PQLN: Post-Quantum Security for the Bitcoin Lightning Network's Off-Chain Surfaces

The discourse on the proposed enhancements to the gossip protocol in decentralized networks sheds light on several critical points, primarily focusing on improving efficiency and security. The current gossip protocol is described as fragile due to its lack of extensibility for new channel types like Taproot Channels. An ongoing initiative aims to overhaul this protocol to address existing issues and facilitate the integration of new channel advertisement methods, which can be observed in the efforts documented here.

A notable suggestion within the discussion involves a transition period where new, revamped gossip messages would support both classical and Post-Quantum (PQ) cryptographic signatures. This hybrid approach ensures that nodes unfamiliar with PQ signatures can still verify message integrity using classical signatures. However, concerns are raised about the increased bandwidth overhead, with predictions of up to a 19-fold increase in steady-state bandwidth usage due to inefficiencies in the current protocol's inventory reconciliation process.

Further into the technological specifics, the dialogue transitions into an examination of cryptographic systems used across different layers within the network. A diverse set of cryptosystems, including ML-KEM, ML-DSA, FN-DSA-512, and SLH-DSA, are discussed for their potential to enhance security. The conversation critiques certain limitations within BOLT-11 and suggests considering BOLT-12’s serialization format, which offers improvements such as removing size limits on tagged fields and supporting pubkey recovery modes, albeit with minimal space savings.

Moreover, any upgrades involving Post-Quantum cryptography would need to address complexities in blinded paths—essential for maintaining privacy in transaction routing—potentially leading to larger QR code sizes necessary for encoding these paths. The technical discourse also touches upon the necessity of maintaining unlinkability in packet formats to ensure security and privacy, referencing the KEM Sphinx paper for possible solutions that could align performance with classical Sphinx implementations.

Finally, the correspondence advocates for starting enhancements at the transport layer by adopting a hybrid model that incorporates PQ cryptography within the existing classical framework, rather than completely shifting to PQ Noise. This approach suggests a gradual transition facilitated by dual-signing mechanisms allowing nodes to operate under both new and old identity verifications. Additionally, access to secure, vetted libraries for implementing ML-KEM, notably supported in Go 1.26.1, is highlighted as a crucial factor in advancing these upgrades.