5 ms·

One thing that is not addressed: say this quantum attack happens tomorrow and everyone agrees it was an attack, what would prevent the community (miners, node o

by glerk 6mo ago

One thing that is not addressed: say this quantum attack happens tomorrow and everyone agrees it was an attack, what would prevent the community (miners, node operators, and users) to hard fork the chain at a snapshot before the attack, patch the protocol, and call that Bitcoin? There would be loss of value of course, but it is not unrecoverable. It’s worth remembering that Ethereum forked for much less (not even a bug in the protocol, but a bug in a private application running on the protocol) and nobody seems too upset about it a decade later.

Retr0id 6mo ago
A hard fork implies a difference in consensus rules, and what do you propose that difference be? Existing wallets need to actively commit to some PQ signature mechanism, prior to Q-day.
- glerk 6mo ago
  Even if Q-day means there is a way to deterministically retrieve any private key from a public key (is that what it means? or is the blast radius of q-day contained? This is a bit above my level of cryptography), I’m sure we could come up with something to minimize the damage. In the worst case, it might involve a claim process with an authority or consensus mechanism to prove who the rightful owner of the funds is and revert the unauthorized transactions on the new chain. Yes, this is not ideal! But if the wallet conversion requires active participation, preemptive measures are also not ideal.
  - Retr0id 6mo ago
    > Q-day means there is a way to deterministically retrieve any private key from a public key That's exactly what it means. (Note also that under ECDSA you can retrieve a public key from a valid signature). How do you prove anything, after the key material is compromised?
  - glerk 6mo ago
    > How do you prove anything, after the key material is compromised? It’s a blockchain, so the simplest would be chain of custody until the chain points undeniably at you. This is not a pure cryptographic device, some social intervention might be needed here.
wmf 6mo ago
In theory nothing prevents that but it would be so contentious that the backlash (e.g. 90% drawdown) may be even worse than just letting the hacks stand.
- glerk 6mo ago
  Letting the hack stand means the chain comes to a halt and all value is destroyed? Even if you’re a staunch bitcoin purist, I don’t think that’s the path you want to go on.
  - wmf 6mo ago
    The chain wouldn't halt because mining won't be affected by quantum. If you see hacks happening you could race to move your coins into a PQ wallet before the hackers do. I'm assuming that PQ software will be available before the hacks. I agree that this is a very bad scenario.
- pants2 6mo ago
  The Bitcoin “value overflow incident” on August 15, 2010 is probably the closest thing and that didn't affect the price much (though one BTC was around 8c at the time)
  - weakened_malloc 6mo ago
    This time you'll have hundreds of billions of BTC that will be hacked by someone who will probably instantly unload it. In that scenario it's hard to see the price of it not dropping >90%, so you'd have to think people would prefer a roll back. That said, I don't know how you could even do a roll back, you're not rolling back to a 'safe' state since the keys aren't safe at that point.
    - pants2 6mo ago
      Very good point on the roll-back. However in terms of the hack, Bitcoin is slow - most exchanges require a few confirmations so it's 30+ minutes to land a deposit in Coinbase/Binance at minimum, and a transfer that huge would instantly set off alarms. Seems unlikely that they would be able to unload that much.
Hasslequest 6mo ago
[dead]
tuckwat 6mo ago
BTC thrives on hype and hope that others will buy in. A successful quantum attack would obliterate the value and future value.
block_dagger 6mo ago
I'd argue there may be an increase in value over time if the community handles the fork well.
- avazhi 6mo ago
  And you’d get laughed at for that argument.
EthanHeilman 6mo ago
> fork the chain at a snapshot before the attack, patch the protocol, and call that Bitcoin? It won't work. The only way to authenticate who ones what coins is with signatures. If the signature algorithm is broken, you can't tell who the original owner is to move the coins to a safe signature algorithm. You need to more to safer signature algorithm before the break, after the break it is game over. > It’s worth remembering that Ethereum forked for much less Ethereum could simply return the coins to the original owners. If the signature scheme is insecure, returning the coins just means the attacker can steal them again.
- glerk 6mo ago
  > The only way to authenticate who owns what coins is with signatures Maybe the only fully cryptographic absolutely zero-trust way? In practice there are very few bitcoin outputs that aren't linked to an offline identity and most users could easily produce a proof of ownership. Of course, this is not ideal and everyone would prefer not to go down that route. But even if we prepare in time and Bitcoin provides a quantum-secure address scheme before "Q-day", what happens to all the wallets that didn't upgrade? Is it open season on them? Satoshi's wallet alone could crash Bitcoin's value as a currency if dumped on the open market. I think even with the upgrade plan in place, a hard-fork + recovery will be on the menu, with various degrees of community support.
  - EthanHeilman 6mo ago
    > In practice there are very few bitcoin outputs that aren't linked to an offline identity and most users could easily produce a proof of ownership. Any who is going to in charge of reading that proof of identity and moving the coins? A trusted centralized party? The point of Bitcoin is to avoid exactly that sort of trust relationship, otherwise use the banking system. > Satoshi's wallet alone could crash Bitcoin's value as a currency if dumped on the open market. No one knows, but the incentives are aligned with a softfork to burn Satoshi's coins.
    - glerk 6mo ago
      > Any who is going to in charge of reading that proof of identity and moving the coins? A trusted centralized party? Basically you'd have to relax the trust/decentralization guarantees, but you don't have to relax them all the way. Most likely a consortium of trusted actors (Blockstream, major miners, major exchanges, bitcoin-adjacent companies,...). Or something like a consensus mechanism with aligned incentives a la Kleros. I think "we" could come up with "something", even if it is not perfect, because the value of Bitcoin is ultimately in the community of people who use Bitcoin, not just the protocol. "Hard-fork" might not be the right way to see this. It's more like starting a completely new protocol where people who held Bitcoin at a certain snapshot can redeem a one-time airdrop equivalent to the value they held, provided they can prove ownership. As that protocol's value overtakes the value of the original Bitcoin chain (which will eventually be completely dead), we can all agree to call it Bitcoin.
ciupicri 6mo ago
In my humble opinion (because I'm not a "crypto investor"), Ethereum lost all credibility with that fork. You can't trust a system/currency that changes the rules like that.
- latchkey 6mo ago
  I believe actions speak louder than words. Their continued execution, including successfully switching engines mid-flight (The Merge), has earned them a bit of reprieve in your view.
  - ciupicri 6mo ago
    Speaking of actions and words, what good is a contract if it can't be enforced? So I find hard to trust Ethereum. All that new stuff could change the point of view if it were some ordinary software, but since we're talking about a currency, trust is very hard to regain. How can someone be sure that they won't change their mind again? I haven't followed the evolution of Dogecoin, but even that sounds more reliable and at least it doesn't pretend to be taken seriously.
    - latchkey 6mo ago
      [dead]

