Post-Quantum Digital Cash
The problem is not the algorithm. It is the money.
Note: I believe QC is a scam and not one that will be solved in my grandchildren’s lives. That does not mean I cannot model the case as it is promoted.
We are told a storm is coming. A sufficiently large quantum computer running Shor’s algorithm will factor the integers and solve the discrete logarithms that stand behind almost every public key in use today. RSA falls. Elliptic curves fall. The signatures that authorise a bank transfer, the key exchange that protects a web session, the keys that control a wallet — all of them rest on problems a quantum computer would make easy.
The standard response is to swap the algorithms. Replace RSA and ECDSA with lattice-based or hash-based schemes that no known quantum algorithm defeats, and carry on. Post-quantum cryptography, in this telling, is a component upgrade: pull the old cipher, push the new one, done.
For most of the internet, that framing is roughly adequate. For money, it is dangerously incomplete.
A payment system is not a cipher. It is an arrangement for deciding who owns what, settling disputes about it, and making transfers final. Cryptography is one input to that arrangement — an important one — but swapping a signature scheme does not tell you whether the resulting system is usable, final, private, affordable to verify, or recoverable when something goes wrong. Those properties are decided at the level of the system, not the primitive. Post-quantum digital cash is a payment-system design problem wearing a cryptography costume.
This essay is about what that design problem actually is.
What breaks, and what does not
Start with the threat, stated precisely, because most of the public discussion is not.
The quantum threat is not uniform. Shor’s algorithm breaks the public-key layer; Grover’s algorithm only weakens symmetric ciphers and hashes, and the fix is cheap; hash-based and lattice-based schemes are the resilient candidates.
Two quantum algorithms matter. Shor’s algorithm attacks the structured hard problems — integer factorisation and the discrete logarithm — that underpin public-key cryptography. Given a large, fault-tolerant quantum computer, Shor turns these from intractable into tractable. This is the one that breaks RSA and elliptic-curve cryptography, and with them the digital signatures and key exchanges that most systems depend on.
Grover’s algorithm is the other, and it is weaker and more general. It gives a quadratic speedup for unstructured search. Against a symmetric cipher or a hash function, a quadratic speedup means the effective security is roughly halved: a 256-bit symmetric key offers something closer to 128 bits of quantum resistance, and a hash’s preimage resistance is similarly reduced. The response is boring and effective — use longer keys and larger hashes. Symmetric cryptography and well-chosen hash functions do not collapse; they are trimmed, and the trim is easily paid for.
So the asymmetry is stark. The public-key layer — signatures and key agreement built on factoring and discrete logs — is the exposed surface. The symmetric layer — block ciphers, and hashes used for their collision and preimage properties — is resilient with modest adjustment.
That asymmetry is why the post-quantum candidates look the way they do. Hash-based signatures build a signature scheme out of nothing but a hash function; if the hash holds, the signature holds, and hashes are Grover-resilient. This makes hash-based signatures the most conservative post-quantum option we have — their security rests on the least. Lattice-based schemes rest on different hard problems, believed resistant to both classical and quantum attack, and offer the efficiency and small key sizes that hash-based signatures sometimes lack. Standards bodies have converged on a mix: lattice constructions for general-purpose key exchange and signatures, hash-based constructions where conservatism matters most.
None of this is speculative in the way the machine is. The algorithms exist. The standards exist. What does not exist — and this is the point that gets lost — is a quantum computer capable of running Shor at the scale required to break a real key. Error-corrected logical qubits at cryptographically relevant scale have not been built. The threat is real and prospective; it is not present. That distinction turns out to matter enormously once money enters the picture, and I will come back to it.
The substitution fallacy
Here is the mistake the drop-in framing makes.
Swapping RSA for a lattice scheme changes which mathematics an attacker must defeat. It does not change how much it costs to verify a payment, how final a transfer is once made, how private the transfer is, how large a value sits behind a single key, or what anyone can do when a transfer turns out to be defective, stolen, or mistaken. Those are the properties that make a payment system a payment system, and they are only loosely coupled to the choice of signature algorithm.
Consider verification cost. Some post-quantum signatures are large — kilobytes where an elliptic-curve signature is tens of bytes. Some verify quickly; some do not. In a payment network that settles millions of small transfers, the size and verification cost of a signature is not a footnote — it is the difference between a system that scales as cash and one that does not. A quantum-resistant signature that is too heavy to verify cheaply has secured the wrong thing: it protects the key while making the payment unusable.
