MetaMask / MetaMask/metamask-extension
Track Post-Quantum Cryptography readiness (secp256k1, EIP-8141, SPHINCS-)
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
What is this about?
France's ANSSI will stop certifying security products without post-quantum cryptography starting in 2027 - the first hard regulatory deadline of its kind globally. Additional mandates: US NSA CNSA 2.0 (2027), NIST IR 8547 (deprecation by 2030, disallowed by 2035), EU critical infrastructure (2030).
Summary
MetaMask's entire signing stack uses secp256k1 ECDSA, which is vulnerable to Shor's algorithm on a quantum computer. Every account that has ever sent a transaction has its public key exposed on-chain - a future quantum computer could derive the private key.
The Ethereum Foundation launched pq.ethereum.org in March 2026 with 10+ client teams running weekly PQ interop devnets. EIP-8141 (PQC account abstraction via Frame Transactions) is targeting the Hegota hard fork (H2 2026).
MetaMask has zero PQC tracking, awareness, or preparation.
What Needs Tracking
Near-term: EIP-8141 (Frame Transactions)
- Allows individual accounts to choose their own signature verification scheme
- Enables opt-in PQC without protocol-wide "flag day"
- Status: Considered for Inclusion in Hegota (H2 2026)
- MetaMask must support Frame Transactions (type 0x06) when this ships
Available Now: SPHINCS- Smart Contract Wallets
- Ethereum researchers demonstrated PQC wallet signatures via SPHINCS- at
~127,000 gas — implementable in Solidity without protocol changes - MetaMask Snaps support Custom EVM Accounts with ERC-4337
- A PQC Snap could implement quantum-safe signing today
Longer-term: Validator PQC (leanXMSS)
- Ethereum Foundation developing hash-based signatures to replace BLS12-381
- Timeline: full L1 protocol upgrades by ~2029
Scenario
No response
Design
No response
Technical Details
No response
Threat Modeling Framework
No response
Acceptance Criteria
No response
Stakeholder review needed before the work gets merged
- Engineering (needed in most cases)
- Design
- Product
- QA (automation tests are required to pass before merging PRs but not all changes are covered by automation tests - please review if QA is needed beyond automation tests)
- Security
- Legal
- Marketing
- Management (please specify)
- Other (please specify)
References
References
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository files, tests, implementation entry points, or acceptance criteria are identified. Start by reading the EIP-8141, pq.ethereum.org, and MetaMask Snaps Custom EVM Accounts references, then determine the required scope and measurable completion criteria for tracking or supporting post-quantum accounts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cryptography, typescript
- Domain
- blockchain, cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100