Quote from: d5000 on July 20, 2025, 03:07:55 PM

Quote from: pooya87 on July 20, 2025, 03:32:20 AM

The way I see it is that if there is even a small possibility of reversing a public key to get the private key, and we still haven't migrated to a resistant protocol (a hard fork), then Bitcoin will have had become obsolete!
That means the warning you are talking about is either pointless (meaning it is impossible to reverse pubkey and reusing your address doesn't put you at any risk) or it is not a warning (bitcoin is already over and you shouldn't even be using it anymore).

Sorry, I don't understand your logic here. Migrating vulnerable coins to fresh addresses is something everybody can do now. And then they are safe until quantum computers are so fast that they can compute a private key in less than an hour [1]. That will take several (probably dozens of) millions of qubits.

The threat that a quantum computer attacks coins with a published public key (due to address reusage or P2PK etc.) is much less far away in the future, and can perhaps be performed in the next decade. If this kind of attack can target 25% of all coins, then it's much more likely to be disruptive for the market, than if it only can target Satoshi's coins and a few lost coins more. In addition, we would see an epic blockchain congestion as everybody (of those who own vulnerable coins) would try to move their coins after the attack has been discovered. This could be a dramatic blow for Bitcoin (even if it's unlikely to be its "death").

For me, the ideal migration path is: first nudging users even more to not reuse addresses, like with such warnings like proposed in this thread, to reduce the number of vulnerable coins, and then implement post-quantum cryptography optionally once it is mature enough and we have a clear candidate. In the mailing list discussion unfortunately there were some objections from cryptography experts against Falcon-512 which is the most convenient candidate as of now. They would prefer Sphincs+ but this one has even (much!) larger signatures.

Quote from: Satofan44 on July 20, 2025, 01:19:22 PM

Do you have any data sources for this? I'm interested to know in specifics like how many Bitcoin exactly are contained in the old outputs.

I took the number of 25% from this post in the thread about Jameson Lopp's draft BIP. I thought Lopp himself had given a number in his blog post but there's only one part where he cites a social media post about 3.7 million lost BTC and a comment about vulnerable coins in the rich list. I have read about similar numbers in the past (around 5 million if I remember correctly). If you google, you'll see the 25% in several articles. Google Gemini even talks about 32% (6.5 million).

The source for the 25% seems to be a Deloitte report from 2020, which also has a chart about the number of coins in specific outputs.

A substantial part of these vulnerable coins according to Lopp's blog post sit in exchange cold wallets, which are often multisig-secured and thus at least a little bit harder to crack. But I think exchanges and other big service providers (ETF custodians ...) would anyway be the first entities to be incentived to abandon address reuse forever once the quantum threat becomes real.

I think it would be worthwhile to do a deeper analysis of this situation, Deloitte are just surface level expensive experts. Since the situation with technical solutions is likely to be at least somewhat controversial based on the recent proposals and they are going to take some time, it would be good to have a social approach happening in parallel. It would be worthwhile to analyze exactly how many UTXOs are old or dead and how many are being actively used right now. A social campaign that highlights this danger could help to lower the amount of coins that are exposed.

Do you have an idea what an exchange could do instead of their current setups? I don't think not reusing cold storage wallets is feasible for them right now. Multisignature helps but is that all that we have on the table right now?

Quote from: d5000 on July 20, 2025, 03:07:55 PM

[1] I think the real danger for this "short exposure" or "mempool" attack will start when QCs are fast enough for cracking a key in 30 minutes or less. They could speculate to be lucky and attack keys hoping for a block taking an hour, but they would waste a lot of resources because the probability for such a long block time is quite low. So I think as superfast QCs will be expensive in that stage, attackers would not start with "mempool attacks" until they are so fast that the effort probably will result in a success at least several times a day.

I think that getting from it is possible to mempool attack is another big leap, and we are not even yet at the level of possible. It is just expected to happen in the near future. Anyhow for those that are really concerned for this just make a strong multisignature wallet. Something like 4 out of 5. You can store all the keys in the same location since the setup is only employed for the purpose of dealing with this type of attack.