Consider finality. Cash is final because possession is entitlement and settlement is instantaneous and irreversible. Card payments are not final — they are reversible for months. A post-quantum signature says nothing about which of these a system is. Finality is a property of the settlement rules and the legal frame, not of the curve or the lattice.
Consider recoverability. When a signing key is compromised — and post-quantum keys can be compromised through implementation flaws, side channels, and theft, exactly as classical keys are — what happens to the value it controlled? In a bearer system, the honest answer is usually “it is gone.” Whether that is acceptable, and what mechanisms exist to intervene, is a design and governance question that the algorithm choice does not touch.
Replacing the primitive and declaring victory is like replacing the lock on a bank vault and calling the bank secure. The lock matters. It is not the bank.
Money is a bearer-instrument problem
To design post-quantum digital cash, you have to be honest about what digital cash is trying to be. The target is a bearer instrument: value that lives in the instrument itself, where possession is entitlement and a valid transfer is final. Physical cash is the archetype. Hand someone a banknote and the value has moved — no intermediary confirms it, no ledger entry reverses it, no counterparty can claw it back. The note verifies itself; entitlement is possession.
Post-quantum digital cash is a stack, not a primitive. Quantum-resistant cryptography is one layer at the base; cheap verification, finality, privacy, and bounded governance sit above it.
Electronic cash tries to reproduce those bearer properties without the paper. This is genuinely hard, because the digital world has no natural notion of possession — a string of bits can be copied. The entire apparatus of digital cash, from the original electronic-cash constructions to modern ledger-based systems, exists to solve one problem: how to make a digital token behave like a bearer instrument, transferable and final, without allowing it to be spent twice.
Cryptography does part of that job. A signature proves the right to spend; a hash chains history so it cannot be quietly rewritten; a ledger or a mint prevents the double spend. But notice what the bearer target demands beyond the primitives:-
Verification must be cheap, because bearer transfers happen constantly and at low value, and a recipient must be able to check entitlement without heavy infrastructure.
-
Transfer must be final, because a bearer instrument that can be reversed is not bearer.
-
Transfer should be private, because cash is private — the value moves without announcing the parties to the world.
-
And — the uncomfortable one — there must be some answer to high-value defect, because a purely bearer system offers no recourse when value is stolen, extorted, or transferred by mistake, and at sufficient scale that absence of recourse becomes a systemic and legal problem.
Post-quantum cryptography sits underneath all of this as one layer. It hardens the primitives against a future machine. It does not, by itself, deliver cheap verification, finality, privacy, or a defect answer. Those are the design problem.
The threat is a cost, not a threshold
Now return to the point I flagged earlier: the machine does not exist yet.
The dominant way of talking about the quantum threat is as a threshold. There is a date — unknown, but treated as a switch — before which cryptography is safe and after which it is broken. “When will a cryptographically relevant quantum computer arrive?” is the question, and the implied model is binary.
That model is wrong, and for money it is worse than wrong, because it hides the variable that actually governs the decision.
The quantum threat is a cost, not a threshold. Exposure begins where the falling cost-per-key frontier drops below a given asset’s value — so high-value keys are exposed first and everyday cash last, if ever. (Schematic; not based on specific cost estimates.)
A quantum computer that can break a key is not a free oracle. It is, on every serious resource estimate, one of the most capital-intensive single-purpose machines ever contemplated — millions of physical qubits, vast cryogenic or photonic infrastructure, enormous power draw, finite throughput, and finite reliability. Conditional on such a machine existing, breaking a key is not an event; it is a production process with a cost. The relevant quantity is not whether a key can be broken in principle. It is the cost per key broken.
That reframing changes the decision entirely. Qubit counts, gate counts, logical-qubit counts — the numbers that fill the headlines — are technical inputs. They are not, by themselves, measures of economic feasibility. A reduction in qubit count does not automatically reduce the cost of an attack; it can be offset by longer runtimes, lower success probability, greater control complexity, or lower utilisation of an enormously expensive machine. The cost of breaking a key is set by capital intensity, utilisation, runtime, operating cost, and reliability together — not by any single qubit number.
For a defender, and especially for a payment system, this is liberating. You do not have to predict the arrival date of a capability. You have to compare a cost to a value. A key protecting a low-value transfer is not worth attacking even by a machine that exists, if the cost per break exceeds the value behind the key. A key protecting an enormous consolidated holding is worth attacking the moment the cost per break drops below that holding’s value — which may be long before the machine is cheap enough to threaten ordinary transfers.
