Foundation documentation names every primitive with its mechanism, down to ciphersuite strings, object identifiers and encoding rules, and the interface specification is exhaustive about which schemes are and are not accepted at each surface. Subnet consensus, response certification, the random beacon, threshold canister signing, vetKD encrypted-key delivery, replica transport and user authentication are all inventoried and reproducible from public specs, source and live measurement. The one gap is that no ICP document names the hybrid X25519MLKEM768 group that its own transport configuration inherits.

Zero post-quantum families are in use on mainnet. Every consensus, threshold-signing, canister-signing, key-derivation and authentication primitive is classical elliptic-curve, pairing-based or RSA. One lattice KEM family (ML-KEM-768 per FIPS 203) is compiled into the replica through the rustls aws-lc-rs dependency and sits in the transport default group list at lowest preference, but it is not the negotiated group and no ICP document declares it, so it does not count as a deployed family.

The classical primitives map to legacy NIST strengths of roughly 128 bits pre-quantum, with SHA-224 principal derivation at 112 bits classically. No post-quantum security category is claimed or in use. FIPS 203 ML-KEM code is present in the replica through a dependency but is not the negotiated group. No FIPS 204 (ML-DSA) or FIPS 205 (SLH-DSA) primitive is deployed. FIPS 203, 204 and 205 were published 2024-08-13; FIPS 206 (FN-DSA, Falcon) is still in development and is not a finalized standard as of 2026-08-19, so no ICP primitive could target it.

The replica is implemented in Rust in dfinity/ic by an in-house cryptography group. The non-interactive DKG and resharing construction is published as IACR ePrint 2021/339; the threshold ECDSA protocol design and security analysis are published as IACR ePrint 2022/506 and 2021/1330, and the interface specification itself cites 2021/1330 for the BIP32 generalization used in key derivation. The elliptic-curve and pairing arithmetic comes from maintained third-party and first-party crates pinned in the lockfile: k256 0.13.4, ed25519-dalek 2.2.0, curve25519-dalek 4.1.3, p256 0.13.2, ic_bls12_381 0.10.1, aws-lc-rs 1.17.3. Constant-time behaviour is not independently verified here; the crates' own claims are the basis. No machine-checked implementation proofs of the threshold protocols are published, and we found no third-party cryptanalysis of the NIDKG construction beyond the design papers themselves. The classical curves in use have decades of public cryptanalysis behind them; the composed threshold constructions do not.

Self-authenticating principals are SHA-224 hashes of DER-encoded public keys, so an address alone does not reveal a key, but every signed ingress message reveals the public key, and any principal that has ever transacted is exposed. Internet Identity principals are anchored by canister signatures that verify against the subnet BLS12-381 public key, which is published in the state tree at /subnet/<subnet_id>/public_key, so those identities are exposed by construction. NNS root and subnet public keys, canister signature anchors and threshold public keys are all published. The controlling private keys for ckBTC, ckETH, ckERC20, ckSOL and ckDOGE are held in secret-shared form on chain-key subnets: breaking secp256k1 or Ed25519 recovers the outbound signing capability, and breaking BLS12-381 recovers the certification capability that authorises minter behaviour.

The earliest NNS proposal on the public record is proposal 3, dated 2021-05-06, so more than five years of balances exist, including genesis allocations, early unlock tranches and dormant Internet Identity anchors. Subnet BLS12-381 keys are long-lived and re-shared to new node sets rather than rotated to fresh public keys; the resharing protocol is documented as keeping the subnet public key unchanged while the shares change. The production secp256k1 threshold key key_1 was already addressable in a mainnet ckBTC minter initialisation argument in December 2022 and no rotation to a new public key is on record.

Subnet BLS12-381 threshold signatures sign blocks, certified state, query-response certificates, cross-subnet messages and canister signatures, and those signatures cover the long-term chain-key reserves. They are forgeable once BLS12-381 falls. Threshold ECDSA secp256k1 signatures already broadcast to Bitcoin and Ethereum, and threshold Schnorr signatures already broadcast to Bitcoin Taproot and Solana, are forgeable once the underlying curves fall, and their public keys are permanently on those external chains.

