Bitcoin may go quantum-safe while Lightning privacy stays exposed

Research released on September 12 outlines a hybrid post‑quantum extension for the Lightning Network called PQLN. While the proposal shows how Bitcoin’s on‑chain outputs could eventually gain quantum‑resistance, five critical off‑chain components of Lightning would still require separate upgrades.

What PQLN Targets

PQLN is implemented as a rust‑lightning prototype and focuses on five Lightning surfaces:

• Gossip data that distributes node and channel information
• Encrypted peer connections
• Signed invoices and reusable payment offers
• Onion packets that hide routing details
• Privacy paths defined in BOLT‑12

The design retains existing secp256k1‑based ECDSA, Schnorr signatures and ECDH, adding ML‑DSA signatures for gossip, invoices and offers, and hybrid ML‑KEM key exchange for transport, payment onions and privacy paths.

Performance Impact

Testing with a feature‑gated rust‑lightning fork and a modified ldk‑sample node revealed significant bandwidth and storage overheads:

• Default ML‑DSA‑44 and ML‑KEM‑768 increased gossip download volume by 10.2× and stored graph data by 8.8× compared with vanilla Lightning.
• A Falcon‑derived FN‑DSA configuration reduced the download multiplier to 4.2×, though the scheme is still under development per NIST.
• Private payment routing added a fixed 21.8 KB ciphertext list, resulting in 19–53 ms extra latency per hop on a 10 Mbit/s link and 160–187 ms on a 1 Mbit/s link.
• ML‑DSA‑44 signing averaged 327 µs on a 16‑core AMD Ryzen Threadripper PRO 3955WX workstation.

Limitations and Open Questions

PQLN does not address Bitcoin‑layer risks. It leaves on‑chain keys that protect funding, commitment, HTLC outputs, and penalty transactions unchanged, meaning channel funds remain vulnerable without a broader Bitcoin post‑quantum upgrade.

The authors note that their prototype is a research artifact; compatibility tests with other Lightning implementations were not performed, and the results reflect static network synchronization rather than real‑world payment latency.

Implications

The study assumes a future quantum adversary and does not claim any current quantum compromise of Bitcoin or Lightning. It demonstrates that Lightning’s off‑chain cryptography can be explored independently of a Bitcoin upgrade, but also highlights the substantial operational costs that node operators would need to absorb.