Exposure, in other words, is not a date. It is the gap between the cost of an attack on the frontier and the value a given key controls. Different assets sit at different distances from that frontier. A payment system that treats all of its keys as equally exposed on some future doomsday is mispricing its own risk. The right object is a descending cost frontier measured against a distribution of values at risk — an economic object, tractable and updatable, not an unfalsifiable prophecy.
I want to be precise about the epistemic status of this. The cost framing is a framework, and a sound one. The specific dollar figures that appear in resource-estimate-based cost models rest on assumptions — capital costs, utilisation, operating profiles — that are not yet firm, and I would not stake a payment system on any particular number. The framework is right; the numbers are provisional. For a payment-system designer, the framework is what matters: budget migration against cost-versus-value, not against a rumoured date.
Verification cost as a first-class variable
Push the cost logic one level down, into the system itself, and it reappears as verification cost.
Every time value is transferred in a digital-cash system, someone verifies entitlement. In a bearer system that verification must be cheap, because it happens constantly, at the point of sale, on modest hardware, for transfers whose value does not justify heavy checks. This is not an implementation detail. It is a design constraint that ranks alongside security.
Post-quantum primitives interact directly with this constraint, and not always kindly. Larger signatures cost more to transmit, store, and verify. Stateful hash-based signatures impose bookkeeping the verifier and signer must respect. Some lattice parameters that buy security also buy bulk. A naive post-quantum migration that swaps a compact elliptic-curve signature for a heavy alternative can quietly destroy the low-cost verification that made the cash usable — securing the instrument against a future machine while breaking it against the present merchant.
So the design problem has a shape. For low-value, high-frequency transfers, verification must stay information-light and cheap, even under post-quantum primitives — favouring compact schemes, aggregation, and verification strategies that do not force every participant to carry the full weight. For high-value or opaque transfers, heavier verification, stronger provenance, and additional checks are justified, because the value at stake pays for them and the risk demands them. The efficient system does not apply one verification regime uniformly. It scales the strength and cost of verification to the value and risk of the transfer.
That is a threshold problem, and it is the same threshold that governs the deepest tension in the whole design.
The tension: finality versus recoverability
Here is the claim that most people in this space would rather not confront, stated plainly because evasion helps no one.
Bearer finality and third-party recoverability are in conflict. They cannot both be maximal in the same instrument at the same time.
Finality and recoverability pull against each other. The design task is to place the threshold deliberately — bearer finality by default, governed recoverability as a costly, bounded exception — and to defend where the line sits rather than assume it.
A bearer instrument is defined by finality without recourse: possession is entitlement, transfer is final, and no third party can reverse it. That is precisely what makes cash cash. The moment an institution can reach into the system and recover, reverse, or freeze value, the instrument is — to exactly that extent — no longer bearer. Recoverability is the negation of pure bearer finality. You do not get to call something bearer cash and also promise that a court or an operator can undo transfers at will; those are different instruments with different properties, and pretending otherwise is how payment systems are mis-sold.
This is not a reason to abandon either property. It is a reason to locate the boundary between them deliberately rather than by accident. And I want to be clear that where that boundary should sit is a thesis I am arguing, not a settled fact: reasonable people place it differently, and a system’s designers must defend their choice rather than assume it.
The argument I would make is that the efficient boundary is not fixed — it depends on value, verification cost, opacity, and institutional reach. A low-value, transparent, everyday transfer should be final and irreversible, like cash, because the cost of providing recourse exceeds the harm of its absence and because reversibility at that layer would destroy the usability that makes the instrument worth having. A very high-value, opaque transfer — the kind that funds catastrophic fraud, or that consolidates value whose theft is a systemic event — sits on the other side of the line, where the harm of pure finality is large enough that some provenance and some controlled recoverability are justified, and where the value at stake pays for the heavier machinery those mechanisms require.
The design task is to build a system that behaves as bearer cash across the vast bulk of ordinary transfers, and that has governance capable of addressing the rare high-value defective transfer — without letting the second capability contaminate the first. That is hard. A recovery mechanism that is always available is not a bearer system at all. A recovery mechanism that is never available leaves the system unable to answer theft and fraud at scale. The whole craft is in the threshold: making finality the default and dominant behaviour, and recoverability a narrow, costly, governed exception triggered by value and defect rather than by routine.