Replica peer-to-peer traffic runs over QUIC, whose handshake uses the replica's rustls configuration: TLS 1.3 only, cipher suites TLS_AES_256_GCM_SHA384 and TLS_AES_128_GCM_SHA256, Ed25519 node certificates. The key-exchange group list is left at the rustls aws-lc-rs default; because the prefer-post-quantum build feature is not enabled anywhere in the workspace or its rustls dependency graph, X25519 ranks first and hybrid X25519MLKEM768 ranks last, so peers negotiate classical X25519 and recorded traffic stays harvest-now-decrypt-later exposed. The public HTTPS gateways ic0.app and icp-api.io terminate TLS 1.3 with X25519 and an ECDSA secp384r1 certificate and reject a forced X25519MLKEM768 handshake with alert 40, measured 2026-08-19. vetKD encrypted-key delivery uses BLS12-381 G2 identity-based encryption, so every key it has transported on mainnet is harvest-now-decrypt-later exposed, and NNS Motion 35660 explicitly names ciphertext harvesting as a reason to start early.

Pseudonymous. ICRC-1 and ICRC-2 ledger transactions reveal sender and receiver principals on-chain. Internet Identity derives a distinct principal per application origin, which its own documentation describes as preventing cross-application tracking, but per-application on-ledger activity is fully linkable.

The live registry read on 2026-08-19 shows 42 subnets and 618 nodes assigned to them, out of 1,284 registered nodes held by 78 node providers. Subnet sizes are 7 nodes on three subnets, 13 on thirty-five, 34 on three (including the fiduciary chain-key subnet pzp6e) and 40 on the NNS subnet, so replica traffic inside a subnet is observable to between 7 and 40 operators. Per-subnet node-provider Nakamoto coefficients range from 3 to 12 with a median of 5, and per-subnet country Nakamoto coefficients range from 1 to 5. The topology moves: eight subnets were decommissioned by NNS proposals executed 2026-08-17 and the 42 figure already excludes them. API boundary nodes are upgraded through NNS proposals. No validator metadata-retention policy is published.

Chain-key tokens live on mainnet: ckBTC, ckETH, ckERC20 (documented examples ckUSDC, ckUSDT, ckLINK), ckSOL, and ckDOGE, which the documentation marks as in beta. ckBTC was in general community use by April 2023. Minter canisters hold the underlying assets at addresses they control through chain-key threshold signatures, with no private key held anywhere, and outbound EVM traffic runs through Chain Fusion JSON-RPC, so on-chain trails link ICP principals to Bitcoin, Ethereum, Solana and Dogecoin addresses.

Every signing primitive that anchors ICP identity is Shor-vulnerable. Recovering a subnet BLS12-381 key exposes every canister-signature-derived principal that subnet certified, so historical Internet Identity authentications can be re-attributed. vetKD-encrypted payloads are decryptable once BLS12-381 falls.

No on-chain mixer, cryptographic shuffle or mix network exists in the replica. vetKD provides application-layer encryption, not traffic-graph privacy.

NNS-governed proposals replace replica binaries subnet by subnet, and the mechanism runs continuously: of the 100 most recent NNS proposals, read 2026-08-19 and covering 2026-08-13 to 2026-08-19, 79 are version-deployment items (32 subnet replica-version updates, 24 HostOS version settings, 19 API boundary node version updates and 4 version elections), and the remainder includes eight executed subnet decommissionings, Internet Identity and registry canister upgrades, a node-provider removal and a ckERC20 token addition. Thirty-seven of the 42 subnets carry more than 100 historical replica-version entries, with a median of 241. The cryptographic stack is modular at Rust crate boundaries. Shipped cryptographic additions: production BIP-340 secp256k1 and Ed25519 threshold keys generated under NNS proposal 131474 executed 2024-08-05; vetKD test key Bls12_381_G2:test_key_1 under NNS proposal 136589 executed 2025-05-13, followed by the staged production key Bls12_381_G2:key_1 on the fiduciary subnet from 2025-06-20 with backup and public enablement by 2025-06-27; and chain-key signing throughput parameters raised in February 2026 (NNS proposal 140289 executed 2026-02-12 raised the advance pre-signature count from 5 to 100 on subnet pzp6e, with expected throughput of 3.5 signatures per second for threshold ECDSA, 6.5 for threshold Schnorr and 18 for vetKeys announced on 2026-02-25). Two shipped agility hooks reference or enable a future post-quantum transition without using one: the ic-hpke crate embeds explicit protocol and version identifiers so the scheme can be rotated later, though its own KEM is ECDH P-384 and a repository-wide search finds no consumer of the crate outside its own manifests, the workspace member list and CODEOWNERS; and the replica's TLS configuration inherits a key-exchange group list that already contains hybrid X25519MLKEM768, so promoting it would be a build-flag change rather than new cryptography. Against that, no mainnet algorithm swap has ever been demonstrated, and the December 2024 crypto-agility statement by DFINITY's cryptography lead is no longer retrievable at its original location.

