The threat of a Cryptographically Relevant Quantum Computer (CRQC) has historically sat at the edges of technical discussions in the Bitcoin community. For many, a CRQC represented a risk that was hard to quantify and easy to dismiss, clouded by imprecise, narrative-driven hype.
Over the past year, the Overton window on the subject has begun to shift. Two recent publications, taken together, significantly lower the bar a CRQC must clear to attack 256-bit elliptic curves. While these findings are only theoretical, they, along with other conversations that have begun to take place in the Bitcoin community, have meaningfully shifted the perspectives of many from “will a CRQC exist?” to “can anyone be sure one won’t?” This aligns with narratives shared in the wider cryptography community. As Filippo Valsorda put it, the bet isn’t whether you’re certain a CRQC will exist but whether you’re certain it will not.
For Bitcoin, this risk calculation is uniquely complex. Bitcoin is as much a social system as a technical one, and no single party can decide how it migrates. Reaching that alignment takes time, which is why the problem must be studied and debated well ahead of a CRQC’s arrival.
There are also the risks of excessive delays in addressing the problem or ignoring it outright. The perception that migration is not being taken seriously can erode the trust of those who do. In a system held in balance by consensus, eroded trust is rarely idle. It tends to find expression in competing plans, and in the ambitions of those who would prefer to set the terms themselves.
To ensure Bitcoin is prepared and to avoid adversarial outcomes, many in the community are contributing resources to the Post-Quantum Problem (PQP). Part of that process includes bringing together the individuals and groups thinking about this problem in-person for meaningful, collaborative discussion. This is why in late August, we co-hosted a workshop with Dan Boneh and Coinbase.
Transcripts of the event can be found here. We’d like to use this blog post as an opportunity to summarize some of the perspectives shared in the talks and sessions held throughout the day.
Dan Boneh opened the morning with a narrative similar to the one we just described: he believes that asking when a CRQC will arrive is the wrong question. Instead, we should focus on how Bitcoin manages the risk of a CRQC, today.
To help set a baseline for attendees, Dan gave a brief background on candidate PQ signature families, with a special focus on hash-based signatures which have captured the attention of the Bitcoin and Ethereum communities. While he lamented the loss of algebraic structure under this regime, he understands that in the near term they are quite attractive given their minimal assumptions. He covered how they work at a high level, some of the tradeoffs the community should expect (e.g. statefulness, loss of non-hardened HD derivation), their parameterization, and how they can be thresholdized.
Dan ended his talk on a hopeful note, presenting a possible future in which Bitcoin first adopts hash-based signatures and later introduces support for a more powerful scheme that may not yet be invented. He assured the group that there is no proof that compact and powerful post-quantum signature schemes are out of reach, and encouraged the Bitcoin community to continue researching and fighting for its needs.
Our second talk was from Ethereum researcher Antonio Sanso. We invited Antonio because, while Ethereum’s PQP is not exactly the same as Bitcoin’s, it has a similar shape, and an exchange of information between the ecosystems benefits both.
One notable takeaway was the work being done by the Ethereum community to make hash-based signature generation more efficient on minimally resourced devices such as hardware wallets. SPHINCS-G, a SPHINCS variant, moves publicly computable work off the secure element at the cost of reworking the security proof. Bitcoin faces similar constraints, and it was a useful preview of Charles Guillemet’s session later in the day. It was also interesting to hear about Ethereum’s focus on full-block non-interactive signature aggregation, a conversation that is happening in Bitcoin circles, albeit as an idea that is further afield.
We then heard from Yehuda Lindell, Coinbase’s head of cryptography. He spoke from two vantage points at once: that of a business whose revenue depends on investor confidence, and that of a cryptographer responsible for securing bitcoin at institutional scale.
Yehuda voiced the concern that Coinbase’s customers “can’t distinguish signal from noise,” and that because a CRQC cannot be ruled out with certainty, institutional involvement and investment are being dampened. In his view, the way to address this is for the community to come together and develop a compelling migration plan. The biggest risk, he said, is inaction.
On the technical side, he shared the MPC strategies Coinbase uses to secure customer funds. Notably, they adapt well to lattice schemes but break down in the context of hash-based signatures on two axes: inefficient MPC and state management. While hash-based signatures are built on conservative assumptions, he noted that the implementation and deployment complexities may undermine that very premise.
We finished the morning with a panel discussion focused on the design of output types that are both post-quantum and migration friendly. Justin of Localhost moderated the discussion between Pieter Wuille, conduition, and the attendees.