Post-quantum cryptography does not resolve this tension. It changes the primitives underneath it while leaving the tension exactly where it was. But a post-quantum redesign is the moment the tension gets re-decided, whether the designers notice or not — because the migration touches signatures, key management, and recovery paths all at once. Doing it without confronting finality-versus-recoverability head-on means deciding it by default, and defaults in payment systems have a way of becoming permanent.
Layered resilience
Put the pieces together and a design principle emerges. Post-quantum digital cash should be built as layered resilience, not as a single quantum-resistant primitive doing all the work.
The layers are these. At the base, quantum-resistant cryptography — signatures and key agreement that no known quantum algorithm defeats, chosen with conservatism proportional to the value they protect, and with hash-based options where the security must rest on as little as possible. Above that, scalable low-cost verification — the property that keeps the instrument usable as cash, achieved through compact schemes, aggregation, and verification that does not force every participant to carry the whole system. Above that, low-value finality — the default bearer behaviour, irreversible and private, for the ordinary transfers that make up the overwhelming bulk of activity. Alongside it, privacy-preserving transfer — value that moves without broadcasting the parties, because cash is private and a payment system that surveils every transfer is not cash. And at the top, governance for high-value defective transfers — the narrow, costly, deliberately-bounded capability to address theft, fraud, and error at a scale where their absence is intolerable, triggered by value and defect and constrained so that it does not reach down and reverse ordinary payments.
No single layer is sufficient. Quantum-resistant primitives without cheap verification produce a secure system nobody can afford to use. Cheap verification without finality produces a fast system that is not cash. Finality without any governance produces a system that cannot answer catastrophic theft. Governance without strict bounds produces a reversible ledger wearing a cash mask. Resilience is the property of the stack, not of any one element — which is exactly the lesson the substitution fallacy misses.
What this means for real systems
The systems being built right now — central bank digital currencies, stablecoins, ledger-based bearer instruments, tokenised deposits — are all making these choices, mostly without naming them.
A central bank digital currency that swaps in post-quantum signatures but leaves its finality and privacy properties unexamined has upgraded the wrong layer. Its hardest questions — how final are transfers, how private, who can reverse them, at what value threshold — are governance and design questions that a lattice scheme does not answer. If it defaults to full reversibility and full surveillance, it is not digital cash; it is a database with quantum-resistant access control, and it should be honest about that.
A stablecoin or ledger-based bearer instrument faces the finality-versus-recoverability tension in its sharpest form. Its users want cash-like finality; its issuers and regulators want the ability to intervene in theft and fraud. Those wants conflict, and the design either resolves the conflict deliberately — finality by default, bounded recovery by exception, thresholded by value — or resolves it by accident, usually in the direction of whoever holds the keys to the mint. A post-quantum migration is precisely the moment to make that choice on purpose.
And any system that harvests today what it hopes to decrypt tomorrow — the harvest-now-decrypt-later concern — is exposed not to a date but to the cost frontier. Value that must stay confidential for decades is exposed if, within that horizon, the cost of breaking its protection drops below its value. That is a per-asset calculation against a descending cost curve, not a single doomsday. Long-lived, high-value confidential records are the assets to migrate first — not because a machine is imminent, but because their value keeps them exposed for longest as the frontier falls.
The real problem, named
Post-quantum cryptography is necessary. Nothing here argues against migrating away from factoring and discrete logs; the exposed public-key layer must be replaced, and the standards to do it exist.
But necessity is not sufficiency, and the substitution framing sells a sufficiency it does not deliver. Quantum-resistant primitives do not, by themselves, make digital cash usable, final, private, cheap to verify, or recoverable where recovery is warranted. Those properties are decided at the level of the payment system, and they are decided by confronting the questions the algorithm choice conveniently hides: how much does verification cost, how final is a transfer, how private, how much value sits behind a key, what is the cost of breaking it against the value it protects, and where does bearer finality yield to governed recoverability.
The quantum threat is best understood as an economic frontier, not a capability switch — a cost per broken key measured against a distribution of values at risk, tractable and updatable rather than prophetic. And a payment system built for that world is not a cipher with a new lock. It is a layered instrument: quantum-resistant at the base, cheap to verify, final by default, private in transfer, and governed at the edges — designed, deliberately, to remain bearer cash across the ordinary and to answer the catastrophic without ceasing to be cash.
That is the design problem. Post-quantum digital cash is not about swapping algorithms. It is about building money that survives a quantum world without forgetting what money is for.