Bitcoin Quantum Risk: It’s Real

Roughly a quarter of all Bitcoin The risk of quantum attacks is linked to public keys which have been disclosed on the Blockchain. If that large a portion of Bitcoin supply is at risk, then it is a cause for concern. Is the entire Bitcoin security model in danger?

Imagine that you check your mobile phone in the morning and find your bitcoin balance at zero. Your exchange and cold storage balances are also affected. Gone. Millions of UTXOs were drained overnight in a coordinated, silent attack.

Although it may sound extreme, this type of theft would involve more than simply stealing. The attack would directly affect Bitcoin’s price, sending a message to the world that the cryptography at its heart is not secure. Such an act would not be done to simply steal money, but rather to deliberately create chaos and undermine trust.

Some attackers would not be so vocal. One who is more motivated to act in the opposite way might do so. Due to their access to a Quantum Computer, they can steal money from old UTXOs that have been forgotten. The goal is to take as much money as possible, before other countries catch on.

The end result will be the same, whether it is a loud attack or if the attacker is slow. In a world post-quantum, the assumptions which secure Bitcoin no longer hold true. It is possible that the math which has protected Bitcoin since its inception could be broken by any machine, even if we haven’t seen it yet.

Quantum Computers: What They Really Break

The quantum computer we use today is not just faster. This is a completely different machine. This machine would not be faster than an ordinary computer for the majority of tasks. It would have enough power to cause a great deal of damage for specific problems.

Bitcoin digital signatures, such as Schnorr or ECDSA today, are based on something known as the Discrete logarithm Problem. Consider it as an unidirectional mathematical street. You can easily go in one direction but it’s very difficult to reverse. The reverse is almost impossible. You can generate a public or signature from a key that’s private, but you cannot do it the other way around. This is the reason you can safely share your public keys on blockchain, as it’s impossible for someone to reverse them and get your private key.

This assumption is broken with large quantum computers. The use of Shor’s AlgorithmA quantum attacker would be able to solve discrete logarithm problems. That’s right. “one-wayness” The old rules no longer apply. A hacker can deduce the private key for any public keys on the Blockchain.

Hard Choices, Big Trade-offs

It is not possible to find a perfect solution. There are some major tradeoffs in any plan designed to protect Bitcoin from these quantum attacks. Some of these are technical. Some of them are technical. They are all hard.

It is possible to create a type of output that relies only on post-quantum signings. You would use quantum-safe signatures from the start, instead of discrete logarithms that quantum computers could break. Anybody sending money to this address will know they’re choosing a stronger and future-proof form of security.

Size is a big factor. Post-quantum signatures can be huge and are often measured in bytes instead of kilobytes. Post-quantum Signatures are 40-600x larger than Bitcoin Signatures. A post-quantum sign could be the size of a digital photograph. It costs more to transmit them and to store them on the blockchain. HD wallets (multisig), basic key management and multisig setups may all become complicated or not work. It is still a research issue to do threshold signatures using post-quantum signs.

The proposal to go post-quantum is a related idea. Jameson Lopp, who proposed a fixed 4-year migration window. Give the Bitcoin eco-system a couple of years after the post-quantum signatures are introduced to allow it time to transition into outputs that will be quantum safe. Coins that are not moved after that date will be treated as being lost. It’s an aggressive strategy, but the deadline is clear and it gives time for network to adjust before a crisis occurs.

We’d rather rely on cryptography until the threats become more real. What is the plan if everyone agrees that Bitcoin requires a strategy?

Bitcoin is not something that anyone wants to risk with assumptions which aren’t proven. Bitcoin may already be a good starting point. Taproot!

Taproot’s Hidden Post-Quantum Safety

TaprootSince its introduction in 2021, has been praised for its improved privacy and performance. Many users are unaware that this technology could be used to smooth the transition from a quantum world into an after-quantum one.

Each Taproot output has a set of initially hidden alternative spending conditions. The alternative script paths will never be revealed until they are used. Currently, the majority of Taproot coin purchases are made using Schnorr Signatures. However, these hidden script paths could be used to do almost anything. This includes signatures that are post-quantum.

Matt Corallo was the first to promote this idea. Recent developments have also been made. Tim Ruffing of Blockstream Research published a paper Showing that the approach used is secure, fallback routes within Taproot are still reliable even in case Schnorr/ECDSA fail.

It opens up a powerful but simple upgrade path.

Step 1: Add Post-Quantum Opcodes

It is important to first introduce post-quantum support in Bitcoin script. Taproot could do this by introducing new opcodes which allow it to check PQ signatures using the algorithms that are currently being standardised and evaluated.

This allows users to create Taproot outputs that have two possible spending paths.

• Key-path still uses fast, efficient Schnorr Signatures in everyday usage.
• A post-quantum failback would be included in the script path, and only revealed when needed.

In the short-term, nothing changes. Coins are the same. If a quantum attack appears, there is a fallback.

The Kill Switch is Flipped.

Bitcoin may disable Schnorr or ECDSA later, in the event that a quantum computer of a sufficient size is created and this risk becomes real.

This kill button would prevent coins from being taken out of vulnerable outputs. Users can spend their coins as long as they have transferred them to Taproot outputs with post-quantum fallsbacks.

Transitioning to Taproot will undoubtedly cause friction. However, it should be much less stressful than scrambling at the last minute. Thanks to Taproot’s hidden script pathways, the majority of this work can be done in advance.

No Panic Preparation

Quantum threat has no clock. No one knows when the quantum computer breakthrough will occur. This breakthrough in quantum computing could take a decade or be closer. Everyone doesn’t know. 

This is not an easy task. Questions remain open about the post-quantum algorithms to use and whether they are efficient enough to be used with Bitcoin. Also, there is still the question of how we can preserve features such as threshold multisignature and key derivation. The most important part is that you start. Idealy, not when the first cryptographically significant quantum computer is built but while it’s still safe and there are upgrade options available.

We give our users plenty of time to prepare by enabling the post-quantum support in Bitcoin Script now. The education can be done gradually and without any panic. Users can migrate their coins at a pace that suits them. We lose this luxury if we delay too long. Under pressure, upgrades are rarely successful.

Tim Ruffing’s work presents a potential path for the future. Bitcoin has many tools that can be used to create a plan. You can read his article. full paper to understand how this works in detail.

Kiara Bickers from Blockstream is the author of this guest post. The opinions expressed by Kiara Bickers are their own, and not those of BTC Inc. or Bitcoin Magazine.