Quantum-Safe Supply Chain Tokenisation in Perth: What WA Mining Needs

A mine in Western Australia can run for decades. The paperwork attached to it tends to outlive the people who signed it. Assay certificates, shipping documents, custody handovers between the pit, the port and the processor, and offtake contracts. When a buyer in 2040 asks where a lithium cargo came from, somebody has to produce the record and prove nobody has touched it.

Most of the record is moving onto blockchains. Buyers want traceability, and some already insist on it. Miners and their contractors end up holding the signing keys. It raises a question that is often skipped during tokenisation plans. If a record is signed today with a scheme a quantum computer could one day break, what is that signature worth in 2040? It’s the gap quantum-safe supply chain tokenisation is meant to close, and WA operators can start working on it now.

WA Has Been Testing Blockchain for Metals and Shipments Since 2019

Back in 2019, the Perth Mint backed a gold token on Ethereum, with each token tied to a GoldPass certificate for metal held in its vault, as CoinDesk reported at the launch. In 2021, BHP ran blockchain pilots on nickel shipped from Nickel West to Tesla’s Shanghai gigafactory, checking provenance and whether the material had been diluted along the way. Another pilot moved Pilbara iron ore shipment data and documents to China Baowu digitally in place of paper, so everyone on the route could see a shipment in real time (BHP).

The push continues. This month, Minespider and Rare Earth Ventures announced a partnership to put digital product passports on Australian rare earth and critical mineral supply chains. Their argument is that traceability is turning into a condition of investment and market access. The European Union is pulling in the same direction with its battery passport rules, which start in 2027 and matter to any WA nickel or lithium producer whose product ends up in a European battery.

A Ledger is Only as Honest as the Signature on It

Every one of those records carries a signature. The assay certificate is signed by the lab, the port operator signs the handover, and the trader signs the release. ECDSA, the Elliptic Curve Digital Signature Algorithm, is the signature on most blockchains today. It works well but has a known weak point. A large enough quantum computer could work out a private key from its public key, and the public key becomes visible the first time an account signs. The ledger keeps it for good. Someone can copy it now and wait.

Let’s suppose a custody record for a lithium cargo was signed in 2026. In 2040, the buyer disputes where it came from. Whoever holds the original files can show they match the fingerprint on the chain. What they can’t do is prove the right person signed it, if the signature scheme has fallen.

It’s quite similar for post-quantum asset tokenisation in WA. The signature scheme should last as long as the records matter. NIST, the US National Institute of Standards and Technology, published its first post-quantum standards in August 2024, including ML-DSA for signatures in FIPS 204. The Australian Signals Directorate (ASD) recommends ceasing traditional asymmetric cryptography such as ECDSA and RSA by the end of 2030, and it expects organisations to have a refined plan by the end of this year.

A Mining Supply Chain Carries More Keys Than Most

One cargo passes through many hands. The producer, a haulage contractor, the port, a shipper, the processor, an inspector, a trader. Every party that signs holds keys, and every set of keys must be listed and replaced.

Contractors are the soft spot. According to S&P Global, cyber risk ranked fourth on KPMG’s list of top concerns for Australian miners in 2025, back in the top ten for the first time since 2021. In June 2025, a ransomware group listed Pressure Dynamics, a Perth mining services firm that counts Rio Tinto as a client, as a victim. The company had reached Maturity Level 3 in a test in February 2024. None of that is about quantum computers. It does show that the weakest signer sets the strength of the whole trail, so both the scheme and the way keys are handled matter.

How One Lithium Shipment Gets Recorded, Step by Step

Take a load of lithium concentrate leaving a WA mine by road. At the gate, a weighbridge ticket is signed and a fingerprint of it, meaning a hash, is written to the chain along with a timestamp. The lab signs an assay certificate once the samples are tested. At the port, the handover to the shipper is signed by both sides. When the vessel loads, the bill of lading and the release are signed too. The documents themselves stay in each party’s own systems. Only the short entries go on the ledger.