While the first half of the discussion focused on the tradeoffs between the P2TRv2 and P2MR proposals, participants acknowledged that both face the same underlying dilemma: allowing a CRQC to sweep vulnerable coins breaks Bitcoin’s most basic guarantee; freezing them breaks another. To minimize this risk, we must quickly design and deploy output types that support a post-quantum signature scheme, encourage migration, and let users opt in to the disablement of ECC spending.
After lunch, we congregated for a number of breakout sessions.
Jonas Nick led a session on SHRINCS, a hash-based scheme that blends stateful and stateless signing: a device that signs only a few times gets compact signatures, and importing the seed elsewhere falls back to a larger stateless path. Most of the discussion centered on the state itself and the ways it can go wrong: replay, signers sharing a seed, state scattered across many UTXOs, and seed-only recovery, which is awkward because the identifier needed for the stateless path is not derived from the seed.
Charles Guillemet shared Ledger’s perspective as a hardware wallet manufacturer and the practical constraints that come with it. He presented benchmarks, warned of the cost of signature schemes that require large numbers of hashes at signing time, and noted that while SHRINCS is an elegant design, stateful signature schemes turn “every backup, every restore, every firmware update into a potential security incident,” an operational burden that does not match the user model of a universal hardware wallet. It was another warning to the community that statefulness is a design pattern that will not work, or worse, will cause loss of funds, in many contexts.
conduition led a breakout session on DropKick, a post-Q-Day recovery protocol for certain classes of vulnerable coins. After describing the scheme, discussion focused on its underlying tradeoffs, its operational and game-theoretic complexities, and the nature of the knowledge asymmetries that make the protocol possible.
Dan Boneh also led a session on lattice signatures, giving the group a 101 on how they work. After the event, Marathon sponsored a dinner at a local restaurant, where we continued discussing the PQP late into the night.
Overall, the event was a huge success. We’re extremely grateful to all those who participated in the discussions, gave presentations, and facilitated breakout sessions. To those who traveled from afar, thank you for making the trip. And a special thank you to our co-hosts, Coinbase and Dan Boneh, for motivating this workshop.
Looking forward, we hope this workshop serves as a jumping-off point for future events that push forward our collective understanding of the PQP and how to tackle it.
The threat of a Cryptographically Relevant Quantum Computer (CRQC) has historically sat at the edges of technical discussions in the Bitcoin community. For many, a CRQC represented a risk that was hard to quantify and easy to dismiss, clouded by imprecise, narrative-driven hype.
Over the past year, the Overton window on the subject has begun to shift. There were two publications released that, when taken together, significantly lower the bar a CRQC must clear to attack 256-bit elliptic curves. While these findings are only theoretical, they, along with other conversations that have begun to take place in the Bitcoin community, have meaningfully shifted the perspectives of many from “will a CRQC exist?” to “can anyone be sure one won’t?” This aligns with narratives that have been shared in the wider cryptography community: as Filippo Valsorda put it, the bet isn’t whether you’re certain a CRQC will exist but whether you’re certain it will not.
For Bitcoin, this risk calculation is uniquely complex. Bitcoin is as much a social system as a technical one, and no single party can decide how it migrates. Reaching that alignment takes time, which is why the problem must be studied and debated well ahead of a CRQC’s arrival. Delay carries its own risk. The perception that migration is not being taken seriously erodes trust, and in a system held together by consensus, eroded trust is rarely idle. It tends to find expression in competing plans, and in the ambitions of those who would prefer to set the terms themselves.
With these calculations in mind, many in the community are contributing resources to the Post Quantum Problem (PQP). Part of that process includes bringing together individuals and groups thinking about this problem in-person for meaningful, collaborative discussions. In late August, we co-hosted a workshop alongside Dan Boneh and Coinbase with this specific intention.
Transcripts of the event can be found here. We’d like to use this blog post as an opportunity to summarize some of the perspectives shared in the talks and sessions held throughout the day.
Dan Boneh opened the morning with a narrative similar to what we just described: he believes that asking when* a CRQC will arrive is the wrong question. Instead, we should focus on how Bitcoin manages the risk of a CRQC.
