3 ms·

One tidbit that continues to bother me regarding the long-term viability of bitcoin is how long the encryption processes it relies on will stay secure. IIRC bit

by zalzane 13y ago

One tidbit that continues to bother me regarding the long-term viability of bitcoin is how long the encryption processes it relies on will stay secure. IIRC bitcoin relies on ECDSA for signing and SHA-256 for hashing. Pretty much all forms of encryption have a shelf-life until they are broken, especially when you consider quantum computing on the horizon. What happens when ECDSA becomes viable to break, or when they start finding SHA-256 collisions? Would the currency just collapse, or is there some way provided to change the system's cryptography methods?

gwern 13y ago
Bitcoin was designed to be quantum-resistant and upgradeable: https://en.bitcoin.it/wiki/Myths#Quantum_computers_would_break_Bitcoin.27s_security https://en.bitcoin.it/wiki/Myths#Quantum_computers_would_bre...
- maaku 13y ago
  Bitcoin was most certainly not designed to be quantum-resistant or upgradable (don't trust the wiki for these sorts of things). Thankfully we have discovered ways in it could be upgraded to be quantum-resistant without horribly breaking legacy nodes, but that's a very different statement.
  - gwern 13y ago
    'Discovered'? If I may quote Satoshi https://bitcointalk.org/index.php?topic=202.msg2133#msg2133 https://bitcointalk.org/index.php?topic=202.msg2133#msg2133 : > True, if it happened suddenly. If it happens gradually, we can still transition to something stronger. When you run the upgraded software for the first time, it would re-sign all your money with the new stronger signature algorithm. (by creating a transaction sending the money to yourself with the stronger sig) Hardly sounds like he's going 'guys! this is a serious problem but I just realized that we happen to have a work-around available!'...
    - maaku 13y ago
      That post doesn't address the underlying problem. How is the new signature opcodes introduced? How is consensus reached among a mix of nodes that may or may not understand the new signature scheme? Back in 2010 this could have been handled by hard-forking and requiring everyone to upgrade. In fact in the very early days there were various hard-fork changes that were not even well documented at the time - you simply upgraded your client and things worked. That is no longer an option: the bitcoin ecosystem is simply too big. Since then we've worked out ways in which soft-fork changes can be introduced which do not result in consensus errors. This was first tested in the wild with pay-to-script-hash in 2012. P2SH outputs are treated as anyone-can-claim outputs by older clients. More recently there has been work on proposals for adding Lamport signatures without the introduction of new opcodes. This is all definitely new work.
      - gwern 13y ago
        > Back in 2010 this could have been handled by hard-forking and requiring everyone to upgrade. ...and it still can, since if QC breaking your bitcoins isn't enough motivation to upgrade, nothing is. > This is all definitely new work. Yes, if you insist any solution has to be soft-forking, then I suppose that's valuable new work which Satoshi did not expect...

by zalzane 13y ago

gwern 13y ago

Bitcoin was designed to be quantum-resistant and upgradeable: https://en.bitcoin.it/wiki/Myths#Quantum_computers_would_break_Bitcoin.27s_security https://en.bitcoin.it/wiki/Myths#Quantum_computers_would_bre...

maaku 13y ago
Bitcoin was most certainly not designed to be quantum-resistant or upgradable (don't trust the wiki for these sorts of things). Thankfully we have discovered ways in it could be upgraded to be quantum-resistant without horribly breaking legacy nodes, but that's a very different statement.
- gwern 13y ago
  'Discovered'? If I may quote Satoshi https://bitcointalk.org/index.php?topic=202.msg2133#msg2133 https://bitcointalk.org/index.php?topic=202.msg2133#msg2133 : > True, if it happened suddenly. If it happens gradually, we can still transition to something stronger. When you run the upgraded software for the first time, it would re-sign all your money with the new stronger signature algorithm. (by creating a transaction sending the money to yourself with the stronger sig) Hardly sounds like he's going 'guys! this is a serious problem but I just realized that we happen to have a work-around available!'...
  - maaku 13y ago
    That post doesn't address the underlying problem. How is the new signature opcodes introduced? How is consensus reached among a mix of nodes that may or may not understand the new signature scheme? Back in 2010 this could have been handled by hard-forking and requiring everyone to upgrade. In fact in the very early days there were various hard-fork changes that were not even well documented at the time - you simply upgraded your client and things worked. That is no longer an option: the bitcoin ecosystem is simply too big. Since then we've worked out ways in which soft-fork changes can be introduced which do not result in consensus errors. This was first tested in the wild with pay-to-script-hash in 2012. P2SH outputs are treated as anyone-can-claim outputs by older clients. More recently there has been work on proposals for adding Lamport signatures without the introduction of new opcodes. This is all definitely new work.
    - gwern 13y ago
      > Back in 2010 this could have been handled by hard-forking and requiring everyone to upgrade. ...and it still can, since if QC breaking your bitcoins isn't enough motivation to upgrade, nothing is. > This is all definitely new work. Yes, if you insist any solution has to be soft-forking, then I suppose that's valuable new work which Satoshi did not expect...