Guarding Bitcoin: Coinbase’s Quantum Defense Strategies

On October 13, Coinbase issued a call for Bitcoin developers to gear up for potential threats posed by quantum computing, indicating that enhancing the cryptocurrency’s security may take several years.

On Tuesday, Coinbase released its insights on how Bitcoin could gradually integrate quantum-resistant digital signatures while ensuring existing wallets and institutional assets remain secure. The company, which holds roughly 5% of all existing BTC, emphasized the need for adaptable transaction designs, improved wallet protections, and a migration strategy that does not rely on resolving all issues related to legacy coins.

Coinbase warns that enhancing Bitcoin’s quantum security could take years

In a paper dated October 13, Coinbase outlined that shifting Bitcoin towards quantum-resistant security involves more than merely implementing a new digital signature algorithm. Developers must take into account transaction fees, network capacity, wallet compatibility, as well as the ability of Bitcoin nodes to independently verify transactions.

The organization cautioned that consensus modifications and wallet transitions typically necessitate extensive planning and collaboration. It urged developers to start preparing before quantum advancements reach a stage where they could crack Bitcoin’s current cryptographic signatures.

Currently, Bitcoin utilizes elliptic-curve cryptography, including ECDSA and Schnorr signatures, for transaction authorizations. A sufficiently advanced quantum computer could potentially derive private keys from public keys, enabling unauthorized access to users’ funds.

This proposal does not assert that such a quantum computer exists now, nor does it claim that Bitcoin’s cryptographic defenses are compromised. Instead, Coinbase considers the eventuality of such a threat, advocating for early preparations before the technology becomes a reality.

Coinbase has already begun enhancing its custody systems to fortify them against potential quantum threats. Their efforts include collaborating with Bitcoin researchers, contributing to open-source initiatives, and being active members of the Bitcoin Security Consortium.

In its earlier research on Bitcoin’s quantum risks, Coinbase called for the initiation of migration planning long before a feasible quantum attacker could pose a threat. The company’s independent advisory board supports the development of security measures while leaving the fate of inaccessible or abandoned funds to the governance of Bitcoin.

The recent publication from Coinbase expands on this dialogue by pinpointing the technical needs for wallets, transaction types, and institutional custody. The firm reiterated that its suggestions are intended as contributions to an ongoing development discussion rather than definitive determinations regarding Bitcoin’s security future.

Coinbase endorses BIP-360 and flexible Bitcoin wallet designs

Among the suggested technical strategies, Coinbase pointed out BIP-360 and P2TRv2 as viable designs for Bitcoin’s transition. Both concepts aim to establish adaptable transaction frameworks that could easily incorporate new digital signature systems.

BIP-360 proposes the introduction of Pay-to-Merkle-Root (P2MR), a new transaction output type that builds on Bitcoin’s existing Taproot architecture. This design eliminates the key-path spending option inherent in Taproot, thereby shielding a public key from potential quantum threats.

The official BIP-360 documentation describes P2MR as a proposed soft-fork adjustment designed to mitigate long-exposure risks linked to public keys. However, it does not independently offer a post-quantum signature algorithm or guard against every conceivable quantum attack. The proposal remains at the draft stage.

Coinbase indicated that an adaptable output framework could empower developers to introduce or swap cryptographic algorithms without necessitating a complete redesign of Bitcoin’s transaction structure for each new algorithm. This adaptability would require well-defined protocols governing transaction validation, spending permissions, and signature identification.

The firm specifically urged an examination of post-quantum signature algorithms such as ML-DSA, SLH-DSA, and FN-DSA, when suitable standards are established. Additionally, it identified SHRINCS, a proposed compact hash-based signature design, as another candidate worthy of further analysis.

According to Coinbase, developers should evaluate factors like signature size, processing speed, transaction costs, and compatibility with hardware before finalizing their approach. Larger signatures could lead to increased block-space demands, ultimately raising transaction fees during a substantial transition period.

