Prototype adds post-quantum to Lightning, raises gossip load

Researchers published a preprint in September 2026 describing PQLN, a rust-lightning research prototype that adds hybrid post-quantum signatures and key encapsulation to Lightning off-chain functions.

The prototype is implemented as a feature-gated fork of rust-lightning and a modified ldk-sample node. It retains secp256k1-based ECDSA, Schnorr and ECDH and layers hybrid primitives on top: ML-DSA signatures for gossip, invoices and reusable offers, and ML-KEM key exchange for transport, onion packets and BOLT 12 privacy paths. The project targets gossip distribution, encrypted peer links, signed invoices and onion routing.

The team ran a 12-scenario test matrix to assess coexistence of hybrid and vanilla binaries, behavior on route failures and protection choices. The repositories are labeled research artifacts and interoperability tests against other Lightning implementations were deferred.

Measured overhead was driven by communication costs rather than raw cryptographic computation. With the default ML-DSA-44 and ML-KEM-768 settings, static synchronization of a full network graph required 10.2 times more gossip downloads and increased stored graph data by 8.8 times compared with vanilla Lightning. A smaller Falcon-derived FN-DSA configuration reduced the download multiple to 4.2, but that scheme remains listed by NIST as under development.

Private payment routing added a fixed 21.8-kilobyte list of post-quantum ciphertexts per hop. On an emulated 10 Mbit/s link the addition increased per-hop latency by about 19 to 53 milliseconds; on a 1 Mbit/s link it increased per-hop latency by roughly 160 to 187 milliseconds. ML-DSA-44 signing averaged about 327 microseconds on the authors’ 16-core AMD Ryzen Threadripper PRO 3955WX workstation with 64 GB of RAM; the paper notes this as a hardware-specific primitive measurement rather than an end-to-end latency figure.

Compatibility tests showed post-quantum and vanilla binaries built from the same rust-lightning base can coexist. Mixed setups sometimes defaulted to classical protection or failed closed depending on route and settings. The study did not establish network-wide readiness for a hybrid deployment.

PQLN does not change Bitcoin-layer on-chain keys that protect funding transactions, commitment and HTLC outputs or penalty transactions. As a result, channel funds would remain exposed unless Bitcoin on-chain key material is migrated to post-quantum-safe algorithms. The preprint frames the work as preparation for a future quantum-capable adversary and reports no present-day quantum compromise of Bitcoin or Lightning.

The authors describe operational trade-offs for node operators, including higher gossip volume, larger stored graphs and increased payment traffic. Their experiments document those costs across the tested configurations.