Post
Topic
Board Development & Technical Discussion
Re: Bitcoin must upgrade or fall victim to quantum computing in 5 years
by
stwenhao
on 19/08/2025, 03:59:31 UTC
Quote
its blockchain is space-limited, and thus a transition to a post-quantum algorithm which requires more space would bring a shift in its economics
It can be solved in two ways: first is hiding quantum signatures behind existing ECDSA signatures. Which means, that quantum-safe addresses will take exactly the same on-chain space as today, as long as ECDSA is still strong, and longer validation time, or bigger signatures will be shared, only when quantum alert will be broadcasted, and when old ECDSA transactions will be non-standard, timelocked, or unspendable.

Another way is signature aggregation: now, Taproot can already be used to aggregate many signatures into one, as long as all of them commit to the same message, and the sum of public keys is equal to the on-chain shared key. Which means, that if quantum signatures will be aggregated, then by having more than one user per UTXO, it can scale, even if the maximum size of the post-quantum chain will be similar to the current version (if you have thousands of users per signature, then a single 50 kB signature means around 50 bytes or less per user).

Also, I think we should focus more on sigops limit, than on the block size limit. We now have 80k sigops per block, where legacy signatures take 4 sigops, and witness signatures take 1 sigop. It is just a matter of setting quantum commitment size, and the number of consumed sigops per quantum signature.

Quote
If we had a quantum secure algorithm with signatures/public keys roughly as large as the ECDSA keys/signatures (and not much costlier to validate like in the case of SQIsign), then it would be also much more straightforward to plan a transition.
It is chicken and egg problem: before SHA-1 was attacked, people didn't know, how to properly make hardened version of it. Which means, that it is quite likely, that ECDSA will behave in a similar way: when practical attacks will materialize (or at least PDFs describing practical attacks), only then we will know, how to turn ECDSA into "hardened ECDSA". And it is quite likely, that something will be already deployed, so we will be stuck with ECDSA, and some slow quantum signature scheme, with big signatures, and only practical attacks will tell us, where to look, and how to protect things. And then, we could have hardened ECDSA, and some inefficient quantum scheme. Which is yet another reason, to think about downgrade from quantum, because it is quite likely, that something better will be invented, and we may need to switch from quantum proposal A, to quantum proposal B.