The NaoX Signature: NIST's Highest Post-Quantum Level
Every transaction, every validator and every block on a blockchain comes down to a signature. It is also the one thing a quantum computer will be able to forge.
NaoX signs with ML-DSA-87, the highest security level in NIST's post-quantum signature standard. This issue explains what that means in plain English, why we chose it, what it costs, and why the past week made that choice more relevant than ever.
What Is a Digital Signature, and Why Can a Quantum Computer Forge It?
A digital signature proves that whoever holds a private key authorised a message. Anyone can check it using the matching public key, and nobody can fake it without the private key.
Bitcoin and Ethereum sign with elliptic curve cryptography. Its security rests on one assumption: that working backwards from a public key to the private key is practically impossible.
For classical computers, it is. For a large enough quantum computer running Shor's algorithm, it is not. Whoever derives your private key can sign as you, and the network cannot tell the difference.
Hash functions are far less exposed, because the best known quantum attack on them only offers a square-root speed-up. That is why signatures, not hashing, are the weak point of every classical blockchain.
What Did NIST Standardise?
In August 2024 NIST published its first three post-quantum standards. FIPS 203 covers ML-KEM, for agreeing keys. FIPS 204 covers ML-DSA, for signatures. FIPS 205 covers SLH-DSA, a hash-based signature scheme. A fourth, FN-DSA, based on Falcon, follows.
ML-DSA is NIST's primary signature standard. It is built on lattices: the hard problem is finding a hidden point in a grid with hundreds of dimensions. No known quantum algorithm solves that efficiently.
NIST's Five Security Levels, in Plain English
NIST grades post-quantum schemes on five security levels. Each level is benchmarked against the effort needed to break a well-known classical standard.
Level 1 is at least as hard to break as AES-128. Level 3 matches AES-192. Level 5 matches AES-256, the encryption governments use for their most sensitive data.
ML-DSA comes in three sizes. ML-DSA-44 sits at Level 2, ML-DSA-65 at Level 3, and ML-DSA-87 at Level 5. Think of it as the same lock design made in three thicknesses. ML-DSA-87 is the thickest.
Why NaoX Chose Level 5
The first reason is permanence. A blockchain never forgets. Every signature and public key stays on the public ledger for good, so anything signed today has to hold up for decades, against machines and mathematics that do not exist yet.
The second is that attacks only get better. In July, HAWK, a lattice-based candidate in NIST's follow-on signature competition, was broken with AI-assisted cryptanalysis in about sixty hours and withdrawn. ML-DSA is a different construction and is unaffected, but it was a clear reminder that security margins matter.
The third is that the margin is affordable where it counts. One ML-DSA-87 verification takes around 38.5 microseconds on NaoX, roughly 26,000 per second on a single core. Speed is not the trade-off. Size is.
What Level 5 Costs
An ML-DSA-87 signature is 4,627 bytes, around seventy times a classical 64-byte signature. Its public key is 2,592 bytes, against 33 bytes on Bitcoin and Ethereum today.
Moving up from ML-DSA-65 adds roughly 1,300 bytes to every signature. On a chain retrofitting post-quantum, that is a painful number. On a chain designed around it from genesis, block space, fees and propagation were planned with it from the start.
That is the real difference Level 5 makes: it is a design decision, not a setting you can quietly turn up later.
The Standards Just Moved Again
On 21 September, NIST moved every remaining FIPS 140-2 certificate to historical status. New US federal systems now have to specify modules validated under FIPS 140-3, the newer standard.
Next, from 1 January 2027, every new acquisition for a US national security system has to support the NSA's CNSA 2.0 algorithms. For signatures, CNSA 2.0 allows one option: ML-DSA-87.
The NSA looked at the three sizes of ML-DSA and picked the largest. NaoX signing uses that same parameter set.
To be precise about the boundary, that is a statement about the algorithm and its security level, not a certification. CNSA 2.0 and FIPS 140-3 apply to specific validated products, and we do not claim either.
What It Means for Users, Developers and Validators
For users, nothing changes in how the chain feels. Post-quantum keys are derived from the same twelve recovery words, and the same wallets and habits carry over.
For developers, Solidity, Hardhat, Foundry, ethers and MetaMask work as they always have, and Go development is supported. Level 5 lives underneath, in the protocol, not in anyone's contract.
For validators, the door has been Level 5 since genesis. NaoX's validator registry only accepts a public key of exactly 2,592 bytes, the size of an ML-DSA-87 key.
The Signature Is the Foundation
Ownership, finality, history: everything a blockchain promises comes back to whether a signature can be trusted. Choose it carefully, and everything built on top inherits that strength.
2026 continues to be the great quantum awakening. Standards are being enforced, deadlines are turning into procurement rules, and the investment and innovation behind quantum computing keep accelerating. The signatures being chosen today are the ones that will have to hold when the machine arrives.
FAQs
About NaoX Protocol
NaoX is a post-quantum Layer 1 blockchain and decentralised infrastructure protocol designed to secure digital assets, applications and systems across the decentralised stack.
Built with NIST-standardised post-quantum cryptography and full EVM compatibility, NaoX enables transactions to be signed with FIPS 204 at Security Level 5 while existing tools, contracts and developer workflows continue to work unchanged.
By extending post-quantum security across both Web3 and connected Web2 environments, NaoX is building the infrastructure required for a more resilient digital future.
