it is that the mispricing is real but slow, and slow mispricing is invisible to anyone whose time horizon is a funding cycle. Listening to the silence between market cycles means hearing the things that are being decided before they are being sold. EIP-8288 is being decided right now, in commit history, in mailing list threads, in a comment section that most people will never open.
There is a sharper version of the contrarian case, and I want to state it honestly even though I do not fully hold it.
It is possible that post-quantum migration for signatures will never be necessary, not because quantum computers will not arrive, but because the chain will migrate away from signatures being the expensive part. Account abstraction, smart contract wallets, delegated authorization, and off-chain intent systems all reduce the number of on-chain signature verifications per user action. If the future is a chain where most authorizations never touch the base layer, then the urgency of an on-chain post-quantum signature scheme drops sharply, and the real migration happens in wallet firmware and in layer two prover markets instead.
I do not think this makes EIP-8288 irrelevant. I think it makes it a transitional technology — a bridge between the chain as it exists today and a chain where authorization is a solved, abstracted, aggregated primitive. Transitional technologies are the least glamorous and most important things in this industry. Almost nobody writes about them, and almost everything depends on them.
There is a second risk, and it is the one that worries me most because it is the one that repeats.
Aggregation introduces provers, and provers introduce a market. Markets concentrate. If the cost of proving a post-quantum aggregation is high enough, the number of entities who can profitably run a prover shrinks, and a small number of provers becomes the bottleneck between users and the chain. That is a centralization vector hiding inside a decentralization upgrade, and it is precisely the kind of tradeoff that gets waved away when the narrative is quantum safety and the incentive is to ship.
I have watched this pattern in liquidity mining, where the advertised yield is the project subsidizing its own activity and the real question — who is still here when the subsidy stops — is never asked until the subsidy stops. I have watched it in stablecoin reserves, where the absence of an independent audit is treated as a scheduling problem rather than a structural one. I have watched it in cross-chain messaging, where the number of chains supported is a marketing metric rather than a user benefit. Prover markets are the next place this pattern will appear, and I would rather name it now than pretend it is inevitable.
What I would want to see, before I trust any implementation of this proposal, is the answer to four questions. Who can run a prover, and at what cost? What happens to batch composition when fees spike and provers rationally refuse to include low-fee signatures? What is the failure mode when a prover produces an invalid proof — does the chain halt, or does it slash, or does it silently drop a batch? And what is the actual measured gas reduction, not the modeled one, on a congested mainnet with real transaction sizes?
None of these are reasons to abandon the proposal. All of them are reasons to stop describing it as settled.
Where This Leaves the Cycle
We are in a market that rewards narrative velocity. A new chain announces a partnership, a token announces a burn, and the price responds within hours. EIP-8288 announces nothing. It reduces a cost that most users never see, on a timeline that most funds cannot hold, in service of a threat that most people file under science fiction.
Which is exactly why it is worth your attention.
The migration to post-quantum cryptography on Ethereum will happen, or it will not, and the difference will be decided by people writing code in the next twenty-four months. The proposal in front of us is one attempt to make that migration affordable, and it is doing so with the most conservative cryptographic tools available — transparent proofs, hash-based soundness, no ceremony, no trusted few. The market prices this at zero because the market prices the stated value rather than the real one.
I will be watching the testnet, the gas data, and the prover market, in that order. And I will be listening — as I always do — to the silence between market cycles, where the decisions that actually determine the next decade are being made quietly, by people who are not asking anyone's permission.
My friend never did get his token. But the line in that draft is still there, waiting.