Every canister is a smart-contract account with native key management, and the reverse-gas model means most calls need no user-held wallet key at all. The Internet Identity specification defines add, remove and replace device operations, and authn_method_add, authn_method_remove and authn_method_replace in its V2 API, so passkey rotation on an existing anchor is a first-class operation. Authentication methods are WebAuthn passkeys, PIN or temporary key, and recovery phrase or recovery device, with OpenID Connect federation to Google, Apple and Microsoft. The specification gives Ed25519 and ECDSA as session-key examples rather than fixing an exhaustive list. No client-layer post-quantum signing path is published.

NNS-coordinated replica upgrades have run since the network's earliest proposals, dated 2021-05-06, and continue daily; eight subnets were decommissioned by executed proposals in a single day on 2026-08-17 without incident on the public record. Coordinated cryptographic additions with dated on-chain governance records include the production threshold Schnorr keys (proposal 131474, executed 2024-08-05), the vetKD test key (proposal 136589, executed 2025-05-13) and the staged vetKD production key in June 2025, each announced in advance with a published schedule and, where the key backup required it, a stated Internet Identity downtime window of 5 to 10 minutes. No contested chain split is on the public record.

No hybrid post-quantum envelope is published at the subnet-consensus, threshold-signing, vetKD or Internet Identity layer. NNS Motion 35660 committed DFINITY to post-quantum research and lists open research questions, including determining the versatility, efficiency and cryptanalytic resilience of post-quantum primitives, selecting security parameters, and evaluating both lattice-based and hash-based signature candidates, but specifies no hybrid migration architecture and no dates. A September 2025 forum post by a non-staff community member claims a third-party hybrid layer 2 on ICP combining classical ECDSA and Schnorr with ML-DSA-44 and SLH-DSA-SHA2-128f for signatures and ML-KEM-768 for encryption; the claim is the author's own, drew no foundation reply, and the implementation is unverified.

ICP deploys no stateful hash-based signature primitive. A code search of dfinity/ic on 2026-08-19 returns zero hits for XMSS, and the repository lockfile contains no XMSS, LMS, SLH-DSA or SPHINCS+ crate of any kind. Default 15 of 15 for stateless schemes.

Subnet consensus, response certification, cross-subnet message authentication and the random beacon all aggregate BLS12-381 threshold shares produced by the NIDKG construction. No specification, testnet or mainnet pilot of a post-quantum aggregation path has been published. A community forum request opened 2026-08-14, setting out seven specific questions about migrating threshold BLS and the BLS-based random beacon, including whether a hybrid or dual-signature period is planned and how the root and subnet public keys would rotate without a fork, had six replies as of a re-read on 2026-08-19 and none from a DFINITY-affiliated account. On 2026-08-15 the founder amplified without dissent a quoted claim that an aggressive post-quantum transition by 2029 would be a mistake, which weakens the active-research reading that previously held this score above the undeclared floor. NNS Motion 35660, never rescinded, keeps it marginally above zero. Flagged consensus-layer-exposed under the standing-exposure clause: subnet BLS12-381 public keys are long-lived and published, so fast finality is no defence at the consensus layer.

Mainnet post-quantum traffic is 0%. No post-quantum primitive signs subnet blocks, certified state, NNS proposals, threshold canister signatures, vetKD key transport or Internet Identity authentications. At the transport layer the hybrid X25519MLKEM768 group is present in the replica's inherited default group list but ranks below X25519 on both peers, so it is not the negotiated group, and the public HTTPS gateways reject it outright, measured 2026-08-19.