To help set a baseline for attendees, Dan gave a brief background of candidate PQ signature families, with a special focus on hash-based signatures which have captured the attention of the Bitcoin and Ethereum communities. While he lamented at the loss of algebric structure under this regime, he understands that in the immediacy they are quite attractive given their minimal assumptions. He covered how they work at a high level, some of the tradeoffs the community should expect (e.g. statefulness, loss of non-hardened HD derivation), their parameterization, as well as how they can be thresholdized.
Dan ended his talk on a hopeful note, presenting a possible future in which Bitcoin first adopts hash-based signatures and later introduces support for a more powerful scheme that may not yet be invented. He assured the group that there is no proof yet that we cannot recover compact and powerful signature schemes that are post-quantum, and encourages the Bitcoin community to continue researching and fighting for its needs.
Our second talk was from Ethereum researcher Antonio Sanso. We invited Antonio because while Ethereum’s PQP is not exactly the same as Bitcoin’s, it has a similar shape and it’s useful to have an information exchange between the ecosystems.
One notable takeaway from the talk was the work being done by the Ethereum community to make hash-based signing operations more efficient in minimally resourced devices (e.g. hardware wallets), via SPHINCS-G, a SPHINCS variant that moves publicly computable work off the secure element (at the cost of reworking the security proof). Bitcoin faces similar constraints and it was a useful preview of Charles Guillemet’s session later in the day.
We then heard from Yehuda Lindell, Coinbase’s head of cryptography. He spoke from two vantage points at once: that of a business whose revenue depends on investor confidence, and that of a cryptographer responsible for securing bitcoin at institutional scale.
Yehuda voiced the concern that their customers “can’t distinguish signal from noise,” and that because there is no certainty with which a CRQC can be ruled out, institutional involvement and investment is being dampened. The way to address this concern is for the community to come together and develop a compelling migration plan.
On the technical side, he shared the MPC strategies that Coinbase uses to secure customer funds. Notably, they are adaptable to Lattice schemes, but breakdown in the context of hash-based signatures on two axes: inefficient MPC and state management. While hash-based signatures are built on conservative assumptions, he noted that the implementation and deployment complexities may undermine that very premise.
We finished the morning with a panel discussion focused on the design of output types that are both post-quantum and migration friendly. Justin of Localhost moderated the discussion between Pieter Wuille, conduition, and the attendees.
While the first half of the discussion focused on some of the tradeoffs between the P2TRv2 and P2MR proposals, contributors to the discussion acknowledged that both proposals face the same underlying dilemma: allowing a CRQC to sweep vulnerable coins breaks Bitcoin’s most basic assumption; freezing them breaks another. To minimize this risk, we must quickly design and deploy output types that support a post-quantum signature scheme, encourage migration, and enable users to opt-in to the disablement of ECC spending.
After lunch, we congregated for a number of breakout sessions.
Jonas Nick led a session on SHRINCS, a hash-based scheme that blends stateful and stateless signing: a device that signs only a few times gets compact signatures, and importing the seed elsewhere falls back to a larger stateless path. Most of the discussion centered on the state itself and the ways it can go wrong: replay, signers sharing a seed, state scattered across many UTXOs, and seed-only recovery, which is awkward because the identifier needed for the stateless path is not derived from the seed.
During Charles Guillemet’s breakout session, he shared Ledger’s perspective as manufacturer of hardware wallets and the practical constraints they are faced with. He shared some benchmarks and warned of the cost of signature schemes that require significant amounts of hashes at signing time, and noted that while SHRINCS is an elegant design, stateful signature schemes “turn every backup, restore and firmware update into a potential security incident, and that the operational complexity does not match the user model of a universal hardware wallet.” Another warning to the community that statefulness is a design pattern that will not work (or worse yet, will cause loss of funds) in many contexts.
conduition led a breakout session on DropKick, a post-q-day recovery protocol for certain classes of vulnerable coins. After describing the scheme, discussion focused on its underlying tradeoffs, operational and game theoretic complexities, as well as the nature of some of the knowledge asymmetries that make the protocol possible.
Dan Boneh also led a session on Lattice signatures, giving the group a 101 on how they work. After the event, Marathon sponsored a dinner at a local restaurant, where we continued discussing the PQP late into the night.
Overall, the event was a huge success. We’re extremely grateful to all those who participated in discussion, gave presentations, and facilitated breakout sessions. To those who traveled from afar, thank you for making the trip. And a special thank you to our our co-hosts Coinbase and Dan Boneh for motivating this workshop.
Looking forward, we hope that this workshop will be used as a jump-point for future events that push forward our collective understanding of the PQP and how to tackle it.