Previous BIP-360 testing on a Bitcoin quantum testnet showcased experimental P2MR transactions. In March, BTQ Technologies reported success with address creation, funding, signing, and transaction confirmation on its test network. This implementation does not signify the active deployment of BIP-360 on the Bitcoin mainnet.

Bitcoin wallets could accommodate old and new signatures

For the migration process, Coinbase recommended assessing a phased approach that allows Bitcoin users to adopt enhanced protections before phasing out older signatures.

One possible method involves utilizing a hybrid wallet featuring two distinct spending mechanisms. Users could approve transactions using existing ECDSA or Schnorr signatures, with a separate post-quantum key providing an additional spending avenue.

Coinbase described this setup as a potential 1-of-2 model. This framework could enable users to advance towards quantum-resistant security without having to await developers’ final decisions on policies governing older Bitcoin signatures.

The company also proposed the evaluation of post-quantum-only outputs for early adopters, along with strategies designed to minimize public key exposure during transactions. Future considerations regarding restrictions on payments to legacy address types would require separate discussions.

Institutional custody presents additional challenges. Coinbase emphasized that new signature systems must retain compatibility with multiparty computation (MPC), a security methodology that facilitates multiple parties or systems in cryptographic signing.

The company expressed significant concern regarding stateful signature algorithms, which necessitate systems to track information throughout signing operations. Reusing signing states may create security vulnerabilities, including potential forgery of signatures.

The paper noted that large custodians maintain signing infrastructure across various servers and locations. Synchronizing stateful signatures among these systems could lead to operational challenges if records are lost, duplicated, or restored incorrectly.

Coinbase recommended retaining a stateless signing option should Bitcoin eventually implement stateful post-quantum algorithms. Developers should furnish wallet providers with clear guidelines for managing signing states and recovering securely from failures.

Coinbase’s earlier research on post-quantum custody explored how institutions can ready themselves for differing cryptographic systems before Bitcoin developers finalize any standard. The September discussions encompassed potential alternatives involving programmable hardware security modules.

Coinbase advocates for separate discussions on lost Bitcoin

Another unresolved challenge pertains to Bitcoins held in legacy wallets that may not transition to quantum-resistant addresses.

Coinbase identified several categories demanding attention, including wallets with publicly accessible keys, dormant assets, lost private keys, and Bitcoin from the cryptocurrency’s nascent years.

Some of these coins may still be owned legitimately, whereas others could remain permanently out of reach. The firm noted that future migration strategies will need to consider whether such assets can be transferred after restrictions on older signatures are instituted.

The paper explored possible recovery strategies involving wallet seed data, cryptographic proofs, and transaction commitments. Coinbase warned that any recovery system must remain secure against attackers who only have access to an exposed public key.

This issue has surfaced in various Bitcoin development proposals. BIP-361, titled Post Quantum Migration and Legacy Signature Sunset, suggests a gradual restriction of older signatures following the adoption of a post-quantum output system. Its draft outlines a staged transition followed by stricter rules for legacy transactions.

BIP-361 is still in proposal form and has not yet been executed. Its creators have detailed a potential timeline for an initial transition period followed by subsequent limitations on legacy spending, with recovery strategies remaining a subject for future analysis.

Coinbase advised that discussions about these decisions should occur independently from the technical development of post-quantum signatures. The company stressed that conflicts regarding inaccessible assets should not impede progress on safeguarding active wallets.

The document noted further testing requirements related to transaction verification, hardware wallets, fee structures, block propagation, and the time necessary to transfer potentially vulnerable Bitcoin holdings. Coinbase called for a standardized evaluation procedure that compares various signature systems under realistic network conditions.

The October 13 publication did not set a deadline for Bitcoin users to transition, endorse any specific final signature algorithm, or suggest an activation date. The company stated that its future work would continue through ongoing discussions with researchers, developers, and open-source contributors.