Search content
Sort by
Showing 20 of 35 results by Adam_xx
Honestly i fail to see risk of quantum-computer towards BIP 39 mnemonic seed. There's no data which can be used by quantum-computer to perform attack. For comparison, Bitcoin address become vulnerable when it's public key is revealed.
Thanks. I agree with you. The best possible attack is probably simply the brute-forcing process which could be potentially (if QC will ever be that powerful enough) dangerous for 12word mnemonic seeds (Grover's algorithm could brute-force a 128-bit symmetric cryptographic key in roughly 2^64 iterations). Using 24word seed is probably safe.
Take note that since any bitcoin private key provides 128 bits of security, with increasing number of words in your seed phrase to more than 12, you don't increase your security.
Instead of trying to brute-force your seed phrase, the attacker can try brute-forcing the private key which provides the same security as a 12 word BIP39 seed phrase.
Instead of trying to brute-force your seed phrase, the attacker can try brute-forcing the private key which provides the same security as a 12 word BIP39 seed phrase.
Let's just focus on those words, not ECDSA security. If we assume there will be some post-quantum cryptography and we will make a new wallet, will it be safe to generate the new wallet from the old seed? That is my point.
⭐ Merited by ETFbitcoin (1)
Is it possible to somehow calculate how many SHA-256 hashes have all the miners calculated for the entire history of Bitcoin?
Last numbers I have seen from Pieter Wuille are from 2020:
With block 632874, around a day ago, the expected cumulative work in the Bitcoin blockchain surpassed 2^92 double-SHA256 hashes (with a standard deviation around 1.4*2^83).
Last numbers I have seen from Pieter Wuille are from 2020:
With block 632874, around a day ago, the expected cumulative work in the Bitcoin blockchain surpassed 2^92 double-SHA256 hashes (with a standard deviation around 1.4*2^83).
If a user wants to use the mnemonic seed words for his wallet even in a few years/decades/..., will the same 24word seed be safe even in the post-quantum era? According to the BIP39 standard, it is protected by the HMAC SHA-512 hash function, so we assume that it is quantum-resistant (at least 256 bits of security post-quantum?). Let's not talk if QC are a real "threat", what the PQC will look like but just discuss the safety of those 24 words.
1) Do you think that from a UX point of view it will be possible to keep the existing seed and just generate a new PQC keys with a new derivation path?
2) I assume users with 12 words (128 bits of entropy without passphrase) would have to migrate to 24 words (256 bits of entropy) as 128 bits entropy is probably reduced to only 64 bits with Grover's algorithm.
1) Do you think that from a UX point of view it will be possible to keep the existing seed and just generate a new PQC keys with a new derivation path?
2) I assume users with 12 words (128 bits of entropy without passphrase) would have to migrate to 24 words (256 bits of entropy) as 128 bits entropy is probably reduced to only 64 bits with Grover's algorithm.
also I think (fairly new thought) that HD keys that were reused could be soft-forked to require a Zero Knowledge proof of knowledge of the chain code and master even if the coin private key was public information. (and soft-fork made not be spendable with direct ECDSA.).
I wonder how something like this could work considering the fact that any information provided based on hashes that could reproduce the keys could be duplicated by the other parties that are trying to steal the same coins.That is the purpose of ZKP, isn't it? You provide a proof that you know some information without actually revealing it (and so nobody can duplicate it if you are the only one who knows the hash).
But I am not sure how P2PK worked. Has the public key changed every time for early wallets?
The same as any other output script but instead of using hash of public key you use the same public key. It could be reused or the wallet could produce a new pubkey for every new payment (which was the default).So the default was that the mining reward of 50 BTC was sent to a different public key each time?
It would favor the scenario of "gradual breaking" the keys rather than "grab all at once".
Also what comes into my mind at the moment - it is true that a huge amount of coins are sitting in P2PK outputs in chunks of 50 BTC coins, however, it an attacker manages to get a private key from one of the early addresses (on which there are these chunks of 50 BTC coins) he would be able to steal a big portion of coins at once.
That is why i think only these two scenarios are realistically possible:
Quote
Or ECDSA/Schnorr will be phased-out much sooner before it is dangerous to use (e.g. a couple of decades) and when we get to the situation of a quantum computer attacking the old coins the consensus for locking the old outputs will be much easier to reach.
Or we just let all the coins like they are. And the market will absorb the multi-year lasting inflow of stolen coins.
Or we just let all the coins like they are. And the market will absorb the multi-year lasting inflow of stolen coins.
