The threat of a Cryptographically Relevant Quantum Computer (CRQC) has historically sat at the edges of technical discussions in the Bitcoin community. For most, a CRQC represented a risk that was hard to quantify and easy to dismiss, clouded by imprecise, narrative-driven hype.
Over the past year, the Overton window on the subject has begun to shift. Two recent publications, taken together, significantly lower the bar a CRQC must clear to attack 256-bit elliptic curves. While these findings are only theoretical, they, along with other conversations that have begun to take place in the Bitcoin community, have meaningfully shifted the perspectives of many into alignment with narratives shared in the wider cryptography community. As Filippo Valsorda put it, the bet isn’t whether you’re certain a CRQC will exist but whether you’re certain it will not.
For Bitcoin, this risk calculation is uniquely complex. Bitcoin is as much a social system as a technical one, and no single party can decide how it migrates. Reaching consensus takes time, which is why the problem must be studied well ahead of a CRQC’s arrival.
Delaying action or ignoring the problem carries risks too. People who take migration seriously may lose trust in a system they believe is dismissing their concerns. Where that system depends on consensus, this can encourage groups to attempt activation of protocol changes before rough consensus is achieved.
To ensure Bitcoin avoids these types of outcomes, a growing number of community members have committed time and resources to the Post-Quantum Problem (PQP). Part of that process includes bringing together the individuals and groups thinking about the PQP in person for meaningful, collaborative discussion. This is why, in late August, we co-hosted a workshop with Dan Boneh and Coinbase.
Transcripts of the event are available online. We summarize some of the perspectives shared in the talks and sessions held throughout the day in the following writeup.
Dan Boneh opened the morning with a narrative similar to the one we just described: he believes that asking when a CRQC will arrive is the wrong question. Instead, we should focus on how Bitcoin manages the risk of a CRQC today.
To help set a baseline for attendees, Dan gave a brief background on candidate PQ signature families, with a special focus on hash-based signatures, which have captured the attention of the Bitcoin and Ethereum communities. While he lamented the loss of algebraic structure under this regime, he understands that the minimal assumptions make hash-based signature schemes attractive in the near term. He covered how they work at a high level, some of the tradeoffs the community should expect (e.g., statefulness, loss of non-hardened HD derivation), their parameterization, and how they can be thresholdized.
Dan ended his talk on a hopeful note, presenting a possible future in which Bitcoin first adopts hash-based signatures and later introduces support for a more powerful scheme that may not yet be invented. He assured the group that there is no proof that compact and powerful post-quantum signature schemes are out of reach, and encouraged the Bitcoin community to continue researching and fighting for its needs.
Our second talk was from Ethereum researcher Antonio Sanso. We invited Antonio because, while Ethereum’s PQP is not exactly the same as Bitcoin’s, it has a similar shape, and an exchange of information between the ecosystems benefits both.
One notable takeaway was the work being done by the Ethereum community to make hash-based signature generation more efficient on minimally resourced devices such as hardware wallets. SPHINCS-G, a SPHINCS variant, moves publicly computable work off the secure element at the cost of reworking the security proof. Bitcoin faces similar constraints, and it was a useful preview of Charles Guillemet’s session later in the day. It was also interesting to hear about Ethereum’s focus on full-block non-interactive signature aggregation, a conversation that is happening in Bitcoin circles, albeit as an idea that is further afield.
We then heard from Yehuda Lindell, Coinbase’s head of cryptography. He spoke from two vantage points at once: that of a business whose revenue depends on investor confidence, and that of a cryptographer responsible for securing bitcoin at institutional scale.
Yehuda voiced the concern that Coinbase’s customers “can’t distinguish signal from noise,” and that because a CRQC cannot be ruled out with certainty, institutional involvement and investment are being dampened. In his view, the way to address this is for the community to come together and develop a compelling migration plan. The biggest risk, he said, is inaction.
On the technical side, he shared the MPC strategies Coinbase uses to secure customer funds. Notably, they adapt well to lattice schemes but break down in the context of hash-based signatures on two axes: inefficient MPC and state management. While hash-based signatures are built on conservative assumptions, he noted that the implementation and deployment complexities may undermine that very premise.
We finished the morning with a panel discussion focused on the design of output types that are both post-quantum and migration friendly. Justin of Localhost moderated the discussion between Pieter Wuille, conduition, and the attendees.
While the first half of the discussion focused on the tradeoffs between the P2TRv2 and P2MR proposals, participants acknowledged that both face the same underlying dilemma: allowing a CRQC to sweep vulnerable coins breaks Bitcoin’s most basic guarantee; freezing them breaks another. To minimize the risk of either outcome, we must quickly design and deploy output types that support a post-quantum signature scheme, encourage migration, and let users opt in to the disablement of ECC spending.
After lunch, we spread out for a number of breakout sessions.
Jonas Nick led a session on SHRINCS, a hash-based scheme that blends stateful and stateless signing: a device that signs only a few times gets compact signatures, and importing the seed elsewhere falls back to a larger stateless path. Most of the discussion centered on the state itself and the ways it can go wrong: replay, signers sharing a seed, state scattered across many UTXOs, and seed-only recovery, which is awkward because the identifier needed for the stateless path is not derived from the seed.
Charles Guillemet shared Ledger’s perspective as a hardware wallet manufacturer and the practical constraints that come with it. He presented benchmarks, warned of the cost of signature schemes that require large numbers of hashes at signing time, and noted that while SHRINCS is an elegant design, stateful signature schemes turn “every backup, every restore, every firmware update into a potential security incident,” an operational burden that does not match the user model of a universal hardware wallet. It was another warning to the community that statefulness is a design pattern that will not work, or worse, will cause loss of funds, in many contexts.
conduition led a breakout session on DropKick, a post-Q-Day recovery protocol for certain classes of vulnerable coins. After describing the scheme, discussion focused on its underlying tradeoffs, its operational and game-theoretic complexities, and the nature of the knowledge asymmetries that make the protocol possible.
Dan Boneh also led a session on lattice signatures, giving the group a primer on how they work. After the event, Marathon sponsored a dinner at a local restaurant, where we continued discussing the PQP late into the night.
Overall, the event was a huge success. We’re extremely grateful to all those who participated in the discussions, gave presentations, and facilitated breakout sessions. To those who traveled from afar, thank you for making the trip. And a special thank you to our co-hosts, Coinbase and Dan Boneh, for motivating this workshop.
Looking forward, we hope this workshop serves as a jumping-off point for future events that push forward our collective understanding of the PQP and how to tackle it.