Months later, the buyer questions the grade. Anyone can take the assay certificate from the lab’s files, work out its hash, and compare it with the entry on the chain. The signature shows the lab put its name to it. That check works for as long as the signature scheme holds, which is the whole argument for choosing one that will. 

Five Records Worth Signing Carefully

Who Holds the Key at a Remote Site?

Mine sites run on contractors, rotating rosters and patchy connections. A key tied to one named person goes missing when that person changes roster or moves to another company. Decide early whether a key belongs to a role or to an individual, who can approve a replacement and where the backup lives. Keep signing authority for high-value actions, such as releasing a cargo, with a small number of people and away from the site laptop. It’s worth writing this down now. Moving to a post-quantum scheme later means every one of those keys gets replaced, and the cleaner the list, the cheaper that job is.

Where a Post-Quantum EVM Chain Fits

ARMchain is an EVM-compatible quantum-safe Layer 1 built on ML-DSA, the algorithm in FIPS 204. User transactions and validator messages are signed with it, so the standard transaction path has no classical signature to migrate away from later. Because it speaks Ethereum, your developers write Solidity for the London fork and existing contracts carry over, which helps if a token or registry contract already exists. Finality is immediate, and archive nodes keep every historical state, so an auditor can query a record as it stood at a past block.

For the controls that matter most, such as the account that releases a cargo or holds a custody token, smart contract accounts can use SLH-DSA, the hash-based scheme in FIPS 205, instead. Passkeys and MPC for ECDSA are supported too, and neither of those is post-quantum. ARMchain is the base layer. It doesn’t come with a traceability product or a mining registry, so the tokens and workflows are yours or your vendor’s to build.

What It Costs

A simple transfer on ARMchain runs about 3,930 bytes, against about 110 for ECDSA, because each transaction carries the signature and the public key. A handful of records per cargo won’t register. Streams of sensor readings will, so keep the raw data in your own systems and write only a fingerprint to the chain, as you would for any sensitive record.

Tooling changes a little. Hardhat and Foundry don’t support this signing natively, so developers sign with ARMchain’s SDK. Your Solidity contracts stay the same.

Where to Start in Perth

Pick one flow, for example, a single commodity from mine gate to port, and list every party that signs along it and where their keys sit. That list is your inventory, and it’s ASD’s first step too. Keep the first pilot small. One commodity, one route, three or four signers, and one question to answer: starting from nothing but the original file, can an auditor confirm who 

signed what and when? Then give one developer a day with the ARMchain documentation. 

A local Fakenet runs on a laptop, and signing one of your existing contracts through the SDK will show what the integration involves. Running the pilot there first means nothing real is at stake. Before any pilot, compare the ML-DSA parameter set with the approved list in the Information Security Manual and raise a formal assessment early.

FAQs

Does putting a record on a blockchain prove the ore came from our mine?

No. The chain shows who signed a record and that it hasn’t changed since. Whether the record was true when it went in depends on the people and sensors feeding it, so inspections and audits stay.

Does a quantum-safe chain have to be hosted in Western Australia?

Cryptography can’t answer that. Hosting and data residency come from your contracts, your buyers’ requirements, and legal advice. Settle them alongside the signature scheme.

Will bigger signatures slow down shipment records?

Not at normal volumes. A few records per cargo is nothing for a chain. Sensor feeds are a different story, which is why raw data stays off-chain, and only a hash goes on it.

Can our existing token contracts move over?

Solidity contracts written for the London fork carry over, since ARMchain is EVM-compatible. The only change is signing, which goes through the SDK. Test on a local Fakenet first.

Is ML-DSA approved for Australian government use?

FIPS 204 defines the algorithm. Module validation is a separate process, and the Information Security Manual lists approved algorithms and parameter sets. Ask your assessor what your project has to show.

Start With One Cargo

A WA mine’s records have to hold up long after the shipment has sailed, and the signature on them should last as long. If you’re working on quantum-safe supply chain tokenisation in Perth, or on post-quantum asset tokenisation for a WA operation, get in touch with the ARMchain team.