Platus encrypts private Ethereum notes with a hybrid design: BabyJubJub ECDH plus ML-KEM-768. That means note confidentiality is not dependent on a classical key-agreement primitive alone.
Every encrypted transaction you send to Ethereum today is being recorded by someone, somewhere. They cannot break it now. But, when a quantum computer with enough coherent qubits comes online, it decrypts everything at once, faster than you might expect.
This is a classic "harvest now, decrypt later" (HNDL) attack and for onchain privacy, this creates an existential problem: the transactions you encrypt today remain onchain forever, vulnerable to retrospective decryption for decades to come.
Platus is building onchain private accounts for Ethereum and EVM chains with a simple belief: make them composable, usable, and secure for the future.
This blog explains why we're deploying post-quantum cryptography now, years before quantum computers become a practical threat and why current privacy solutions are already obsolete.
The Quantum Threat Timeline
No one can responsibly give a precise date for a cryptographically relevant quantum computer. The important security property is independent of the forecast: public blockchain ciphertext can be collected now and attacked later if the underlying cryptography becomes breakable.
If a CRQC shows up in 2030, every transaction encrypted in 2026 using ECDH becomes readable in 2030. Blockchain makes this worse because everything is public and permanent. An adversary doesn't need to intercept your traffic, they just read the chain. The ciphertext sits there, waiting.
Onchain transactions leak: who you transacted with, how much, when, and often what for (based on linked metadata or counterparty identification). This information stays valuable. A business competitor learns your customer list. A government traces dissident funding. An ex-spouse finds hidden assets in a divorce settlement. You can't rewind the blockchain and re-encrypt with stronger algorithms once quantum computers exist.
Elliptic Curves break
Public-key cryptography relies on mathematical one-way functions: easy to compute forward, hard to reverse. RSA uses integer factorization (easy to multiply two primes, hard to factor the product). Elliptic curve cryptography, which we use in baby jubjub, relies on the discrete logarithm problem over elliptic curves.
Both are instances of the hidden subgroup problem, which Shor's algorithm solves efficiently on a quantum computer. A CRQC with enough coherent qubits breaks ECDH, ECDSA, RSA—all of it.
Post-quantum cryptosystems use different one-way functions that resist quantum attacks. ML-KEM is a lattice-based key encapsulation mechanism. The underlying hardness assumption is the Learning With Errors (LWE) problem: given noisy linear equations, solve for the secret vector. No known quantum algorithm breaks this efficiently.
Hybrid Post-Quantum Key Agreement
Platus implements BJJ-KEM768, a hybrid post-quantum key agreement protocol designed to securely establish a shared secret between two mutually authenticated parties.
The protocol combines:
- Elliptic-curve Diffie–Hellman over the Baby Jubjub curve, and
- ML-KEM-768, a NIST-standardized post-quantum key encapsulation mechanism.
Each party derives independent shared secrets from both the classical elliptic-curve exchange and the post-quantum KEM. These secrets are then cryptographically combined into a single master key. As a result, an attacker must successfully break both Baby Jubjub ECDH and ML-KEM-768 to recover the final shared secret, a significantly stronger security model than relying on either primitive alone.
Tradeoff: Slightly larger key sizes and ciphertext in exchange for dramatically higher security assurance against both classical and quantum adversaries.
Is it experimental or production-ready?
Platus is not taking a risky, unproven approach. Hybrid post-quantum cryptography has already been deployed at scale.
- Cloudflare: X25519 + ML-KEM-768 for TLS connections
- Apple iMessage: PQ3 protocol combining ECDH with Kyber
- Signal: PQXDH (X25519 + CRYSTALS-Kyber)
These deployments show that hybrid post-quantum designs are practical enough for real systems. Platus applies that direction to long-lived private payment data on a public blockchain.
What about signatures and zkSNARKs?
Digital signatures don't encrypt data, they authenticate it. If you sign a transaction with ECDSA today and a CRQC appears in 2030:
- Anyone can verify the signature was valid when created
- But new signatures can be forged going forward
The threat is prospective, not retrospective. Past signatures don't become invalid; you just can't trust new ones after CRQCs arrive.
zkSNARKs have the same property:
- The zero-knowledge property resists quantum attacks: a quantum adversary looking at the proof learns nothing about the witness, same as a classical adversary.
- A zkSNARK proof generated today remains cryptographically trustworthy forever; the statement being proved is provably true
- The proof's validity is information-theoretic, not computational, it's checking polynomial identities, which quantum computers don't help with.
What changes post-CRQC: attackers can forge new proofs of false statements. A quantum computer could break the discrete log assumptions underlying the trusted setup and generate false proofs. But proofs generated before CRQCs remain valid.
So signatures and zkSNARKs need eventual migration (likely to hash-based signatures and post-quantum SNARK), but there's no harvest-now-decrypt-later attack. The old data stays safe.
Onchain privacy protocols should default to the strongest reasonable security model. For encryption, that means post-quantum hybrid constructions, deployed now, while we still have time to get it right.
Read the technical documentation on post-quantum note encryption for the protocol design and threat model.