Post
Topic
Board Development & Technical Discussion
Merits 6 from 2 users
Re: QC threat on electrum "spawnable" type wallets vs old wallet.dat
by
nc50lc
on 14/06/2025, 05:37:46 UTC
⭐ Merited by pooya87 (4) ,vapourminer (2)
-snip- Because if you've got someone's public keys, couldn't you use those to try to derivate the master private key?
No, a theoretical QC Computer powerful enough for that would need its pair Master Public Key.
And it's not available in watch-only nor locked wallets' descriptors but its child "extended public key" derived at m/84h/0h/0h (e.g. for bech32)

Since your concern that the entire HD wallet's keypool could be compromised if once a child private key is successfully calculated by a QC machine;
It'll only work if the hacker also knows its parent extended public key due to the weakness of unhardened derivation of child keys at 'chain_index' and 'address_index'.
For that, the attacker also needs to get access to the user's machine to succeed. (like a cold-storage set-up's online watch-only wallet)

So, I think the more interesting question is: "Would it be better to go back to hardened address derivation like the old HD wallets?"
It will prevent the case I described above but it'll limit the capabilities of the current version that utilizes those unhardened xpub like being able to create HD watch-only wallets for Cold-storage setups.
Anyways, if someone can get access to a machine like that, the owner has bigger problem than QC.