Field note
Post-Quantum Where, Exactly?
“Post-quantum” is useful only when attached to a boundary. A system can use a quantum-resistant proof and still depend on an elliptic-curve signature, RSA certificate, or key exchange elsewhere.
The target vault's protocol core is deliberately hash-based. Commitments, nullifiers, authorization tags, account identifiers, and aggregator selection use hashes. The proof system is a Stwo circle-STARK. Threshold authority uses committed secret shares and proof of knowledge rather than a curve-based aggregate signature. Shor's algorithm has no discrete-log or factoring target in that core.
Hash-based does not mean quantum-unaffected
A generic quantum search gives roughly a quadratic improvement against preimage search, so security parameters still need margin. The Architecture of Record sizes hash outputs and the Poseidon2 sponge capacity with that reduction in mind. STARK soundness also depends on the Fiat–Shamir hash and its declared security target.
“Shor-immune” is therefore narrower than “mathematically everlasting.” It means the known polynomial-time attack on RSA and elliptic curves does not apply to the primitive.
The classical boundaries
Three important components remain classical:
- The note-delivery mailbox uses X25519. Its role is confidentiality, and it can be replaced in a new deployment, but recorded traffic is exposed to harvest-now/decrypt-later risk.
- The launch TLSNotary attestation is signed with ECDSA-secp256k1 and verified inside the M31 AIR. A quantum attacker capable of breaking that key could forge payment evidence. This trust risk already exists today: if the launch notary works with a dishonest taker, they can fake evidence and drain one claimed offer. The offer cap limits the loss. Quantum capability would let more attackers forge the same evidence.
- Banks choose their own TLS key exchange and certificate algorithms, commonly elliptic-curve or RSA based. PayMoney cannot upgrade a bank's cryptography.
MPC-TLS binds evidence to a live bank session, which narrows some retrospective attacks, but it does not turn the bank or notary signature into a post-quantum primitive.
The honest product claim
The correct description is a post-quantum-plausible settlement core with a classically secured fiat-evidence leg. Deposit and withdrawal are also public boundaries, so this qualification belongs next to the privacy qualification rather than in fine print.
A future notary quorum improves trust distribution but does not by itself remove ECDSA. Replacing a primitive, key, rail template, or parameter means a new immutable deployment under the architecture's forward-only rule.
This layered inventory is more useful than a single badge. It tells implementers which secrets face which adversary, what can be migrated, and which dependency sits outside the protocol's control.