4 ms·

Bitcoin was most certainly not designed to be quantum-resistant or upgradable (don't trust the wiki for these sorts of things). Thankfully we have discovered wa

by maaku 13y ago

Bitcoin was most certainly not designed to be quantum-resistant or upgradable (don't trust the wiki for these sorts of things). Thankfully we have discovered ways in it could be upgraded to be quantum-resistant without horribly breaking legacy nodes, but that's a very different statement.

gwern 13y ago
'Discovered'? If I may quote Satoshi https://bitcointalk.org/index.php?topic=202.msg2133#msg2133 https://bitcointalk.org/index.php?topic=202.msg2133#msg2133 : > True, if it happened suddenly. If it happens gradually, we can still transition to something stronger. When you run the upgraded software for the first time, it would re-sign all your money with the new stronger signature algorithm. (by creating a transaction sending the money to yourself with the stronger sig) Hardly sounds like he's going 'guys! this is a serious problem but I just realized that we happen to have a work-around available!'...
- maaku 13y ago
  That post doesn't address the underlying problem. How is the new signature opcodes introduced? How is consensus reached among a mix of nodes that may or may not understand the new signature scheme? Back in 2010 this could have been handled by hard-forking and requiring everyone to upgrade. In fact in the very early days there were various hard-fork changes that were not even well documented at the time - you simply upgraded your client and things worked. That is no longer an option: the bitcoin ecosystem is simply too big. Since then we've worked out ways in which soft-fork changes can be introduced which do not result in consensus errors. This was first tested in the wild with pay-to-script-hash in 2012. P2SH outputs are treated as anyone-can-claim outputs by older clients. More recently there has been work on proposals for adding Lamport signatures without the introduction of new opcodes. This is all definitely new work.
  - gwern 13y ago
    > Back in 2010 this could have been handled by hard-forking and requiring everyone to upgrade. ...and it still can, since if QC breaking your bitcoins isn't enough motivation to upgrade, nothing is. > This is all definitely new work. Yes, if you insist any solution has to be soft-forking, then I suppose that's valuable new work which Satoshi did not expect...

by maaku 13y ago

gwern 13y ago

'Discovered'? If I may quote Satoshi https://bitcointalk.org/index.php?topic=202.msg2133#msg2133 https://bitcointalk.org/index.php?topic=202.msg2133#msg2133 : > True, if it happened suddenly. If it happens gradually, we can still transition to something stronger. When you run the upgraded software for the first time, it would re-sign all your money with the new stronger signature algorithm. (by creating a transaction sending the money to yourself with the stronger sig) Hardly sounds like he's going 'guys! this is a serious problem but I just realized that we happen to have a work-around available!'...

maaku 13y ago
That post doesn't address the underlying problem. How is the new signature opcodes introduced? How is consensus reached among a mix of nodes that may or may not understand the new signature scheme? Back in 2010 this could have been handled by hard-forking and requiring everyone to upgrade. In fact in the very early days there were various hard-fork changes that were not even well documented at the time - you simply upgraded your client and things worked. That is no longer an option: the bitcoin ecosystem is simply too big. Since then we've worked out ways in which soft-fork changes can be introduced which do not result in consensus errors. This was first tested in the wild with pay-to-script-hash in 2012. P2SH outputs are treated as anyone-can-claim outputs by older clients. More recently there has been work on proposals for adding Lamport signatures without the introduction of new opcodes. This is all definitely new work.
- gwern 13y ago
  > Back in 2010 this could have been handled by hard-forking and requiring everyone to upgrade. ...and it still can, since if QC breaking your bitcoins isn't enough motivation to upgrade, nothing is. > This is all definitely new work. Yes, if you insist any solution has to be soft-forking, then I suppose that's valuable new work which Satoshi did not expect...