{
  "id": "zcash",
  "name": "Zcash",
  "type": "Privacy L1 (PoW UTXO)",
  "reviewed": "2026-06-24",
  "summary": "Zcash's privacy is its product — and it is not quantum-resistant. Shielded note encryption is elliptic-curve Diffie-Hellman, so harvest-now-decrypt-later lets a future quantum computer retroactively de-anonymize today's shielded transactions; the shielded proofs (Sapling Groth16, Orchard Halo 2) are discrete-log / pairing based, proving that \"transparent\" (no trusted setup) does not mean post-quantum. The only post-quantum-safe parts are the Equihash proof-of-work that orders blocks and secures consensus. A PQ migration (ML-KEM note encryption, Project Tachyon) is on the roadmap (~2027), not deployed. Deep-research-verified against the Zcash Protocol Specification and ZIPs (June 2026).",
  "links": {
    "Website": "https://z.cash",
    "Protocol spec": "https://zips.z.cash/protocol/protocol.pdf",
    "ZIPs": "https://zips.z.cash"
  },
  "assessment": {
    "1.1": { "verdict": "fail", "scheme": "secp256k1 ECDSA + RedDSA (Jubjub/Pallas)", "why": "Transparent addresses sign with secp256k1 ECDSA; shielded spend authorization uses RedDSA (Schnorr-type) over Jubjub (Sapling) and Pallas (Orchard) — all elliptic-curve signatures that Shor breaks.", "sources": ["https://zips.z.cash/protocol/protocol.pdf", "https://zips.z.cash/zip-0224"] },
    "1.2": { "verdict": "fail", "scheme": "EC spending keys", "why": "Wallets store the same Shor-breakable elliptic-curve spending keys (secp256k1 / Jubjub / Pallas); no post-quantum key material ships by default.", "sources": ["https://zips.z.cash/protocol/protocol.pdf"] },
    "1.3": { "verdict": "fail", "scheme": "Classical threshold (FROST)", "why": "Threshold / MPC signing (e.g. FROST) splits classical Schnorr/EC keys; splitting a key does not change the EC discrete-log hardness Shor solves, and PQ threshold signing is research-stage." },
    "1.4": { "verdict": "na", "scheme": "", "why": "Zcash is a non-programmable Bitcoin-derived UTXO chain — no smart contracts or programmable accounts.", "sources": ["https://messari.io/report/understanding-zcash-a-comprehensive-overview"] },
    "1.5": { "verdict": "na", "scheme": "", "why": "With no programmable-account layer, passkeys / session keys are not a Zcash protocol concept." },
    "1.6": { "verdict": "na", "scheme": "", "why": "Zcash has no on-chain naming or identity registry." },
    "1.7": { "verdict": "na", "scheme": "", "why": "Governance is off-chain (ZIPs, ECC, the Zcash Foundation; coordinated hard forks) — there is no on-chain coin-holder-vote signature to break.", "sources": ["https://messari.io/report/understanding-zcash-a-comprehensive-overview"] },
    "2.1": { "verdict": "na", "scheme": "", "why": "No smart-contract layer, so there are no on-chain contract signature-verification routines." },
    "2.2": { "verdict": "na", "scheme": "", "why": "Shielded-proof verification is a protocol consensus rule (scored under Proof system, 3.2), not app-level pairing-verifier contracts.", "sources": ["https://zips.z.cash/protocol/protocol.pdf"] },
    "2.3": { "verdict": "na", "scheme": "", "why": "No oracle system (non-programmable chain)." },
    "2.4": { "verdict": "na", "scheme": "", "why": "No on-chain verifiable-randomness or beacon component." },
    "2.5": { "verdict": "na", "scheme": "", "why": "No verifiable delay function." },
    "3.1": { "verdict": "pass", "scheme": "Equihash PoW", "why": "Blocks are ordered by Equihash proof-of-work — hash-based, with no Shor-breakable block-signing key. Confirmed still proof-of-work on mainnet in mid-2026 (Crosslink PoS not activated).", "sources": ["https://forum.zcashcommunity.com/t/crosslink-updated-staking-design/52695"] },
    "3.2": { "verdict": "fail", "scheme": "Groth16 (BLS12-381) + Halo 2 (Pasta IPA)", "why": "Shielded proofs use Sapling Groth16 over the BLS12-381 pairing and Orchard Halo 2, whose inner-product-argument commitments live on the Pasta curves — both pairing / discrete-log based and Shor-breakable. Halo 2 needs no trusted setup, but \"transparent\" does not mean post-quantum (unlike hash-based STARKs).", "sources": ["https://zips.z.cash/protocol/protocol.pdf", "https://zcash.github.io/halo2/background/pc-ipa.html", "https://web.stanford.edu/~buenz/pubs/bulletproofs.pdf"] },
