Cryptography

Every signature in Spek is SQIsign, an isogeny-based post-quantum scheme, and every hash is BLAKE3. Two facts qualify everything on this page.

Why SQIsign, and what if it fails

SQIsign is one of nine candidates NIST advanced to Round 3 of its additional digital-signature process in May 2026. That round is expected to last about two years, a draft standard could not appear before about 2028, and SQIsign may be dropped. "Level I" and "Level V" name the security categories its parameters target, comparable to AES-128 and AES-256 key search, not any NIST approval.

Spek chose SQIsign over the standardised ML-DSA for its size: a 200-byte signature and an 83-byte key, against roughly 2.4 KB and 1.3 KB. The trade-off is that SQIsign's security rests on a younger assumption, the supersingular endomorphism-ring problem, with less cryptanalytic history than lattices, and on a reference implementation that was not built for production.

If later cryptanalysis weakens SQIsign, or NIST drops it, the only remedy is a migration to another signature scheme through a hard fork, and every operator chooses for themselves whether to adopt it. Mining keys rotate with every horizon, so moving block headers to a new scheme phases in as horizons expire, with no coin moves.

Level I and Level V

Signing a Level I header takes 25–40 ms, once per slot for a miner. There is no ECDSA, no Schnorr and no elliptic-curve library linked into the signature code, and a test on the dependency graph keeps it that way.

Keys hidden until spent

The default output hides even the public key. A hashed output is 34 bytes: a witness version and a 32-byte program, which is a tagged BLAKE3 hash of the key and its script commitment. The key appears on chain only when the output is spent. Wallets use this form for every receive, change and coinbase address. The one exception is a stake key, which every header it signs makes public; the payout rule keeps one stake unit at that address.

ScriptCommit instead of Taproot tweaks

Taproot hides a script tree by tweaking an elliptic-curve key. Isogeny keys cannot be tweaked that way, so Spek's analogue, ScriptCommit, commits to the script tree with a hash instead. A key-path spend reveals the key and commitment next to one signature; a script-path spend reveals the leaf, its Merkle proof and a control block, and the node recomputes the commitment and the program before running the leaf. Multisig, timelocks, hash locks and atomic swaps are expressible; key aggregation is not. An output that wants its key visible can use the plain ScriptCommit form, 118 bytes.

Addresses

Addresses are Bech32m with the prefix spek. Witness version 1 carries a 32-byte hashed program (Level I) or the 115-byte plain program, and version 2 a 32-byte Level V program. Decoding re-encodes and requires a byte-exact match, so each output script has exactly one lowercase address string. There is no pay-to-pubkey form.

Slot secrets from BLAKE3 alone

The election needs a per-slot value that is secret until used, unique per height and committed before the beacon exists. No deployable post-quantum VRF exists, so Spek builds it from BLAKE3 hash chains (see Slot election). The slot seed is independent of the signing key, so recovering a SQIsign secret key reveals nothing about future slot secrets. Every consensus hash is domain-separated by a tag string.

The migration path

There is no per-transaction menu of algorithms and no runtime negotiation: at any height exactly one scheme is valid for a given output form or header version, which closes downgrade and algorithm-confusion attacks. The witness version selects the output scheme (1 for Level I, 2 for Level V, 3–16 reserved), and the block version selects the header scheme through a height-indexed upgrade schedule. Because each signature commits to the locking script of every output it spends, a signature made for one scheme can never be reinterpreted under another.