npub160…zyjc9 on Nostr: ...

quoting nevent1q…cyqg

The Quantum Threat to Bitcoin

Bitcoin's security model relies on the Elliptic Curve Digital Signature Algorithm (ECDSA) and the secp256k1 curve. The security assumption is that deriving a private key from a public key is computationally infeasible—a problem known as the Elliptic Curve Discrete Logarithm Problem (ECDLP).

Quantum computers change this calculus. Shor's algorithm, running on a sufficiently powerful quantum computer, can solve ECDLP in polynomial time. While such computers don't exist today, the cryptographic community takes this threat seriously. Bitcoin's long-term security depends on proactive measures.

BIP-360: Pay to Quantum Resistant Hash (P2QRH)

The Bitcoin community is actively developing quantum-resistant solutions. [BIP-360](<https://github.com/bitcoin/bips/blob/master/bip-0360.mediawiki>) proposes a new output type using post-quantum cryptographic signatures. Key features include:

Lattice-based signatures (e.g., FALCON, SPHINCS+) resistant to Shor's algorithm
Backward compatibility via soft fork activation
Migration path for existing UTXOs to quantum-safe addresses

Until P2QRH or similar solutions are deployed, minimizing public key exposure is the most effective defense-in-depth measure available today.

Understanding Public Key Exposure

Bitcoin addresses are derived from public keys through a one-way hash function:

 
Address = RIPEMD160(SHA256(PublicKey))  // P2PKH
Address = SHA256(PublicKey)[0:20] // P2WPKH (simplified)
 

This hash provides a layer of protection: even if an attacker can derive private keys from public keys (the quantum threat), they still cannot derive public keys from addresses (hash preimage resistance). The public key remains hidden until the first spend.

The ECDSA Exposure Window

 
┌───────────────────────────────┐
│  FRESH ADDRESS                │
│  (never spent from)           │
├───────────────────────────────┤
│ • Pubkey hidden behind hash   │
│ • Quantum-safe                │
│ • No known attack             │
└───────────────────────────────┘
              │
              │ First spend
              ▼
┌───────────────────────────────┐
│  EXPOSED ADDRESS              │
│  (spent from)                 │
├───────────────────────────────┤
│ • Transaction reveals pubkey  │
│ • Quantum vulnerable          │
│ • Future deposits at risk     │
└───────────────────────────────┘
 

Why Address Reuse is Dangerous

When you spend from an address, the full ECDSA public key is revealed in the transaction's witness data (for SegWit) or scriptSig (for legacy). A quantum attacker could then:

1. Extract the public key from any historical transaction spending from that address

2. Run Shor's algorithm to derive the private key

3. Steal any funds subsequently deposited to that address

This is particularly dangerous for mining pools that reuse a single coinbase address. After the first consolidation transaction, every future block reward sent to that address is quantum-vulnerable from the moment it's mined.

The "Harvest Now, Decrypt Later" Attack

Nation-state adversaries are already archiving encrypted data and blockchain transactions with the expectation that future quantum computers will enable decryption. This is known as a "harvest now, decrypt later" (HNDL) attack.

For Bitcoin, this means:

Public keys exposed today are recorded permanently on-chain
When quantum computers become viable, historical public keys can be attacked
Funds in addresses with exposed public keys become immediately vulnerable

> Mining Pool Coinbases: A High-Value Target
>
> Mining pools accumulate significant value in coinbase outputs. A pool using a single static address creates an attractive target: one public key exposure compromises all future deposits. Coinbase rotation eliminates this single point of failure.