Debate continues over hash-based versus lattice-based signatures

The discussion touched on the ongoing debate in the blockchain community regarding the choice between hash-based and lattice-based signatures for post-quantum migration. While the broader internet has largely adopted lattice-based systems, Bitcoin and Ethereum communities are divided. Proponents of hash-based signatures argue they are more secure because the framework remains sound even if a specific hash function is broken, allowing for easy substitution. Additionally, using hash-based signatures avoids adding new assumptions to blockchains that already rely on hashes for Merkle trees. However, Dan Boneh noted that lattice-based systems offer superior properties, such as threshold signatures and non-hardened key derivation, which are absent in hash-based schemes. He expressed concern that moving exclusively to hash-based signatures would constrain cryptographic capabilities. The experts also noted that many internet connections already use hybrid encryption, combining elliptic curves and lattices, providing a backup if one system is compromised. Dan Boneh expressed a preference for lattice-based schemes due to their richer algebraic properties, while acknowledging the security arguments for hash-based systems in the blockchain context.