Skip to main content

Cryptography

Cryptographic agility is core to Sui. The system supports multiple cryptography algorithms and primitives and can switch between them rapidly. This flexibility means applications can adopt new cryptographic standards without protocol-level changes.

Available primitives​

Sui provides the following cryptographic capabilities for smart contracts and applications:

  • Signing: Sui supports multiple signature schemes. User transactions authenticate with Ed25519, ECDSA (secp256k1 and secp256r1), or passkeys, and multisig addresses can combine different schemes in a single address. BLS12-381 signatures are available for validator operations and onchain verification in Move but are not used for user transaction authentication.
  • Hashing: Move modules can compute SHA2-256, SHA3-256, Keccak-256, and Blake2b-256 hashes onchain for data integrity verification, commitment schemes, and cross-chain interoperability.
  • Groth16 verification: Verify zero-knowledge proofs onchain using the Groth16 proof system over BN254 and BLS12-381 curves. This enables privacy-preserving applications that verify computations without revealing inputs.
  • ECVRF: Verify Elliptic Curve Verifiable Random Function outputs onchain for applications that need provably fair randomness from an external source.
  • Passkeys: Authenticate transactions using WebAuthn passkeys (FIDO2), enabling hardware-backed authentication through biometrics or security keys without managing private keys.

For transaction-level authentication including multisig and offline signing, see Transaction Authentication.

Sui's cryptographic capabilities extend beyond smart contract primitives. For Bitcoin integration through threshold cryptography, see Hashi (the Sui native Bitcoin orchestrator). For passwordless authentication using device-native key pairs, see Passkeys. For zero-knowledge authentication with OAuth providers, see zkLogin.