Project Eleven@projecteleven
Zcash just activated Ironwood.
Here’s why it matters for Zcash, and for post-quantum security.
There are at least two ways to prepare a blockchain for quantum computers. The first is to replace vulnerable cryptography with post-quantum alternatives. The second is to ensure that funds can survive the transition before those alternatives have even been selected.
With Ironwood, Zcash has taken a major step toward the second.
Zcash activated the Ironwood upgrade (NU6.3) at block 3,428,143, introducing a new shielded pool that reuses the existing Orchard protocol but maintains separate state. From a quantum security perspective, the defining feature is what Zcash calls “quantum recoverability”, specified in ZIP 2005 (a proposal under development since early 2025).
The supply integrity risk
Zcash's shielded pools depend on the hardness of computing discrete logarithms over elliptic curves. A cryptographically relevant quantum computer would break that assumption, and with it, more than just signatures.
If an attacker can compute discrete logs on Zcash's curves, the existing Sapling and Orchard note commitments are no longer binding against that attacker. Instead of committing to one fixed note, a commitment could be opened to alternative note contents.
This issue is often overlooked in quantum-migration planning. Even if Zcash later upgraded its proof system to a post-quantum one and rebuilt the commitment tree with a post-quantum hash, an attacker could still produce an alternative opening for a genuine commitment, effectively forging value inside the shielded pool. In an encrypted pool, that means the resulting inflation could be invisible.
Signatures and key exchange get most of the attention in quantum-migration planning, partly because they are covered by the NIST post-quantum standards. Commitment binding rarely appears on migration checklists, even though it is one of the properties that cannot simply be restored retroactively.
Make the note part of its own randomness
The actual fix is relatively small. For Orchard-pool notes, the commitment randomness rcm is derived only from rseed (a 32-byte random seed the sender picks) and ρ. For Ironwood notes, rcm is derived from rseed together with all of the note fields: g_d, pk_d, v, ρ, and Ψ. The note’s contents therefore become inputs to the randomness derivation itself.
That is what makes future recovery possible. Because rcm is now a hash of the note contents, a future recovery protocol can recompute the derivation from the recovered fields and check it against the onchain commitment, which proves the recovered note corresponds to a real note with fixed contents. Worth flagging: the Ironwood spend proof doesn't enforce this derivation today. The check only exists in a future, dedicated recovery statement which, ideally, never has to be written. That's also why the change adds essentially no cost to ordinary Zcash transactions today.
What Ironwood does not do
Quantum recoverability is not a post-quantum shielded protocol, and to Zcash's credit, nobody involved is claiming otherwise. It does not make current Orchard-protocol spends post-quantum secure, does not define the future recovery protocol in full, and does not choose a future post-quantum proof system or commitment tree.
We can think of it as a forward-compatibility patch. Not a full solution, but a decent placeholder. Funds created as recoverable notes will be usable by a later recovery protocol, without requiring Zcash to choose that protocol today.
Why this matters beyond Zcash
This design separates two decisions that are usually bundled together: protecting funds against a future emergency and choosing the eventual post-quantum stack. The first one no longer has to wait for the second. Proof systems, hash functions, and standards can take whatever time they need to mature.
At Project Eleven, we funded related work built on the same broader principle. The resulting post-quantum zero-knowledge proof allows a user to prove knowledge of wallet key material above a hardened derivation step and show that it derives to a particular address, without revealing the key material itself. Like Ironwood, it preserves a recovery path without requiring the final migration mechanism to be chosen in advance.
The cryptography is unlikely to be the hardest part. Blockchains still need to agree on a solution, implement it, test it, and deploy it through consensus. Zcash moved from an initial ZIP proposal to mainnet in roughly sixteen months. It is unclear which larger chains could match that pace, and every year spent debating the eventual post-quantum stack is one less year available to prepare for the migration.
