5 ms·

Yes, quite possibly. As the article notes though, it's more of an engineering and social challenge than a fatal flaw. As soon as it is clear it will be actual

by retrac 5y ago

Yes, quite possibly. As the article notes though, it's more of an engineering and social challenge than a fatal flaw. As soon as it is clear it will be actually practical in the near future to attack ECDSA, then the protocol will move to a quantum-resistant cryptosystem and you'll have to sign a transaction with your old ECDSA key to transfer it to the new one. Your paper wallet might become a rather thick paper listing, though. As long as most of us do this before the attacks are practical and widespread, no problem. But when do we stop accepting transactions with ECDSA keys? I suppose at some point someone will try move 500,000 BTC from addresses that have been dead since 2010. Hopefully we'll have a consensus by then. As to the surprise attack scenario, I find it uncompelling. The only ones who could fund that in the near future are nations, and one thinks they'd have better things to do with a top secret trump card like that, than to attempt to very publicly steal money with it.

Thorrez 5y ago
>Your paper wallet might become a rather thick paper listing, though. Why? Are you saying you'll need a bunch of new addresses? I think you'll only need 1 new address. Are you saying the addresses or stored private keys will be gigantic? I don't think that needs to be the case. Current addresses are just hashes, they can stay hashes and thus be small. Private keys don't need to be stored, only a seed needed to generate a private key needs to be stored.
- retrac 5y ago
  Keys for some quantum-secure crypto systems are pretty big - the Wikipedia article has a chart of proposed ones: https://en.wikipedia.org/wiki/Post-quantum_cryptography#Comparison https://en.wikipedia.org/wiki/Post-quantum_cryptography#Comp... They range from about 10 to 100x as large as the EDCSA keys used in Bitcoin. This poses its own problems with transaction sizes and the block size cap and total throughput, though it's not a fatal flaw to the protocol.
  - nemo1618 5y ago
    True, but you don't actually print out your private key on a paper wallet -- you print out a seed phrase, from which the key material is derived. So you might even be able to keep using the same seed phrase! (Don't quote me on that, though.)
    - 3np 5y ago
      A 12 words BIP39 phrase is 128 bits of entropy. Is this enough? Depends on the algorithm. In either case, you'd absolutely not want to reuse the phrase. AFAIK BIP-32 does not have security guarantees such that you can't find the seed from a set of private keys.
      - Thorrez 5y ago
        Oh, very interesting. I hadn't considered that a quantum-resistant private key might have its security depend on a large amount of input randomness.
gruez 5y ago
> But when do we stop accepting transactions with ECDSA keys? I suppose at some point someone will try move 500,000 BTC from addresses that have been dead since 2010. Hopefully we'll have a consensus by then. It shouldn't be too hard to come up with a consensus right? All the stakeholders would benefit old coins being lost forever (because the value of their holdings would go up), and there's no point in opposing it when you can just shuffle your old coins to using post-quantum signatures.
- retrac 5y ago
  There would be a period when both systems are active. It will likely require more bytes to log a quantum-secure transaction. With no other protocol changes, this would incentivize people to keep using ECDSA keys. And the increase in transaction size, would cause reduced transactions per second. No inherent problem. The protocol could have a built-in discount. Maybe the block cap should be increased to compensate. Questions like that are not so easy to get consensus on.
  - danuker 5y ago
    I say no discount, or the miners will prefer to include ECDSA key transactions.
MrStonedOne 5y ago
>But when do we stop accepting transactions with ECDSA keys? I suppose at some point someone will try move 500,000 BTC from addresses that have been dead since 2010. Hopefully we'll have a consensus by then. Why would you bother? The outcome is the same, either the user gets locked out of their coin or hackers gain access to the coin, meaning the user is locked out of the coin. There isn't a solution that doesn't resolve in one of those and if you aren't able to protect the user by doing it, why spend the effort?
- matthewdgreen 5y ago
  Because if someone gains the ability to resurrect lost coins, it will massively increase the circulating supply of bitcoin overnight, causing the value of everyone’s bitcoin to crash. This effect will get worse the farther we go in the future. Some people might not be happy about this.

by retrac 5y ago

Thorrez 5y ago

>Your paper wallet might become a rather thick paper listing, though. Why? Are you saying you'll need a bunch of new addresses? I think you'll only need 1 new address. Are you saying the addresses or stored private keys will be gigantic? I don't think that needs to be the case. Current addresses are just hashes, they can stay hashes and thus be small. Private keys don't need to be stored, only a seed needed to generate a private key needs to be stored.

retrac 5y ago
Keys for some quantum-secure crypto systems are pretty big - the Wikipedia article has a chart of proposed ones: https://en.wikipedia.org/wiki/Post-quantum_cryptography#Comparison https://en.wikipedia.org/wiki/Post-quantum_cryptography#Comp... They range from about 10 to 100x as large as the EDCSA keys used in Bitcoin. This poses its own problems with transaction sizes and the block size cap and total throughput, though it's not a fatal flaw to the protocol.
- nemo1618 5y ago
  True, but you don't actually print out your private key on a paper wallet -- you print out a seed phrase, from which the key material is derived. So you might even be able to keep using the same seed phrase! (Don't quote me on that, though.)
  - 3np 5y ago
    A 12 words BIP39 phrase is 128 bits of entropy. Is this enough? Depends on the algorithm. In either case, you'd absolutely not want to reuse the phrase. AFAIK BIP-32 does not have security guarantees such that you can't find the seed from a set of private keys.
    - Thorrez 5y ago
      Oh, very interesting. I hadn't considered that a quantum-resistant private key might have its security depend on a large amount of input randomness.

gruez 5y ago

> But when do we stop accepting transactions with ECDSA keys? I suppose at some point someone will try move 500,000 BTC from addresses that have been dead since 2010. Hopefully we'll have a consensus by then. It shouldn't be too hard to come up with a consensus right? All the stakeholders would benefit old coins being lost forever (because the value of their holdings would go up), and there's no point in opposing it when you can just shuffle your old coins to using post-quantum signatures.

retrac 5y ago
There would be a period when both systems are active. It will likely require more bytes to log a quantum-secure transaction. With no other protocol changes, this would incentivize people to keep using ECDSA keys. And the increase in transaction size, would cause reduced transactions per second. No inherent problem. The protocol could have a built-in discount. Maybe the block cap should be increased to compensate. Questions like that are not so easy to get consensus on.
- danuker 5y ago
  I say no discount, or the miners will prefer to include ECDSA key transactions.

MrStonedOne 5y ago

>But when do we stop accepting transactions with ECDSA keys? I suppose at some point someone will try move 500,000 BTC from addresses that have been dead since 2010. Hopefully we'll have a consensus by then. Why would you bother? The outcome is the same, either the user gets locked out of their coin or hackers gain access to the coin, meaning the user is locked out of the coin. There isn't a solution that doesn't resolve in one of those and if you aren't able to protect the user by doing it, why spend the effort?

matthewdgreen 5y ago
Because if someone gains the ability to resurrect lost coins, it will massively increase the circulating supply of bitcoin overnight, causing the value of everyone’s bitcoin to crash. This effect will get worse the farther we go in the future. Some people might not be happy about this.