Blog

Notes and research from the Applied PQC project.

• Post-quantum Privacy Pass: anonymous credentials from UOV and VOLE-in-the-head

  Privacy Pass tokens stay private after Q-day but become forgeable. Cloudflare Research's replacements build on UOV and VOLE-in-the-head: PoMFRIT, VOLE-IHAT and VOLE-ACT, at 4 to 12 KB per token and milliseconds per step.

  Post2026-11-08

• NIST IR 8547, from draft to final: what changed in the transition schedule

  NIST's final transition report keeps 2030 and 2035 but deprecates quantum-vulnerable public-key cryptography at every key size, builds in the federal 2030 and 2031 deadlines, and names ML-KEM-768 as the default. What changed from the 2024 draft, sentence by sentence.

  Post2026-10-28

• The construction of SHRINCS, a semi-stateful hash-based signature scheme

  SHRINCS demotes SLH-DSA to a fallback path and puts a 548-byte stateful signature on the primary one. What the draft reuses from FIPS 205, what it only reparameterises, what it constructs anew, and what it gives up.

  Post2026-08-28

• Post-quantum migration for Bitcoin layer 2s

  A Bitcoin layer 2 settles to a base layer it cannot change, borrows consensus from a third ecosystem, and runs a bridge whose trust root is cryptography of its own choosing. Where the post-quantum exposure actually sits, and who can fix each part.

  Post2026-07-31

Nothing matches that.