Another factor that would affect the decision whether to lock the coins or not would be the total amount that would be affected by the vulnerability. It is not just P2PK outputs, it is all the reused addresses that have revealed their public key and still have a balance and all the new outputs that start using public keys again like P2TR outputs or any other output type that contains public key like P2MS. For example if it affects a quarter of bitcoin total supply (5-6 billion BTC) then it is a serious issue to let them be "stolen".
There is probably a solution for reused addresses if they are a part of HD wallets so the problem might be "just" with very old P2PK and reused addresses from non-HD wallets. That is currently at least 2 mil. coins but not all of them are lost. The breaking process will probably not be so fast as o_e_l_e_o pointed out, at least in the beginning (and if ever, of course). The economical effect could really be similar to mining. If we look at exchange inflows for the last couple of days the amount of coins changing hands is huge (and still survivable). If BTC can survive such scenario without need to lock the coins (or lock but introduce a way to claim them by ZKP) it would be good.
There is a quote from Adam Back's tweet:
also I think (fairly new thought) that HD keys that were reused could be soft-forked to require a Zero Knowledge proof of knowledge of the chain code and master even if the coin private key was public information. (and soft-fork made not be spendable with direct ECDSA.).
-----
Of course there is a problem that chain code / master is sometimes known by the wallet providers, etc. And the issue with P2PK and non-HD coins still persists. But at the same time I suppose this claiming process will not be used so much because every rational person would move their coins way long before they become vulnerable. But the option to move coins even when ECDSA is no longer supported would be nice.
Or ECDSA/Schnorr will be phased-out much sooner before they become vulnerable (e.g. a couple of decades) and when we get to the situation of a quantum computer attacking the old coins the consensus for locking the old outputs will be much easier to reach.
It is difficult for me to imagine that a consensus on this would be somehow reached. I have been asking this theoretical question for a couple of months now and the community is divided almost like 50/50. Even the developers have different opinions (Pieter Wuille/Adam Back would probably prefer locking the coins, Jimmy Song favors letting them be stolen, etc.). So if the situation occurs anytime in the future there will be a huge controversy. If attacking the keys is slow the result would be probably "just" a bear market. If it is fast and huge amount of coins will flood the market I am afraid it would really endanger the existence of Bitcoin.
Mulling this, I am quite confident that a practical post-quantum ZK proof emergency salvage system could be designed not based on seed derivations, but for all UTXOs that require unrevealed public keys. This includes P2SH/P2WSH. The only coins that could not be safely salvaged are those in addresses with known public keys: Reused P2PKH/P2WPKH, all P2TR, reused P2SH/P2WSH multisig, etc. (About those, I absolutely agree with you that coins vulnerable to theft cannot be locked or seized; the idea flies in the face of all that Bitcoin means!)
But what about all those other UTXOs (reused P2PKH/P2WPKH, P2TR, reused P2SH/P2WSH multisig)? I think that is the main dilemma here. I would quote Pieter Wuille here: "If a QC can ever spend lost ECC-locked coins, I believe it's game over for Bitcoin. How can an asset maintain value if an attacker has the ability to flood the market with the significant portion of the entire supply?".
I don't like the idea of some coins being locked by consensus, however, Pieter has a point that the economical impact of flooding the market with all these coins could be unsurvivable.
⭐ Merited by ETFbitcoin (2)
If it is e.g. 2 million coins being stolen in small chunks for 10 years, the effect on price would not be so significant.
Coins are not going to be stolen in small chunks like that, they're either going to be stolen in quick succession because commercial quantum computers can in fact break SHA256, or they are not going to be stolen at all, because as it turns out, quantum computers cannot break SHA256 yet.
There are only two possible outcomes.
SHA-256 is not quantum endangered as far as I understand the topic (just a little speedup with Grover's algorithm).
We are talking here about ECC vulnerabilities (Shor's algorithm/lattice attacks).
And breaking each key can be quite a long process (= it is not the winner takes it all in "quick succession").
So maybe altogether 2-3 mil. is accurate.
It's closer to 4 million vulnerable coins, according to this study: https://www2.deloitte.com/nl/nl/pages/innovatie/artikelen/quantum-computers-and-the-bitcoin-blockchain.htmlIt was done around 2 years ago, but you can see from the graph halfway down the page that the number has fluctuated around the 4 million mark for ~8 years, so I suspect it is still around the same. P2PK outputs are essentially constant and unchanging, while reused P2PKH addresses have slowly fallen as reused P2WPKH addresses have slowly increased. And of course we can now add in P2TR outputs as well.
4 million currently vulnerable but people would migrate.
Not all 4 million from the study are coins with lost private keys.
