From SHRINCS to SHRIMPS
SHRINCS solved signature size — but only for one device
RECAP: SHRINCS (MARCH 2026)
Blockstream Research deployed ~324-byte stateful PQ signatures on Liquid via Simplicity. Hash-based, using Unbalanced XMSS (a Merkle tree of one-time signatures). First live PQ-signed transactions on a Bitcoin sidechain. See March slides.
THE SINGLE-DEVICE PROBLEM
Stateful signing means tracking which one-time keys have been used. If two devices share the same seed but independently track state, they may reuse a one-time key — catastrophically breaking security. SHRINCS is strictly single-device. That's a dealbreaker for most Bitcoin users who sign across hardware wallet + phone + desktop.
324 B
SHRINCS sig size
1
Device only
Hash
Security assumption
SHRIMPS
Multi-device stateful PQ signatures — 2.5 KB, any device from the same seed
WHAT THE DELVING POST SHOWS (MARCH 27)
SHRIMPS extends the SHRINCS family to support multiple devices loaded from the same seed. With a conservative bound of 1,024 device initializations, the compact path yields ~2,564-byte signatures at 128-bit security — about 3× smaller than SLH-DSA.
HOW IT WORKS
SHRIMPS combines two SPHINCS+ instances under one public key: a compact instance sized for a bounded number of device initializations, and a large fallback instance. A newly initialized device can use the compact path, while later signatures can fall back safely without any cross-device coordination.
WHY ~2.5 KB
Bitcoin keys usually sign only a small number of times. With
n_dev = 2^10 and one compact-path signature per device, SHRIMPS stays around 2.5 KB while still supporting many backup and secondary devices from the same seed.HASH-ONLY SECURITY
Like SHRINCS, SHRIMPS relies only on hash function security — the same assumption Bitcoin already depends on. No new cryptographic hardness assumptions (unlike lattice-based schemes). The most conservative PQ approach possible.
PQ Signature Landscape
| Scheme | Sig Size | Multi-Device | Assumption |
|---|---|---|---|
| ECDSA (current) | 72 B | Yes (stateless) | ECDLP (not PQ) |
| SHRINCS | 324 B | No | Hash |
| SHRIMPS | ~2,564 B | Yes | Hash |
| ML-DSA (Dilithium) | 2,420 B | Yes (stateless) | Lattice |
| FN-DSA (FALCON) | 666 B | Yes (stateless) | Lattice |
| SLH-DSA (SPHINCS+) | 7,856 B | Yes (stateless) | Hash |
VS ML-DSA
Similar size (~2.5 KB vs ~2.4 KB) but SHRIMPS uses hash-only assumptions. ML-DSA relies on lattice hardness — newer and less battle-tested. SHRIMPS is the conservative choice.
VS SLH-DSA
SLH-DSA is NIST's hash-based standard at ~7.8 KB. SHRIMPS achieves 3× smaller sigs by being stateful. The tradeoff: you must track signing state (but get multi-device support).
What This Means
SHRINCS SOLVED SIZE, SHRIMPS SOLVES USABILITY
324-byte PQ sigs are remarkable but single-device is impractical. SHRIMPS at 2.5 KB enables the same seed across hardware wallet + phone + desktop — the way Bitcoiners actually use wallets.
LIQUID AS TESTBED
SHRINCS is already live on Liquid via Simplicity. SHRIMPS could follow the same path — production testing before any Bitcoin consensus change. Jonas Nick is presenting
OP_SHRINCSVERIFY at OPNEXT on April 16.EARLY DAYS
Jonas Nick published a detailed Delving Bitcoin writeup on March 27 covering the construction, parameter choices, and example sizes. A formal paper may still follow, but the mechanism above now comes from that post rather than inference from a tweet.