Bitcoin’s Quantum Leap: A Long Road Ahead, Says Ledger CTO

The ongoing discussion about Bitcoin’s adaptation to the post-quantum era has shifted focus towards enhancing wallet security and managing dormant coins. Ledger’s CTO, Charles Guillemet, indicated that selecting a new signature method might be simpler than safely transitioning Bitcoin users and their funds.

In a detailed analysis released by Ledger, Charles Guillemet stated, “Bitcoin is not currently facing a quantum computer issue,” emphasizing that the journey toward migration—encompassing research, software adaptation, hardware modifications, and user acceptance—might take years. He identified that no commercially relevant quantum computer that can undermine Bitcoin’s existing signatures has been found thus far, and the timeline for its emergence remains unpredictable.

Guillemet’s analysis highlights SHRINCS, a draft proposal aimed at incorporating post-quantum signatures specific to Bitcoin, which intermingles a compact stateful signing method with a broader stateless recovery route. As it stands, the specification is incomplete, has no assigned BIP number, and includes a formal note stating, “security proof is TODO.”

Bitcoin Transition Entails More Than Cryptography Choices

Guillemet categorized the migration process into three key challenges: selecting a post-quantum signature method, modifying Bitcoin wallets and protocol frameworks accordingly, and determining the fate of existing BTC, particularly coins belonging to users who may have lost access or have not transacted in years.

Currently, Bitcoin’s transaction verification is primarily dependent on ECDSA and Schnorr signatures through elliptic-curve cryptography. A sufficiently advanced quantum computer leveraging Shor’s algorithm could, in theory, extract private keys from exposed public keys; however, no publicly available machine can execute this attack on Bitcoin today.

Guillemet also pointed out that evaluating migration should not solely hinge on the cryptographic robustness of any new scheme. It’s crucial that wallets, hardware devices, backup strategies, and multi-tool setups can implement it securely. He noted that gaining consensus on how to handle vulnerable legacy coins poses significant unresolved challenges.

Similar perspectives have been echoed by other cryptographers. Dan Boneh from Stanford suggests that while Bitcoin should brace itself for quantum risks, a hurried migration could lead to substantial software failures.

SHRINCS: Smaller Signatures at the Expense of Wallet State

The latest SHRINCS draft specification outlines a hash-centric framework centered on SHA-256, the hash function extensively utilized by Bitcoin. Its design aims for around 128 bits of classical security and approximately 64 bits of quantum safety under the chosen guidelines.

This system employs a 48-byte public key that is anchored in two signing routes. The compact path utilizes Flexible XMSS and WOTS+C, yielding stateful signatures between 548 bytes and 4,619 bytes. A backup path derived from SLH-DSA concepts results in a signature size of 5,777 bytes.

NIST ratified SLH-DSA as FIPS 205 in August 2024, introducing a stateless standard rooted in SPHINCS+. The SHRINCS draft, however, employs a tailored parameter set alongside its distinct stateful element.

These newer figures are vital, as a preceding version of SHRINCS made a frequently referenced claim of a 324-byte stateful signature. Guillemet clarified that this statistic no longer corresponds to the draft in question; the current specification begins at 548 bytes for the stateful approach.

Blockstream Research posits that hash-based signatures provide conservative cryptographic assumptions while ensuring affordable validation. Their findings from May indicated that standardized post-quantum signatures often considerably exceed Bitcoin’s existing 64-byte Schnorr signatures, leading to increased demand for block space and transaction efficiency.

Blockstream has validated SHRINCS verification on the Liquid sidechain using Simplicity; however, this trial does not imply that the methodology is functional on the Bitcoin mainnet. The current Bitcoin specification is still under research requiring further evaluation and consensus before any network application.

Stateful Signatures Introduce New Wallet Vulnerabilities

The SHRINCS compact path mandates that each one-time signing key be utilized just once. Consequently, a wallet must track a counter that designates the next signing slot, which must progress continuously before a signature is transmitted from the device.