No first-party post-quantum implementation exists. A dfinity/ic code search on 2026-08-19 returns zero hits for ml-dsa, ML_DSA, kyber, dilithium, sphincs, SLH-DSA, falcon, ml-kem, mlkem and XMSS; searching the phrase post-quantum returns a single hit, a design comment in packages/ic-hpke/src/lib.rs stating that the crate's protocol and version identifiers exist so the algorithm can be rotated later, for example to a post-quantum scheme. That crate's own construction is classical HPKE with ECDH P-384, HKDF-SHA-384 and AES-GCM-256, it was added on 2025-03-03, and its last change on 2026-07-20 was a dependency migration that left the comment intact. Post-quantum code does nevertheless reach the shipped replica through a dependency: the TLS stack links aws-lc-rs 1.17.3 through rustls 0.23.37, whose aws-lc-rs default key-exchange group list includes hybrid X25519MLKEM768 (ML-KEM-768 per FIPS 203) in every build configuration, and the replica's TLS configuration, which the peer-to-peer QUIC transport also consumes, overrides only the cipher suites and leaves that list in place. We audited the whole rustls dependency graph and confirmed no manifest enables the prefer-post-quantum feature, so the group stays at lowest preference. The score reflects post-quantum KEM code present in the consensus client binary, unpreferred and undeclared, with no first-party post-quantum signature or KEM implementation anywhere.

No replica holds a post-quantum key. Subnet threshold keys are BLS12-381, secp256k1 and Ed25519 only, and node TLS identity certificates are Ed25519. The ML-KEM-768 material in the transport stack is ephemeral key-exchange material, not a registered or stored key, and it is not negotiated.

Voided to 0 because 5a is 0. The standing dated commitment is NNS Motion 35660, executed 2021-12-21, adopted as a long-term research objective with open research questions and named discussion leads but no completion date. A December 2024 crypto-agility statement by DFINITY's cryptography lead is cited second-hand in a later community thread as saying replacement algorithms would be proposed to the NNS at the appropriate time and that the network public key would have to change; its original forum location returns an access-denied response on re-check at 2026-08-19. No NNS proposal carries a hard-coded activation epoch, flag day, or sunset date for BLS12-381, secp256k1 or Ed25519.

No foundation-authored post-quantum announcement appears in the trailing 12 months. The February 2026 chain-key throughput work is foundation-authored but entirely classical and makes no post-quantum claim, and the only founder-level public statement on the topic, 2026-08-15, argues against a near-term transition, which is the inverse of washing. A forum search across the trailing 12 months returns five post-quantum items, all third-party and none with a foundation reply: a September 2025 hybrid post-quantum layer 2 post, a December 2025 recruitment post for a canister-level post-quantum verification and policy engine, a March 2026 application post claiming client-side Kyber-1024 encryption, a May 2026 canister-user threshold-signing thread whose author reports secp256k1 ECDSA working today and the MAYO signature scheme tested on a replica subnet, and a July 2026 application post claiming ML-KEM-768 keypair generation in a browser library. Post-quantum bytes shipped to mainnet by the foundation: none. No deduction trigger.

No post-quantum signature scheme is selected or specified for ICP consensus, threshold signing, vetKD or Internet Identity, so no signature-size multiplier can be computed. Score 0 per rubric for undisclosed.

Wallet and identity surfaces we verified live on 2026-08-19: Internet Identity, DFINITY-operated, WebAuthn passkeys plus PIN and recovery methods with OpenID Connect federation to Google, Apple and Microsoft, now served at id.ai after the legacy internetcomputer.org path began redirecting there; Plug Wallet; and NFID Wallet. Ledger hardware wallets list ICP support through Ledger Live, with the device application maintained in the open by Zondax for Nano S+, Nano X, Flex, Stax and Apex P. None of these surfaces publishes a post-quantum roadmap, and none names a post-quantum key type. No public source ranks ICP wallets by usage, so we make no ranking claim.

The chain-key token set on mainnet is ckBTC, ckETH, ckERC20 (documented examples ckUSDC, ckUSDT, ckLINK), ckSOL, and ckDOGE in beta. All of them rest on the same threshold ECDSA secp256k1, threshold Schnorr BIP-340 and Ed25519, and subnet BLS12-381 stack, so the exposure is single-family across the whole set. The tile sits above the floor only because the minter canisters are first-party and are changed through NNS proposals, a mechanism exercised in the observed proposal window by an executed ckERC20 token addition, which is a working change mechanism, not a declared migration plan. No post-quantum roadmap is published for any of them.

