Quote from: coinpeculiator on March 19, 2013, 12:20:20 PM

Quote from: Come-from-Beyond on March 15, 2013, 06:34:41 AM

As we all know elliptic curve cryptography is vulnerable to a quantum computer. For a conventional computer difficulty of breaking 256-bit key equals 256/2=128 bits. For a quantum computer it's just sqrt(256)=16 bits.
Bitcoin address is a hashed public key of 256-bit EC. Hashes are resistant to quantum algos, so while someone keeps his public key unknown it's OK. But when he wants to transfer his money he must reveal the key.
Let's assume that an attacker with a quantum computer monitors all transactions. The attacker can pick any key while a transaction awaits to be included into a block. Now imagine that miners choose transactions with higher fees. The attacker can issue other transaction (when he picks the private key) that transfer coins to his address and set a higher fee. Or he could switch his mining rig on and try to find a block himself. With 0.1% of all hashpower he needs only 5 days to solve a block with 50% chance.

Seems Bitcoin is NOT safe. Or am I wrong?

If this attack were ever to become a potential threat it would be simple to avoid being a victim without altering the protocol but just with client behavious change. So with your theory, after you do a transaction from an address a quantum computer could break the private key from the transaction and use the remainder of bitcoins in that address.

The answer is not to leave any coins on that address... so when you want to make a payment you give it two outputs, one to the person you want to pay, and the other output is your next generated address which has no transactions to crack.

No. I meant the key could be picked while a transaction is unconfirmed, so an attacker could double-spend the coins. Two outputs won't help.