Quote from: ABCbits on June 26, 2025, 08:57:17 AM

Quote from: kanftka on June 25, 2025, 07:14:38 PM

If that fails maybe the key gets compromised, or ECDSA becomes weak, then there is a second way. That one uses a pre-committed post-quantum key, like Falcon or something similar. The idea is that a hash of that key is locked in, and in the future, the spender can reveal the proof and access the funds. I am still reading up on how best to handle the reveal side of things, since Bitcoin doesn’t verify PQ sigs natively, but the commit reveal approach seems like a reasonable fallback.

Quote from: kanftka on June 25, 2025, 07:14:38 PM

Now, in case everything else fails, no key, no PQ stuff, maybe the person managing it is even gone. The third option is where it gets interesting. This is where a simple hash of raw entropy comes in, something generated with dice rolls or coin flips and written down on paper. If that paper is kept safe and the longer time lock maybe 15 years is respected, then the person can recreate the preimage and spend the funds. It is like an emergency backup, something that doesn’t need any device, just good memory or good record keeping.

There's no OPCODES to verify signature that comes from different cryptography. So it seems 2nd and 3rd option feels same, where the proof is just quantum public key rather than quantum signature. And if you broadcast the TX publicly, there's risk of double spend (for theft purpose) since the spending condition is based on providing arbitrary data rather than signed signature. CMIIW.

Yeah I see what you’re saying. Since Bitcoin can’t actually verify post quantum signatures directly at least not yet, then yeah, both the second and third options pretty much fall into the same bucket, it is just about revealing some kind of preimage to unlock the funds. One is a hash of a PQ public key, the other is just raw entropy from dice rolls or whatever.

The main difference in my head was the intention behind them, like the PQ one feels more like a tech driven backup, while the raw entropy one is more like a last resort, human level backup. But yeah, if someone sees the reveal before you spend, they can absolutely front run it. That is the scary part.

Also, i’ve been wondering, is there any way to actually reduce that front running risk on Bitcoin? Like, are there ways to structure it so that even if someone sees the reveal, they can’t act on it before you do? Or is it just about being fast and maybe spending in the same block you reveal?

Also, do you think it is even worth messing with this stuff right now? Or should this kind of fallback structure just stay as theory until Bitcoin actually supports PQ signatures natively