Utilizing the same signing slot for multiple messages may allow observers to gather enough information to create a valid signature. According to Guillemet, while an attacker may not completely recover the private seed, the affected user’s funds could still be at risk of theft.

Backups pose an additional concern. Restoring a wallet from an outdated backup can resurrect an obsolete counter. Two hardware devices initialized from the same seed could encounter this same issue if they independently utilize the stateful method without synchronizing which one-time keys have already been consumed.

A separate Project Eleven analysis of SHRINCS reached a similar conclusion. Researchers Alex Pruden and Conor Deegan pointed out that the scheme imposes a critical state requirement on wallets and custodial systems, where restoring backups or rolling back state could inadvertently lead to the reuse of one-time keys.

SHRINCS includes a fallback option in the event of lost or uncertain state. The original seed can generate the stateless signing key, allowing transactions using the 5,777-byte signature. Once the counter is deemed untrustworthy, the wallet must cease utilizing the compact stateful option for that key.

Guillemet highlighted this feature as one of the stronger design choices of SHRINCS, as losing state can hamper efficiency without rendering the coins impossible to spend.

Current Wallet Features May Not Transition Smoothly

The shift from elliptic-curve signatures to hash-based signatures could complicate several wallet functions that Bitcoin users depend on today. Non-hardened BIP32 derivation permits an extended public key to generate child public keys without revealing private keys, facilitating common watch-only wallet formats. Guillemet stressed that an efficient counterpart in the hash-based ecosystem does not readily exist.

Threshold signing presents its own challenges. While Schnorr-based systems manage participant combinations effectively, existing hash-based alternatives typically necessitate larger signatures, increased storage or communication needs, or different trust models. Guillemet indicated that SHRINCS should not be seen as a simple drop-in alternative to current Schnorr threshold systems.

Hardware performance also remains a significant factor. Ledger’s evaluation notes that post-quantum key generation and the stateless SHRINCS method can take considerable time on specific secure hardware due to the extensive number of SHA-256 operations required, along with greater memory usage compared to Schnorr signing.

Blockstream’s research approaches the tradeoff from another angle, asserting that SHRINCS verification is dominated by SHA-256 computations. Thus, it could remain computationally feasible even with larger signature sizes. The current draft claims that its maximum verification cost per signature byte is lower than that of BIP340 Schnorr.

No Established Post-Quantum Migration for Bitcoin Yet

SHRINCS represents just one facet of the broader dialogue surrounding Bitcoin’s quantum security. BIP 360, known as Pay-to-Merkle-Root, is another draft proposal aimed at eliminating Taproot’s susceptibility to quantum-based vulnerabilities and safeguarding users from long-exposure attacks.

While BIP 360 does not introduce a post-quantum signature method, its authors assert that mitigating short-exposure attacks—where an attacker can derive a private key post-transaction but before confirmation—may necessitate future post-quantum signature solutions.

BIP 361 directly tackles the migration issue. This draft proposal details a gradual phase-out of legacy ECDSA and Schnorr spending following the introduction of a post-quantum output mechanism. It suggests an initial migration period, succeeded by stricter controls on legacy signatures.

As crypto.news highlighted in its review of BIP 360 and BIP 361, an outstanding question revolves around the future of at-risk BTC that does not undergo migration. Various potential solutions could impact coins that are believed to be lost, abandoned, or owned by users who cannot engage in a forthcoming upgrade.

Coinbase’s independent cryptography advisory board has similarly urged for preparation efforts to begin before the emergence of quantum attack capabilities. The board emphasized the importance of laying groundwork while leaving decisions about freezing or managing legacy coins to the Bitcoin community.

The official Bitcoin BIP repository still lists BIP 360 and BIP 361 as Draft as of September 17. SHRINCS remains an unnumbered draft specification, with its developers cautioning that the cryptographic components are in prototype stage, awaiting further peer review and the completion of a security proof.

FAQs