3

In a hypothetical future where a quantum computer is able to break the cryptography protecting the bitcoin private key, one of the solution would be to move our coins to quantum safe resistant addresses before it happens.

How could this switch look like, does every UTXO have to be published on the blockchain on which new quantum resistant address it is moving to, and what would these addresses look like?

Improve this question
0

1 Answer 1

Reset to default
1

There has been some literature discussing this and a migration strategy:

The 2nd referenced paper describes a commit-delay-reveal scheme that would avoid having your funds stolen when you want to migrate them to some new, quantum-resistant address.

The new addresses would pretty much look the same: a string of characters, with maybe few bits of difference in starting characters to encode the use of some new scheme. If collision resistance is required they'd also have to be a little longer (384 bits). Quantum preimage resistance is already achieved with SegWit 256-bit addresses (even though the underlying key is vulnerable).

In fact, assuming some upgrades to Bitcoin Script opcodes to have QC-resistant signature opcodes, then for many applications quantum-resistant addresses could look exactly the same as current P2WSH addresses.

So addresses wouldn't be affected much. However, transactions would get much bigger, since the input script would then have to include a bigger public key and signature. For example, SPHINICS uses 1KB keys and 41KB signatures so in that case the spending input's unlocking data would have to be about 420 times longer (pubkey & signature)! Note that, with SegWit, the big unlocking data wouldn't count against the legacy 1 MB blocksize limit but it would count against the 4 MB SegWit block weight limit so we could fit much less transactions. To allow the same number of transactions, some protocol upgrade would have to be rolled out to make room for bigger pubkey & signature data.

Improve this answer
10
  • 1
    Any signature scheme with public keys P and signatures S can always be transformed into a scheme with public keys H(P) and signatures P+S. A post-quantum hash function H may need to be 384-512 bits instead of 256, but that still only means addresses that are 1.5x to 2x longer than P2WSH/P2TR addresses today.
    – Pieter Wuille
    Commented Oct 31, 2022 at 12:50
  • You're right, the keys will be about 1KB but shouldn't addresses then be 256 or 384 bits, depending on whether you need collision-resistance or no. Why would you need 512? I'll fix the answer.
    – bca-0353f40e
    Commented Oct 31, 2022 at 12:53
  • 2
    Yeah, 384 bits is sufficient according to that reasoning, when collision security matters. I just prefer not to speculate about what security levels we need in the presence of as-of-yet hypothetical machines. Maybe the quantum speedup comes with a significant constant factor slowdown, and we don't actually need 128-bit security. Or maybe they end up being faster, or they help exploit weaknesses in hash functions beyond what Grover's can do.
    – Pieter Wuille
    Commented Oct 31, 2022 at 13:10
  • 1
    There's some literature suggesting it'd be costly, but sure, it's all speculative. At least the lower bounds have been proven, so if the hash function itself is not weakened then you'd get full 128 bits of security with 384-bit outputs. I have updated my answer accordingly.
    – bca-0353f40e
    Commented Oct 31, 2022 at 13:15
  • 1
    @bca-0353f40e: Yeah, exactly.
    – Murch ♦
    Commented Oct 31, 2022 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.