7

Here (https://bitcoincore.org/en/2017/03/23/schnorr-signature-aggregation/) it says Schnorr replaces ECDSA, we know that ECDSA can be broken by quantum computers. Is Schnorr safe from q-computers?

13

No, ECDSA and EC-Schnorr, as well as related schemes like EdDSA, all belong to the class of elliptic curve cryptography. Their security is based on the assumption that the EC discrete logarithm is unfeasibly hard to compute. This assumption is not true if a sufficiently strong general purpose quantum computer would exist.

Quantum resistant signature algorithms do exist, but they all rely on very large signatures - which may make them unfeasibly expensive for purposes like Bitcoin. Furthermore, much less research exists into features on top (like homomorphic derivation like BIP32 uses, or aggregation), making them effectively a step backwards in terms of functionality if we'd adopt that instead.

However, I am not very worried about this. Quantum Computing in general has a very long way to go before it comes even close to tackling problems like solving discrete logarithms for curves of our size. A general-purpose QC with several 1000s of qbits would be needed, and it is not even known whether it is physically possible to build such a computer.

| improve this answer | |
1

This is basically an invalid question. It doesn't matter how you sign data. As long as you're using elliptic curve and (EC)DLP (Elliptic Curve Discrete Logarithm Problem), then a quantum computer should be (by definition, with Shor's algorithm) be able to break it. This is because signature verification requires a publicly available public key. If you have a quantum computer and a public key, you get the private key.

Asking whether quantum computers can break digital signatures, is like asking whether a reinforced safe can be opened by anyone, while the key to that safe is public information. It doesn't matter how you reinforce the safe, if there's a way to make a key that opens that safe by anyone.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.