If it is e.g. 2 million coins being stolen in small chunks for 10 years, the effect on price would not be so significant.
What do you think?
It can only be seen from this thread that opinions on this are very different (relevant points on both sides).
For this reason, I think that forming a new consensus would not be reached and the default situation (letting the coins be stolen) is the most likely outcome.
For this reason, I think that forming a new consensus would not be reached and the default situation (letting the coins be stolen) is the most likely outcome.
Let's say there are even 2-3 mil. coins that are lost (nobody has private keys anymore).
Note that there are addresses with revealed public keys that do have a balance and aren't P2PK outputs, such as 1P5ZEDWTKTFGxQjZphgWPQUpe554WKDfHQ. Those are in the same danger as well if their owners don't move them to a quantum-safe address. Yeah, I know, as stated in my post.
Also P2TR outputs are in the same danger.
So maybe altogether 2-3 mil. is accurate.
The damage (of course if that happens at all) depends on the speed of breaking the keys.
Whatever the circumstances, there's going to be a lot of split opinions when it comes to the proper discussion definitely.
Which is why I think what will probably happen is the scenario I've described above, where lost coins are gradually stolen and re-enter circulation. If we can't reach a consensus on some other solution, then this is the default position which will happen if we do nothing, as Adam_xx points out above.I agree with that. Let's say there are even 2-3 mil. coins that are lost (nobody has private keys anymore). If the stealing lasts 10 years it's like mining with current block subsidy at that time (approx. 328.500 BTC is currently mined per year).
And to be honest, I don't think that many coins are lost and thus would stay on vulnerable addresses.
Of course, if the attacker manages to crack keys from dozens of thousands P2PK UTXOs within a couple of months it could be disastrous (pricewise).
FYI: there is currently 1.73 mil. BTC on 48.000 P2PK UTXOs.
Quote
The surprise to the system would be similar to Satoshi or some other early miner returning and suddenly moving a few hundred thousand or even million bitcoin which have been dormant for 12+ years. And that could happen at literally any time, and there is nothing we can or should do to prevent it. Assuming that coins which have not moved in a long time are lost permanently is wrong, although I'll concede that many users in the market do assume just that.
Totally agree with that. And Satoshi selling all his coins would be destructive as well.
But we assume it won’t happen (selling, not moving). But would it be the case for anybody else?
Would this selling pressure be recoverable?
By the time something is capable of breaking it within minutes, Bitcoin could have well have moved on so much, that the old chain is considered obsolete, or alternatives people themselves might have found an alternative to Bitcoin.
Well, I suppose (and hope) that the UTXO set (or basically the "ownership database" in any future form) will be preserved even if there is a completely new technology and the system moves the Bitcoin's UTXO set into it. But that is for another discussion
Quote
Inflation pressure? There's no inflation pressure, and will never be. Provably lost coins are lost, gone, removed from circulation. Period. Non-provably lost coins aren't removed, they're just trapped. No one should assume they won't return into circulation, and in fact, we, overtime, observe some decade-old, dusted, 50 BTC worth outputs being spent, which reveals that these coins are falsely assumed as lost.
The system begun with the presumption that someday it'd reach a number less than 21 million coins, without any arbitrary monetary policy, and so it is.
The system begun with the presumption that someday it'd reach a number less than 21 million coins, without any arbitrary monetary policy, and so it is.
You are absolutely correct, inflation was not a correct word at all. But let's say the market counts non-provably lost coins as provably lost-coins (and might be surprised one day).
Quote
but flooding the market with so many coins could be massively disruptive
That's why I think if someone will suddenly move a lot of coins, then the consensus will quickly form around burning all of them, by providing valid signatures. In economical sense, other forks could be just cheaper and lose Proof of Work support from miners.But how do you distinguish legitimate users from "thieves"? The legitimate/stealing transactions will both have a valid signature.
If there is ever a consensus to lock the coins I guess the only way would be to block the UTXOs (to block all coins with vulnerable signatures, not just some chosen coins) after a long period of alert (e.g. a decade) before the attack itself, not after the coins have already moved. After some block height, only coins on new and safe addresses will be movable. But even for this scenario I can't imagine reaching a consensus for the reason below:
If you can burn or lock coins for arbitrary reasons, then you have proven that you can manipulate the ledger, after which it will never be long until censorship rears its regular head.
No one knows if the key break will take minutes, hours, weeks, years but I suppose it won't be one entity takes it all with a single attack in a single day.
And if the stealing lasts years or decades in small chunks nobody can prevent inflation pressure on Bitcoin, unfortunately.