The Nervos community recently hosted an AMA with Tea (8th January), a community developer who built Quantum Purse, an industry-first SPHINCS+ wallet offering quantum-resistant security on CKB. Tea is also the creator of JoyDAO.
Nervos社区近期与社区开发者Tea进行了一场AMA （1月8日）。Tea开发了Quantum Purse，这是业界首个基于SPHINCS+的抗量子钱包，运行在CKB上。Tea也是JoyDAO的创建者。
We’re sharing the full AMA here for the Nervos Talk community. If you have questions that weren’t covered, please reply below. We’ll collect them and get Tea’s responses.
我们在此同步完整的AMA内容。如果你有未被覆盖的问题，欢迎在下方回复。 我们会收集并转达给Tea。
Original Reddit AMA: https://www.reddit.com/r/NervosNetwork/comments/1q11raa/quantum_purse_reddit_ama/
Quantum Purse GitHub: GitHub - tea2x/quantum-purse: A CKB quantum-safe & lightweight wallet
Original AMA Transcript
Thanks Tea for all of the amazing work you’ve done with this, it is truly an inspiration.
1. When testing Quantum Purse, I remember needing to use a sufficiently long password to enhance the security guarantee, although users may experience friction here.
2. Is there a way to provide the benefits of quantum security whilst maximising user experience and ease of use?
For example, is there a way the benefits of Passkey technology could somehow be combined with quantum safety in future? I understand they use different lock scripts so it may not be an easy solution.
3. What is your future roadmap for Quantum Purse? How do you see it making an impact moving forward?
Happy New Year 
-
Hardware wallets like Trezor have a method to let users authenticate with only 6 digit numbers, whilst still secure. I believe in modern computers/phones, there is a similar thing to realise that hardware-wallet experience in a pure software solution like Quantum Purse. Let’s see if the next upgrade of Quantum Purse can make use of that or not (I’m not sure now, so I can’t promise xd).
There is a way. But it requires more testing. -
Yes, the Passkeys Lock Script is the famous JoyID Lock Script. It is different from the Lock Script Quantum Purse uses.
Regarding the question, Passkeys are often thought of as R1 signatures generator, with enclaved private keys (That’s why JoyID can’t allow for a CKB mnemonics backup). The JoyID Lock Scripts you mentioned process these R1 signatures from the Passkeys module and allows for a great UX.
But besides R1 signatures, the hardware behind the Passkeys module can do more. It can derive deterministic keys (think of it as if you have one Google account and create 1 passkey → you can derive 1 key). This is a new extension for the web authentication kit called Passkeys PRF.
Passkeys PRF produces cryptographic keys that can be used in so many things (imagine Ethereum/Bitcoin Private key). In Quantum Purse, it can be used to encrypt the wallet seed. So? No need for lengthy passwords to encrypt the wallet seed any more. You only need a Google/Apple account, create a passkey and use it to encrypt the wallet seed. All you need is quantum-safety to your Google account xd, and a fingerprint / biometric in general. -
Haha, this is a small community-driven project, so the roadmap is in my head XD. The next step is an upgrade for Quantum Purse, both in the technology stack and features.
-
Big tech like Microsoft, hardware wallet creator, and even big embedded chip designers like ST, are also preparing to go quantum-safe. I believe there are more, they are happening behind the scenes and out of the crypto space. So a quantum-safe blockchain and a quantum-safe wallet can make quite an impact and inspiration.
assets transferred to these addresses remain secure against quantum threats.
1. Are these addresses exchange-supported?
2. Are they compatible with the desktop wallet?
3. Does Quantum purse seek to replace the desktop wallet?
4. If so, will it have Nervos DAO staking?
Happy new year
-
There are no problems sending CKB back and forth between Quantum Purse and exchanges.
-
There should there be no problem sending CKB back and forth between Quantum Purse and other wallets.
-
Hahah it depends if you guys want to use it. Yes next big(or medium) thing after Quantum Purse is an upgrade both in technology stack and features. Let’s see.
-
It already has. There will be a default feature for the official release.
1. Are there any plans to make platform specific versions of quantum purse or staying browser based?
Happy new year
- Definitely yes!!
1. Is there going to be hardware wallet support with any particular device? If so, when will the roll out be?
Happy new year
Is there going to be hardware wallet support with any particular device?
I can’t say anything for now, it is too soon. But good news is that there’re people(me included) pushing this kind of thing.
If so, when will the roll out be?
It is too soon, I can’t say anything yet. Please stay updated!
1. Are you planning to build anything else or work in other teams to do other projects in the future?
Happy new year
Yes & yes, I have many ideas. I wish I had more time 
1. What has been the hardest part about creating the wallet? How easy has it been to work with CKB?
Happy new year
> What has been the hardest part about creating the wallet?
The hardest part about creating the wallet is understanding the design of SPHINCS+. It is a combination of many signature schemes, and over 50 years of cryptography XD. I’m not a cryptographer and didn’t have enough knowledge about all types of signatures used in the architech of SPHINCS+ but fortunately a video from COSIC made it for me.
