PQLN Protects Lightning's Gossip, Transport and Onions, Not Channel Funds - the Platform Card Has It Backwards - and the Price Is 10x Gossip Bandwidth, a 270 MB Bootstrap and a 4,286-Character Invoice
Correction first. The platform summary says the East Texas A&M approach "protects on-chain Bitcoin transactions more effectively than Lightning's off-chain privacy mechanisms." That is inverted. PQLN (Post-Quantum Lightning Network), posted to Delving Bitcoin and arXiv by Ahmet Kurt of East Texas A&M's RELLIS campus on September 12, 2026, secures ONLY the off-chain surfaces: BOLT 8 transport, BOLT 7 gossip, BOLT 4 onion routing, BOLT 11 invoices and BOLT 12 offers. It explicitly does not touch the funding, commitment, penalty or HTLC keys, because, in the author's words, those "can't move to post-quantum without a consensus change." Channel funds remain exactly as exposed as any other Taproot/ECDSA output until Bitcoin itself adopts something like BIP-360.
What it actually does. A hybrid Noise_XK handshake with two ML-KEM-768 encapsulations (one to a pinned node key, one to an ephemeral), ML-DSA-44 signatures (about 2,420 bytes each) or FN-DSA-512 as the smaller alternative, keys distributed through node announcements on a trust-on-first-use pinning model. Onion routing carries ML-KEM ciphertexts in a fixed 20-slot list beside update_add_htlc, with dummy ciphertexts in unused slots so route length cannot be inferred. Channel announcements stay classical because two of their four signatures are Bitcoin-rooted. The code is about 11,000 lines behind a "post-quantum" cargo feature in a rust-lightning fork (pq-rust-lightning) plus a modified LDK sample node.
What it costs. Gossip volume ~10x with ML-DSA-44 (~4x with FN-DSA-512); a full-graph bootstrap on a 33,000-channel network grows from 26 MB to 270 MB; graph storage 8.8x. A signature-only BOLT 11 invoice becomes 4,286 QR characters (about 1,500 with FN-DSA). Each private payment adds a 21.8 kB ciphertext list and 19-53 ms per hop on a 50 ms link (CryptoSlate cites up to 187 ms on slower links). ML-DSA signing itself is fast at 0.33 ms.
Why it does not deploy tomorrow. There is no in-band negotiation; PQ nodes must listen on a separate port to avoid downgrade attacks, and a "require-PQ" flag is needed to fail closed rather than silently falling back when a vanilla peer is met (12 mixed-node scenarios were tested). rust-lightning hardcodes MAX_EXCESS_BYTES_FOR_RELAY at 1,024 bytes, so PQ gossip will not propagate through today's nodes at all. TLV types, invoice tags and feature bits still need the BOLT process, and there has been no interop testing against CLN, LND or Eclair. Key pinning also only protects relationships established before a quantum adversary exists.
What the threat model actually covers. The real win is against harvest-now-decrypt-later on transport and gossip: an adversary recording Lightning traffic today could not later decrypt it to recover payment paths and invoice metadata. That is a privacy guarantee, not a funds guarantee. Anyone reading "Lightning gets quantum-proof" as "your channel balance is safe" has read the wrong sentence.
Sources (4)
AI Research
Key Takeaway
PQLN quantum-hardens Lightning's transport, gossip, onion, invoice and offer layers only; channel funds stay classical until a Bitcoin consensus change, and the prototype costs ~10x gossip bandwidth and a 4,286-character invoice.
Correction first. The platform summary says the East Texas A&M approach "protects on-chain Bitcoin transactions more effectively than Lightning's off-chain privacy mechanisms." That is inverted. PQLN (Post-Quantum Lightning Network), posted to Delving Bitcoin and arXiv by Ahmet Kurt of East Texas A&M's RELLIS campus on September 12, 2026, secures ONLY the off-chain surfaces: BOLT 8 transport, BOLT 7 gossip, BOLT 4 onion routing, BOLT 11 invoices and BOLT 12 offers. It explicitly does not touch the funding, commitment, penalty or HTLC keys, because, in the author's words, those "can't move to post-quantum without a consensus change." Channel funds remain exactly as exposed as any other Taproot/ECDSA output until Bitcoin itself adopts something like BIP-360.
What it actually does. A hybrid Noise_XK handshake with two ML-KEM-768 encapsulations (one to a pinned node key, one to an ephemeral), ML-DSA-44 signatures (about 2,420 bytes each) or FN-DSA-512 as the smaller alternative, keys distributed through node announcements on a trust-on-first-use pinning model. Onion routing carries ML-KEM ciphertexts in a fixed 20-slot list beside update_add_htlc, with dummy ciphertexts in unused slots so route length cannot be inferred. Channel announcements stay classical because two of their four signatures are Bitcoin-rooted. The code is about 11,000 lines behind a "post-quantum" cargo feature in a rust-lightning fork (pq-rust-lightning) plus a modified LDK sample node.
What it costs. Gossip volume ~10x with ML-DSA-44 (~4x with FN-DSA-512); a full-graph bootstrap on a 33,000-channel network grows from 26 MB to 270 MB; graph storage 8.8x. A signature-only BOLT 11 invoice becomes 4,286 QR characters (about 1,500 with FN-DSA). Each private payment adds a 21.8 kB ciphertext list and 19-53 ms per hop on a 50 ms link (CryptoSlate cites up to 187 ms on slower links). ML-DSA signing itself is fast at 0.33 ms.
Why it does not deploy tomorrow. There is no in-band negotiation; PQ nodes must listen on a separate port to avoid downgrade attacks, and a "require-PQ" flag is needed to fail closed rather than silently falling back when a vanilla peer is met (12 mixed-node scenarios were tested). rust-lightning hardcodes MAX_EXCESS_BYTES_FOR_RELAY at 1,024 bytes, so PQ gossip will not propagate through today's nodes at all. TLV types, invoice tags and feature bits still need the BOLT process, and there has been no interop testing against CLN, LND or Eclair. Key pinning also only protects relationships established before a quantum adversary exists.
What the threat model actually covers. The real win is against harvest-now-decrypt-later on transport and gossip: an adversary recording Lightning traffic today could not later decrypt it to recover payment paths and invoice metadata. That is a privacy guarantee, not a funds guarantee. Anyone reading "Lightning gets quantum-proof" as "your channel balance is safe" has read the wrong sentence.