by glerk 6mo ago

Retr0id 6mo ago

A hard fork implies a difference in consensus rules, and what do you propose that difference be? Existing wallets need to actively commit to some PQ signature mechanism, prior to Q-day.

glerk 6mo ago
Even if Q-day means there is a way to deterministically retrieve any private key from a public key (is that what it means? or is the blast radius of q-day contained? This is a bit above my level of cryptography), I’m sure we could come up with something to minimize the damage. In the worst case, it might involve a claim process with an authority or consensus mechanism to prove who the rightful owner of the funds is and revert the unauthorized transactions on the new chain. Yes, this is not ideal! But if the wallet conversion requires active participation, preemptive measures are also not ideal.
- Retr0id 6mo ago
  > Q-day means there is a way to deterministically retrieve any private key from a public key That's exactly what it means. (Note also that under ECDSA you can retrieve a public key from a valid signature). How do you prove anything, after the key material is compromised?
- glerk 6mo ago
  > How do you prove anything, after the key material is compromised? It’s a blockchain, so the simplest would be chain of custody until the chain points undeniably at you. This is not a pure cryptographic device, some social intervention might be needed here.

wmf 6mo ago

In theory nothing prevents that but it would be so contentious that the backlash (e.g. 90% drawdown) may be even worse than just letting the hacks stand.

