Why hash-based signatures

Almost every account on Ethereum-style chains, Robinhood Chain included, is controlled by an ECDSA key on the secp256k1 curve. All of its safety hangs on a single bet: nobody can work backwards from a public key to its secret. Run on a big, stable quantum machine, Shor's algorithm would lose that bet for us.

Which accounts are exposed

An address is a hash of the public key, so an account that has only ever received funds does not show its public key yet. The first transaction it sends puts the public key on chain, permanently. From then on the account depends entirely on the curve staying hard. Most active wallets are in that group.

What changes with hashes

A hash function can be run forwards cheaply and is believed to be infeasible to run backwards. Quantum computers are expected to speed up a search against a hash (Grover's algorithm) by roughly a square root, which a 256-bit output absorbs. No known quantum method turns a hash chain backwards the way Shor's algorithm undoes a curve. That is why hash-based signatures sit among the post-quantum options that standards bodies have adopted.

The price

• One signature per key. Each Winternitz signature reveals part of its key. Two signatures from one key can let someone forge a third. MERKI handles this with rotation: see Inside a key.
• Size. Each signature takes 2,209 bytes, against 65 for ECDSA, and it does not compress.
• Gas. Checking it costs about 106k gas. See Gas measurements.

Nobody knows when, or whether, a machine large enough to break secp256k1 will exist. MERKI is a way to keep long-term holdings under an authorisation scheme that does not depend on that answer. It is not a prediction.