No named institutional custodian's ICP support is established by a primary source as of 2026-08-19: the supported-asset listings either did not resolve or required authentication. The only custody-adjacent surface we verified is the Ledger hardware wallet path described in 6a. No ICP-specific post-quantum migration roadmap was found from any custody vendor. The tile therefore rests on an unrebutted negative finding rather than on a verified vendor set, and it is scored at the floor accordingly.

Public HTTPS gateways ic0.app, icp-api.io and internetcomputer.org terminate TLS 1.3 with the X25519 group, TLS_AES_256_GCM_SHA384, and ECDSA secp384r1 or secp256r1 server certificates, and they reject a forced X25519MLKEM768 handshake with alert 40, measured 2026-08-19: no hybrid post-quantum KEM is offered to clients. API boundary nodes are registered on-chain and upgraded through NNS proposals. On the trusted-hardware side, two of the 42 subnets run with AMD SEV enabled per the live registry, one of them carrying the confidential specialization, and a node-swap program to move further subnets onto SEV-enabled hardware was running in the observed proposal window at wave 6. Confidential computing is therefore deployed and expanding, but it sits on a small minority of subnets and it does nothing for post-quantum exposure. We found no published information about hardware security module vendors used by node providers and make no claim about them.

Live registry, 2026-08-19: 42 subnets, 618 nodes assigned to subnets out of 1,284 registered, held by 78 node providers with node-provider Nakamoto coefficients per subnet ranging from 3 to 12, median 5. Subnet sizes are 7, 13, 34 and 40 nodes. The largest single entity is DFINITY Stiftung with 59 directly operated nodes, 42 of them rewardable, present in 39 subnets, plus 1,325 cloud-engine nodes of which 1,251 are unassigned. Several independent providers cluster at 42 and 37 nodes each. Governance authorship is more concentrated than node counts suggest: of the 100 most recent NNS proposals, read 2026-08-19 and covering 2026-08-13 to 2026-08-19, 95 carry the DFINITY-proposer flag. Node-provider admission and removal both run through NNS proposals.

NNS proposals execute daily, and replica binaries roll subnet by subnet without downtime. Major cryptographic key operations have shipped on published schedules with advance notice, including the staged vetKD production rollout of June 2025, which named the generation, backup and enablement dates and disclosed the 5 to 10 minute Internet Identity downtime the backup required, and the August 2024 threshold Schnorr production-key generation, which disclosed a 6 to 10 minute window on the same subnet. Strong operational record under non-emergency conditions; no emergency cryptographic rollback is on record to test the other case.

NNS Motion 35660 names Jens Groth and Andrea Cerulli as the post-quantum discussion leads, and we found no newer naming. There is no publicly named, mandated post-quantum migration program manager and no quarterly deliverable schedule. The December 2024 crypto-agility statement that previously supported this score is no longer retrievable at its original forum location and survives only as a second-hand summary. A 2026-08-15 post from the founder's account shared a claim that an aggressive post-quantum transition by 2029 would be a mistake, and drew same-day public pushback from a named community developer, and the 2026-08-14 request for a concrete threshold-BLS migration plan had no foundation reply through 2026-08-19. The top coordination authority is currently arguing against near-term migration rather than leading one.

Proposals are genuinely contested rather than rubber-stamped: of the 100 most recent NNS proposals, read 2026-08-19, five drew a no-vote share above 2% of voting power, the highest at 24% on a service-nervous-system creation, and node-provider removal is itself a proposal type in that window. But there is no precedent of a coordinated cryptographic primitive change under active adversarial pressure. The closest operational precedent is the NIDKG resharing protocol that lets subnet membership change without changing the subnet public key, plus the key-backup resharing that the threshold Schnorr and vetKD production rollouts required.

No community honeypot, no rate-limited spending rule, no cryptographic tripwire embedded in subnet consensus, no automated post-quantum event response. A community participant raised a compliance-driven tripwire argument in the August 2026 forum thread; it drew no foundation response and is not a mechanism.