    "3.3": { "verdict": "fail", "scheme": "Sapling powers-of-tau (BLS12-381)", "why": "The still-active Sapling pool relies on a powers-of-tau + MPC trusted setup over BLS12-381; Shor recovers the secret from the public reference string regardless of honest deletion, enabling forged Sapling proofs. Orchard's Halo 2 is transparent (no setup).", "sources": ["https://eprint.iacr.org/2022/1592.pdf", "https://zips.z.cash/protocol/protocol.pdf"] },
    "3.4": { "verdict": "na", "scheme": "", "why": "Monolithic UTXO L1 — full blocks are published with no separate data-availability layer or commitment.", "sources": ["https://messari.io/report/understanding-zcash-a-comprehensive-overview"] },
    "3.5": { "verdict": "fail", "scheme": "Pedersen / Sinsemilla trees (Jubjub/Pallas)", "why": "Note-commitment trees use Bowe-Hopwood Pedersen hashes over Jubjub (Sapling) and Sinsemilla over Pallas (Orchard); their binding rests on elliptic-curve discrete-log hardness, which Shor breaks.", "sources": ["https://zips.z.cash/protocol/protocol.pdf", "https://zcash.github.io/halo2/design/gadgets/sinsemilla.html"] },
    "3.6": { "verdict": "na", "scheme": "", "why": "Zcash has no general-purpose virtual machine (non-programmable).", "sources": ["https://messari.io/report/understanding-zcash-a-comprehensive-overview"] },
    "4.1": { "verdict": "pass", "scheme": "Equihash PoW (Nakamoto)", "why": "Consensus is Nakamoto Equihash proof-of-work with no validator or BLS finality signatures — nothing Shor-breakable. The Crosslink hybrid-PoS finality gadget is still in development (not activated on mainnet as of mid-2026); if it ships, this flips to fail.", "sources": ["https://forum.zcashcommunity.com/t/crosslink-updated-staking-design/52695", "https://zechub.wiki/zcash-tech/crosslink-protocol"] },
    "4.2": { "verdict": "na", "scheme": "", "why": "No signing-set sync committee; light wallets follow proof-of-work headers (via lightwalletd), not a BLS sync committee." },
    "4.3": { "verdict": "na", "scheme": "", "why": "Base layer — Zcash does not anchor or settle to another chain." },
    "4.4": { "verdict": "na", "scheme": "", "why": "Zcash has no canonical / in-protocol bridge; all cross-chain ZEC representations are third-party and custodial, which this framework scores against the bridge operator, not the chain." },
    "4.5": { "verdict": "na", "scheme": "", "why": "No restaking / AVS attestation layer." },
    "4.6": { "verdict": "na", "scheme": "", "why": "Transparent HTLC / atomic-swap scripts (inherited Bitcoin Script) exist but are app-layer, not core protocol." },
    "4.7": { "verdict": "na", "scheme": "", "why": "Proof-of-work miners build their own blocks; there is no MEV-Boost / PBS relay market." },
    "5.1": { "verdict": "fail", "scheme": "Bitcoin-lineage P2P (unencrypted)", "why": "The Bitcoin-derived peer protocol is largely unencrypted and deploys no PQ / hybrid key exchange, so node-to-node transport is not post-quantum-secure." },
    "5.2": { "verdict": "na", "scheme": "", "why": "The Bitcoin-lineage P2P layer identifies peers by IP address, not a node-identity keypair, so there is no node key to break (unlike libp2p chains)." },
    "5.3": { "verdict": "fail", "scheme": "Classical TLS (lightwalletd / RPC)", "why": "Wallet ↔ lightwalletd (gRPC/TLS) and node JSON-RPC use classical TLS, whose ECDHE key exchange is Shor-breakable." },
    "5.4": { "verdict": "fail", "scheme": "ECDH note encryption (Jubjub/Pallas)", "why": "Shielded note encryption derives its symmetric key via elliptic-curve Diffie-Hellman over Jubjub (Sapling) / Pallas (Orchard) (ZIP-212 KA.Agree). Shor breaks it, and harvest-now-decrypt-later retroactively de-anonymizes all harvested shielded transactions — the headline quantum risk for a privacy coin.", "sources": ["https://zips.z.cash/zip-0212", "https://zips.z.cash/protocol/protocol.pdf", "https://github.com/zcash/zcash_note_encryption"] },
    "5.5": { "verdict": "fail", "scheme": "Shielded stack (SNARKs + ECDH)", "why": "Shielded confidentiality rests on breakable zk-SNARKs (Groth16 / Halo 2) plus ECDH note encryption — neither is post-quantum, so privacy is not quantum-resistant (enabling proof forgery and retroactive de-anonymization). PQ note encryption (ML-KEM) and Project Tachyon are roadmap (~2027), not the deployed default.", "sources": ["https://zips.z.cash/zip-0212", "https://zcash.github.io/halo2/background/pc-ipa.html"] }
  }
}