This document presents the post-quantum safety analysis of the Logos Blockchain Bedrock layer. It identifies every quantum-vulnerable cryptographic component across the Bedrock stack, classifies the nature of each vulnerability under the same threat-model taxonomy used in the Blend Protocol analysis, and identifies the structural couplings between components that constrain any eventual migration. The concrete migration solutions — per-component replacements, phasing and sequencing, the per-block and per-transaction overhead analysis, and the selection of candidate post-quantum primitives — are out of scope here and are deferred to a separate migration strategy document and to the companion Post-Quantum Primitive Candidates for the Logos Bedrock Layer.
This document is a stack-wide extension of two prior analyses scoped specifically to the Blend Protocol:
The present document adopts the framework established in those two baseline documents and extends it to the rest of the Bedrock stack. We do not modify the threat-model taxonomy, the abstract-primitive versus concrete-instantiation framing, the NIST security category reference point, or the candidate primitives; the taxonomy is briefly restated in the next section to keep this document self-contained, but the Blend baseline documents remain the authoritative treatment for readers unfamiliar with the framework. We do, however, identify several structural differences between Bedrock proper and Blend that meaningfully change the migration calculus, and we discuss them explicitly throughout this document.
The scope below reflects the Bedrock and Blend protocol design as of July 2026; later protocol changes may add or remove surfaces, and this document is not re-versioned for every such change. The scope of this document includes:
provider_id / zk_id), and the locked-note collateral mechanism.The scope explicitly excludes the Blend Protocol itself, which is covered by the two baseline documents referenced above. The Blend leader branch of the Proof of Quota does interact with the Cryptarchia Proof of Leadership at a structural level — both depend on the same hash-based key derivation pattern and live on the same Groth16/BN254 proof system — and that coupling is treated as a first-class migration sequencing constraint in this document.
We adopt the threat-class taxonomy established in the Blend PQ Safety Analysis without modification, and restate it briefly to keep this document self-contained; the Blend baseline remains the authoritative treatment. In summary, the Blend analysis identifies two threat classes — retroactive Harvest-Now-Decrypt-Later (HNDL) against confidentiality primitives, already active today for any recording adversary, and real-time forgery against integrity primitives, active only once a CRQC exists — and classifies each Blend component accordingly, with the X25519 message encapsulation and the TLS key exchange as the HNDL surfaces and the signatures and proofs as forgery surfaces. The same taxonomy applies to Bedrock with the considerations below, which is where Bedrock structurally departs from Blend.
Retroactive attacks (Harvest Now, Decrypt Later — HNDL). An adversary records ciphertext today and decrypts it once a Cryptographically Relevant Quantum Computer (CRQC) becomes available. The threat applies exclusively to confidentiality primitives — key agreement, encryption, and ZK-for-confidentiality proofs. Where HNDL applies, the threat is already active: every day of delay increases the corpus of recorded traffic that a future quantum adversary can decrypt.
Real-time forgery (Future Forgery). An adversary with access to a CRQC at the time of protocol execution can forge signatures, fabricate ZK proofs, and impersonate parties. The threat applies to integrity and authentication primitives — digital signatures and ZK-for-integrity proofs. Recording signatures or proofs today provides no advantage to a future quantum adversary; the threat materializes only when CRQC capability is contemporaneous with protocol execution.
ZK-for-confidentiality versus ZK-for-integrity. A zero-knowledge proof’s threat class depends on its role within the protocol, not on the proof system in isolation. When a proof is used in a confidentiality role — as in Zcash-style shielded transactions, where the protected data (amounts, addresses) is the asset to keep secret — HNDL may apply, but the exposure comes from the associated encryption or commitment layer that carries that data, not from the proof: a perfectly/statistically zero-knowledge proof hides its witness information-theoretically and leaks nothing even to a quantum adversary. When a proof attests to authorization, ownership, or compliance, and the witness contains private keys or Merkle paths that are not themselves the confidential asset, it is an integrity primitive and only real-time forgery applies — a break of the proof’s computational soundness, not of its information-theoretic hiding.
The Blend analysis was dominated by the HNDL threat against its message-encapsulation key agreement: Blend’s entire purpose is network-level confidentiality, and its on-the-wire messages carry routing and payload data that must remain unrecoverable in perpetuity. The Bedrock-wide situation is structurally different in three ways, and these differences shape the entire migration narrative.