Skip to main content
4 of 7
added 284 characters in body
bca-0353f40e
  • 1.2k
  • 3
  • 18

There has been some literature discussing this and a migration strategy:

The 2nd referenced paper describes a commit-reveal scheme that would avoid having your funds stolen when you want to migrate them to some new, quantum-resistant address.

The new addresses would pretty much look the same: a string of characters, with maybe few bits of difference in starting characters to encode the use of some new scheme. If collision resistance is required they'd also have to be a little longer (384 bits). Quantum preimage resistance is already achieved with SegWit 256-bit addresses (even though the underlying key is vulnerable).

In fact, assuming some upgrades to Bitcoin Script opcodes to have QC-resistant signature opcodes, then for many applications quantum-resistant addresses could look exactly the same as current P2WSH addresses.

So addresses wouldn't be affected much. However, transactions would get much bigger, since the input script would then have to include a bigger public key and signature. For example, SPHINICS uses 1KB keys and 41KB signatures so in that case the address would have to be about 7 times longer and signature about 645 times longer! Good news is that with SegWit it wouldn't count against the "hard" blocksize limit, and that data could be later pruned.

bca-0353f40e
  • 1.2k
  • 3
  • 18