Ethereum consensus P2P inventory maps post-quantum ENR and TLS changes

On October 27, 2026, @adust09 of Nyx Foundation posted an Ethereum Research inventory of the consensus-layer (CL) networking keys and handshakes that need post-quantum (PQ) replacements. Client and libp2p developers should know that swapping validator BLS signatures for leanXMSS leaves ENRs, Discovery v5, libp2p Peer IDs and QUIC/TLS on classical cryptography, and they should start mapping those code paths now.

What the inventory found

The post says that Ethereum CL networking "has no adopted post-quantum migration profile." It splits the work into three linked targets:

1. Discovery: ENR signatures, Discovery identity proofs and Discovery key exchange.
2. Connection key exchange: TLS 1.3 key agreement inside QUIC.
3. Connection authentication: the libp2p TLS identity binding and the TLS CertificateVerify message.

The post's inventory lists six places that use classical schemes today:

The hardest problem is size. EIP-778 defines an ENR as an RLP list of [signature, seq, k, v, ...] with a maximum encoded size of 300 bytes. Its v4 identity scheme uses a 64-byte secp256k1 signature over the keccak256 hash of the content. The post compares these limits with ML-DSA-44, which it uses as an example, not as a choice:

An ML-DSA-44 public key on its own is larger than both the ENR limit and the Discovery packet limit. The author concludes that a PQ migration needs "a new record format or credential-distribution model". Swapping in a new signature will not be enough. The post also says the choice differs by layer. Hash-based schemes such as XMSS and SLH-DSA are being promoted for consensus signatures, but P2P size limits make lattice-based schemes the de facto candidates for networking.

The inventory deliberately does not choose a PQ signature, KEM, encoding, fork or rollout date. It is a research post open for feedback, not an EIP or a change to the consensus specs.

Who is affected and why it matters

The main audience is CL client networking teams and libp2p implementers. According to the post, Lighthouse, Prysm, Teku, Nimbus, Lodestar and Grandine all derive the Discovery node ID and the libp2p Peer ID from one secp256k1 networking key. The two identifiers do different jobs. The node ID selects records in the Discovery routing table, and the Peer ID identifies the libp2p endpoint. If a future design gives them separate keys, the post warns that the mapping from node ID to Peer ID must be authenticated and defined in the spec. If each client uses its own convention, peers could be impersonated and clients could stop working together.

The threats also have different timelines. An attacker can record key-exchange traffic now and decrypt it later, once the classical key agreement is broken. Forging a signature needs a quantum computer at the moment of the attack. So hybrid key exchange can ship before a full PQ identity design. However, the post stresses that hybrid key exchange "does not provide PQ authentication", so on its own it does not complete the P2P migration.

The libp2p TLS design also matters. Under the libp2p TLS specification, a peer does not sign its X.509 certificate with its host key. Instead, the host key goes into a libp2p Public Key Extension inside a self-signed certificate. A PQ host key would make that extension, and the handshake that carries it, much larger.

The analysis covers QUIC only. The current consensus specs say all implementations MUST support both the QUIC and the TCP libp2p transports, and the TCP fallback uses the libp2p Noise handshake with secp256k1 identities. The author calls the QUIC-only scope "an analytical boundary, not a deployment proposal". TCP/Noise and the execution layer still need their own migration work.

Validator operators have nothing to change today. No fork, flag or client release follows from this post.

What to do now

Client and libp2p maintainers can use the inventory as a checklist for a code audit:

1. List every use of the secp256k1 networking key. Include ENR signing, Discovery v5 ECDH and identity proofs, Peer ID derivation, the libp2p TLS extension and the Noise handshake on TCP.
2. Find hard-coded size limits. Search encoders, decoders and tests for the 300-byte ENR limit and the 1,280-byte packet limit. Note where a larger record or a separate credential fetch would break parsing.
3. Check the ENR-to-Peer-ID adapter. Write down how your client turns an ENR into multiaddrs and an expected Peer ID, and where it compares that Peer ID with the authenticated TLS identity. This code changes if the node ID and Peer ID stop sharing one key.
4. Track key exchange and authentication separately. Hybrid TLS 1.3 key exchange in QUIC protects against record-now-decrypt-later attacks on traffic. It does not replace the ENR, Discovery or CertificateVerify signatures.
5. Do not assume the consensus-signature work covers networking. The leanXMSS migration for validators leaves the P2P identities unchanged.
6. Send feedback on the thread. The author asks network-layer and libp2p developers for comments, and no algorithm or encoding has been chosen yet.

Caveats

This is one author's inventory, not an adopted specification. The ML-DSA-44 sizes only illustrate the limits. Other schemes make different size trade-offs, and the post says none of them should be assumed to be a drop-in replacement.