glerk 6mo ago
Letting the hack stand means the chain comes to a halt and all value is destroyed? Even if you’re a staunch bitcoin purist, I don’t think that’s the path you want to go on.
- wmf 6mo ago
  The chain wouldn't halt because mining won't be affected by quantum. If you see hacks happening you could race to move your coins into a PQ wallet before the hackers do. I'm assuming that PQ software will be available before the hacks. I agree that this is a very bad scenario.
pants2 6mo ago
The Bitcoin “value overflow incident” on August 15, 2010 is probably the closest thing and that didn't affect the price much (though one BTC was around 8c at the time)
- weakened_malloc 6mo ago
  This time you'll have hundreds of billions of BTC that will be hacked by someone who will probably instantly unload it. In that scenario it's hard to see the price of it not dropping >90%, so you'd have to think people would prefer a roll back. That said, I don't know how you could even do a roll back, you're not rolling back to a 'safe' state since the keys aren't safe at that point.
  - pants2 6mo ago
    Very good point on the roll-back. However in terms of the hack, Bitcoin is slow - most exchanges require a few confirmations so it's 30+ minutes to land a deposit in Coinbase/Binance at minimum, and a transfer that huge would instantly set off alarms. Seems unlikely that they would be able to unload that much.

Hasslequest 6mo ago

[dead]

tuckwat 6mo ago

BTC thrives on hype and hope that others will buy in. A successful quantum attack would obliterate the value and future value.

block_dagger 6mo ago

I'd argue there may be an increase in value over time if the community handles the fork well.

avazhi 6mo ago
And you’d get laughed at for that argument.

EthanHeilman 6mo ago

> fork the chain at a snapshot before the attack, patch the protocol, and call that Bitcoin? It won't work. The only way to authenticate who ones what coins is with signatures. If the signature algorithm is broken, you can't tell who the original owner is to move the coins to a safe signature algorithm. You need to more to safer signature algorithm before the break, after the break it is game over. > It’s worth remembering that Ethereum forked for much less Ethereum could simply return the coins to the original owners. If the signature scheme is insecure, returning the coins just means the attacker can steal them again.

glerk 6mo ago
> The only way to authenticate who owns what coins is with signatures Maybe the only fully cryptographic absolutely zero-trust way? In practice there are very few bitcoin outputs that aren't linked to an offline identity and most users could easily produce a proof of ownership. Of course, this is not ideal and everyone would prefer not to go down that route. But even if we prepare in time and Bitcoin provides a quantum-secure address scheme before "Q-day", what happens to all the wallets that didn't upgrade? Is it open season on them? Satoshi's wallet alone could crash Bitcoin's value as a currency if dumped on the open market. I think even with the upgrade plan in place, a hard-fork + recovery will be on the menu, with various degrees of community support.
- EthanHeilman 6mo ago
  > In practice there are very few bitcoin outputs that aren't linked to an offline identity and most users could easily produce a proof of ownership. Any who is going to in charge of reading that proof of identity and moving the coins? A trusted centralized party? The point of Bitcoin is to avoid exactly that sort of trust relationship, otherwise use the banking system. > Satoshi's wallet alone could crash Bitcoin's value as a currency if dumped on the open market. No one knows, but the incentives are aligned with a softfork to burn Satoshi's coins.
  - glerk 6mo ago
    > Any who is going to in charge of reading that proof of identity and moving the coins? A trusted centralized party? Basically you'd have to relax the trust/decentralization guarantees, but you don't have to relax them all the way. Most likely a consortium of trusted actors (Blockstream, major miners, major exchanges, bitcoin-adjacent companies,...). Or something like a consensus mechanism with aligned incentives a la Kleros. I think "we" could come up with "something", even if it is not perfect, because the value of Bitcoin is ultimately in the community of people who use Bitcoin, not just the protocol. "Hard-fork" might not be the right way to see this. It's more like starting a completely new protocol where people who held Bitcoin at a certain snapshot can redeem a one-time airdrop equivalent to the value they held, provided they can prove ownership. As that protocol's value overtakes the value of the original Bitcoin chain (which will eventually be completely dead), we can all agree to call it Bitcoin.

ciupicri 6mo ago

In my humble opinion (because I'm not a "crypto investor"), Ethereum lost all credibility with that fork. You can't trust a system/currency that changes the rules like that.

latchkey 6mo ago
I believe actions speak louder than words. Their continued execution, including successfully switching engines mid-flight (The Merge), has earned them a bit of reprieve in your view.
- ciupicri 6mo ago
  Speaking of actions and words, what good is a contract if it can't be enforced? So I find hard to trust Ethereum. All that new stuff could change the point of view if it were some ordinary software, but since we're talking about a currency, trust is very hard to regain. How can someone be sure that they won't change their mind again? I haven't followed the evolution of Dogecoin, but even that sounds more reliable and at least it doesn't pretend to be taken seriously.
  - latchkey 6mo ago
    [dead]