4 ms·
My understanding is that Bitcoin, used correctly, is effectively quantum safe. Since the "recipient" address of a UTXO is expressed as a hash, a user does not
by g_p 4y ago
My understanding is that Bitcoin, used correctly, is effectively quantum safe.
Since the "recipient" address of a UTXO is expressed as a hash, a user does not broadcast their public key until after they spend the funds. If you follow good practice, you make a single transaction, sending funds to the recipient, and the "change" to yourself, in a new wallet address (addressed by the hash of its public key). This means the public key is never visible to an attacker until its balance is zero.
Therefore, to attack this and steal funds through false transactions, you effectively need both a pre-image attack on SHA256 (so you have a valid public key to match the UTXO address), and a way to solve the discrete logarithm problem, breaking ECDSA (on the Secp256k1 curve), so you can sign using the private key corresponding to that public key.
SHA256 would come under Grover's algorithm, I believe, which would give you 128 bits of security under a quantum attack. That is still pretty good going.
- kadoban 4y ago> This means the public key is never visible to an attacker until its balance is zero. This part is just a tad questionable. To spend funds, you have to get the transaction recorded in a block. The usual way to do that is to broadcast it through the whole network until a miner picks it up. So there's more than a bit of wiggle room between "I broadcast everything about this tx" until "the money is already spent and I'm safe. It certainly does (in the usual case where the vast majority of the network and your connection to it is not under the attacker's control) limit the time an attacker has to compute, but it's not exactly pretty or reassuring.