>how easy has it been to work with CKB?
It took a rough start(about a few months) to build a personal mental model of CKB to kind of feel the nature of building on it. That’s the first challenge and I rate it 6/10(hardness) based on my experience (Ethereum, EOS, Bitcoin).
The second challenge is the tooling. It’s been relatively easy to build with CCC, Rust contract template, sample code and lots of help from CKB people! On a scale of 1 → 10 of hardness, I rate this 6 too.
I want to gift some CKB to a friend in the form of a preloaded wallet, preferably quantum secure (of course).
1. Is it possible to create and manage a offline wallet with QPurse so far and use the DAO?
2. Outcome will be a seed-phrasae + password am I right?
3. The overhead cost of CKB is only 10 if I did understand correctly?
Thanks for the great work, looking forward to the future of this great project!
Happy New Year
1/2. Just a seed phrase and the link to a stable build of Quantum Purse software are enough. Please keep in mind that Quantum Purse seed phrase (mnemonic seed) is long, and can ONLY be imported to Quantum Purse now.
3. 73 CKB is the smallest cell users can put into the Quantum Purse. It can not be lower than that. It is similar to the 61 CKB on the Neuron wallet.37
Hi Tea
1. As new QR algorithms emerge, can Quantum Purse adapt those as needed? Does CKB’s flexibility allow new implementations on quantum purse or does a different wallet need to be created as QR algos get more advanced?
Thanks for all you do Tea
Happy New Year
-
Yes. But to be exact, Quantum Purse is only half a QR protocol (SPHINCS+). Another half of the protocol is the on-chain Lock Script - which is developed by a dedicated team from Cryptape (Quantum Purse signs - Lock Script verify). So Quantum Purse alone is not so meaningful without a trusted companion Lock Script.
-
CKB flexibility allows it to implement any kind of cryptography - meaning any quantum-safe Lock Script can be built on CKB. If QR algos get more advanced, those that stand the test of time (or even not, if we want experimentations XD) can just be implemented on the CKB blockchain. I’ll be excited to integrate them into Quantum Purse too!
Q: 测试Quantum Purse时需要足够长的密码来保证安全性，用户可能会觉得麻烦。有没有办法在保持量子安全的同时优化用户体验？比如Passkey技术能否与量子安全结合？
A: 像Trezor这样的硬件钱包可以让用户只用6位数字认证，同时保持安全。我相信现代电脑/手机上也能用纯软件方案实现类似体验。下一版Quantum Purse会看看能不能做到（不敢保证）。
关于Passkey：JoyID的Lock Script确实和Quantum Purse用的不同。但Passkey硬件除了R1签名，还能派生确定性密钥（deterministic keys），这是WebAuthn的新扩展叫Passkeys PRF。它可以用来加密钱包种子，这样就不需要长密码了，只需要Google/Apple账号创建一个passkey，用指纹或生物识别就行。当然，前提是你的Google账号本身也要量子安全。
Q: Quantum Purse的路线图是什么？
A: 这是社区驱动的小项目，路线图在我脑子里。下一步是技术栈和功能的升级。微软、硬件钱包厂商、ST这样的芯片设计商都在准备量子安全方案。一个量子安全的区块链和钱包会有影响力。
Q: 这些地址交易所支持吗？和桌面钱包兼容吗？会取代桌面钱包吗？有Nervos DAO质押吗？
A: 和交易所、其他钱包之间转账都没问题。会不会取代桌面钱包取决于你们想不想用。DAO质押已经有了，正式版会作为默认功能。
Q: 会做平台特定版本还是保持浏览器版？
A: 肯定会做！
Q: 会支持硬件钱包吗？
A: 现在说还太早，但有人（包括我）在推动这件事。请保持关注。
Q: 创建钱包最难的部分是什么？在CKB上开发容易吗？
A: 最难的是理解SPHINCS+的设计，它组合了多种签名方案和50多年的密码学成果。我不是密码学家，幸好COSIC的一个视频帮了我。
在CKB上开发，一开始需要几个月建立心智模型（mental model），难度6/10（基于我在Ethereum、EOS、Bitcoin的经验）。工具方面，有CCC、Rust合约模板、示例代码和CKB社区的帮助，也是6/10。
Q: 可以创建离线钱包并使用DAO吗？最低CKB开销是多少？
A: 只需要种子短语（seed phrase）和Quantum Purse软件链接就够了。注意Quantum Purse的种子短语很长，目前只能导入到Quantum Purse。最小cell是73 CKB，类似Neuron钱包的61 CKB。
Q: 新的抗量子算法出现时，Quantum Purse能适配吗？
A: 能。但准确说，Quantum Purse只是协议的一半（SPHINCS+签名），另一半是Cryptape团队开发的链上Lock Script（验证签名）。CKB的灵活性允许实现任何密码学方案，新的抗量子Lock Script都可以在CKB上构建，我也很期待把它们整合到Quantum Purse。
Got questions? Drop them below!
有问题？请在下方留言！