Quote from: Vigme86 on January 02, 2018, 04:02:08 PM

Quote from: haltingprobability on December 24, 2017, 05:55:57 PM

3) For certain kinds of problems, QC can provide quadratic speedup, which is a massive speedup. For symmetric ciphers, this probably just means you double your key size - where 128 bits of security used to be sufficient, now you need 256. No big deal. The real problem is with public-key encryption. But lay-people often forget that the quantum speedup blade cuts both ways. We can build encryption systems which take advantage of quantum speedup and make quantum cryptanalysis of PKE quadratically more difficult, mooting the theoretical advantage that cryptanalysts get from quantum speedup. In fact, this is why Bitcoin uses the public-key hash instead of the public-key itself and recommends against address-reuse; in the event of working, at-scale QC, your coins are still secured behind 128-bit-equivalent security as long as you don't reuse addresses or publish the public-keys for your addresses.

...

I'm sorry to short your message but I would know at the underlined sentence if I have good understood the point.
The fact that Public Key and Bitcoin Address are different is not a safeguard against Quantum computing, because when you sign a transaction you are revealing on the blockchain your Publickey, so that Adress can be exposed to QC attack, is that correct?

My doubt is when you speak about "address-reuse": what do you mean with that? I have a cold storage paper wallet ecrypted via BIP0038 where I periodically put some cash into that. I've never spent BTC on that but there is not a single but multiple input transactions, so there are multiple utxo transactions on the blockchain. Until I don't spend bitcoin is it still secured or not? Should I use a cold storage paper wallet for every transaction?

Thanks in advance

In this particular context (but see below), address reuse means reuse of an address from which you have spent. Transactions to your address contain the public keys of whoever sent you the moneynot your public key. But the only information revealed in the blockchain when you receive money is the Hash160 (RIPEMD160 of SHA256) of your public key. That is what haltingprobability referred to as the public-key hash in the portion you underlined.

(For the sake of simplicity, I here assume only P2PKH and P2WPKH addresses. What do these stand for? Pay To (Witness) Public Key Hash.)

But this discussion misses the point that the security of public keys is just fine. It seems that you missed this upthread:

Quote from: haltingprobability on December 24, 2017, 06:55:43 PM

Quote from: nullius on December 24, 2017, 06:39:37 PM

There are excellent reasons to avoid address reuse; but this is not one of them. I say this as a paranoid security nut: The security of publicly disclosed public keys is just fine. That is why they are called public keys. The only exception I would here make is if you have coins which you intend to potentially leave in cold storage for decades. Then, yes, you will want the extra security margin of the key being unpublished.

Bingo.

Do you intend to leave the coins in cold storage for decades? If so, then I recommend that you do what you said youre doing: Use the addresses for receiving only. Not that I expect for secp256k1 to be broken: If storing something for decades (or longer), I prefer some extra security margin just in case.

Otherwise, there is no reason to worry about revealing the public key. secp256k1 is secure. You may rely on it.

But there is another, very different reason to avoid reuse of addresses for both sending and receiving: Privacy. Blockchain analysis is already easy enough for experts. Address reuse of all kinds makes it trivial.

To start with, for a bare modicum of privacy, use one HD wallet with the seed and keys generated (and backed up!) on an airgapped computer; and from that wallet, use a different address every time you receive money. This recommendation has nothing to do with the security of your money against attacks on public keys.