Bitcoin Forum

Can Quantum computers one day break SHA256, and hence cause Bitcoin's death?

When would that be estimated to happen?


(probably won't die since we'll hard/soft-fork then to a new algo or smth, but just for discussion's sake)

This topic has been discussed multiple times already. Please use the search function or google and read up on the subject.

There are no known ways that quantum computers will break sha256.

I would find it interesting to read a nice article on how collision attacks are done.

Doesn't the fact that quantum computers are more efficient than classical computers (Taken from https://cs.stackexchange.com/questions/50366/is-there-any-proof-that-quantum-computers-are-more-efficient-than-classical-comp) mean that they will be slightly better than normal computers at hashing? Maybe not exponentially, but slightly more efficient?

Let's woodchipper this dead horse rather than kick it, shall we? Quantum does not mean magic. Quantum computers use 1,2,3,4 etc rather than 1 and 0. They aren't magic, they can just make smarter decisions rather than yes no yes no yes no the answer could be infinite. How does this top look on me? How the hell would a computer ever answer that!? A quantum computer could ;).

It won't be cracked and if it is all banking around the world would be cracked so we'd be a small fish in a big pond. Don't worry about it.

This one makes for an interesting watch ...

- https://www.youtube.com/watch?v=Lh8OGDNJZQk - Christian Schaffner: Quantum Cryptography  8)

21:00 = Quantum Cryptography Landscape / Post Quantum Crypto.

The only thing that quantum computers can do is to speed up the calculation of SHA256 hashes. Even if its faster than normal computers by a factor of thousands, the ASICs would still be way faster than quantum computers. The difficulty will rise and the network would continue as per normal.

ECDSA is a bigger problem than this.

i dont think qunatum computers can speed up hashing, but anyway this is not what is meant by 'cracking' sha256.

I hope Quantum computer technology is take under control. Otherwise it will be threatens the world. I fear that all encryption systems, cryptocurrency ecosystems to be threatened.

Scientists have already built basic quantum computers that can perform certain calculations; but a practical quantum computer is still years away..
so we don't know if is is possible..

it's quite difficult to happen in the near future (maybe 20 years later) and if this issue could happen then They would have some strong tools to prevent this issue. So do not worry about it and it's too early to think about this issue.

Isn't Golem project just like quantum computers? I must be misinformed though but I assume its what the company are going to manufacture base on what I have read on their whitepaper.


Time flies so that 20 years will be just a flash and you won't realize we can casually use these computers and available on local stores.

If not 1 but 10 quantum computers might do it if that efficiency of system gets developed.

There's no proof yet that a quantum computer in practice can actually do anything faster than a classical computer. Theoretically it might be possible, but there are plenty of computer designs which sound like they could provide exponential speedups, but end up requiring some exponential resource to build or run which eliminates all advantages. It's totally possible the same thing happens with QC.

But even then, QC has it's limits, and it's unlikely that it's going to be able to break all cryptography or hashing.

Majority of people commented above do believe that Quantum computers might crack sha256 but it would need lots of QC (just my own view) and also we are not still on that era to make such assumptions.The right time to say it when we do already test it out when QC is already been here.Just sit and wait for more decades to come before we can able to witness the development of QC's.

By the time quantum computing happens that can crack SHA256, I suspect civilization will have already progressed far beyond our current knowledge. Especially with the advent of artificial intelligence and automated systems.

Concerning quantum computers and cryptography, there are two totally different aspects.

1) quantum computers, if ever they come into existence with a lot of qubits (which I personally doubt, but ok), can TOTALLY CRACK the current public key systems based on prime factorisation (RSA, Diffie-Hellmann) or based upon discrete logarithms in groups (elliptic curve crypto).  The algorithm to do so is known, it is Shor's algorithm.  By TOTALLY I mean totally: just ANY key can be cracked in a matter of milliseconds, on the condition that the quantum computer has more qubits than (a few times) the key length.  If such a quantum computer exists, there is simply no difficulty in cracking the key, it doesn't take "days" or anything because the difficulty goes LOGARITHMIC with Shor's algorithm.

2) however, for hash functions, and symmetric crypto like AES-256, it can be shown that a quantum computer can AT BEST use Grover's algorithm to crack it.  Grover's algorithm doesn't crack entirely a hash function, but essentially HALVES ITS BIT STRENGTH.  So a SHA-256 hash (with 256 bits) would not require 2^256 trials like on a classical computer, but "only" 2^128 trials on a quantum computer, which is STILL IMPOSSIBLE to do practically.  Most people think that quantum computers will, if ever they exist, run much slower than classical machines, so 2^128 trials on a quantum machine will be much harder to solve than 2^128 trials on a classical machine.

So while quantum computers can speed up hash function searching, they won't crack it entirely.  The interesting thing is that under certain conditions, it has been established that Grover's algorithm is the best possible one on a quantum machine, to attack a random hash function.

==> big hash functions are still secure against quantum attacks ; most current public key crypto is totally broken by quantum attacks.

This is why it is somewhat strange, in the bitcoin protocol, to have hashed the public key to 160 bits, and not have kept the 256 bits.  If the menace of a quantum attack were the reason for this, it would have been wiser to keep the 256 bit hash as an address instead of the 160 ripemd hash, because under grover's algorithm this would become only 80 bits secure, while the 256 bit hash would remain 128 bit secure under a quantum attack, which is the same level of *classical* security offered by the elliptic curve signature scheme - which wouldn't survive, by itself, a quantum attack.  This is one of the peculiar crypto design "features" of bitcoin...

Full fledged quantum computers are still years away, I have read a para from a book called "Applied Cryptography" and it does imply that 256 keys are unbreakable as of now. But what we consider as 'secure' today might be compromised in few years so the no can give a definite answer yet. As for the bitcoin address, it is run through several hashes SHA-256, RIPEMD-160. So "when will it become a reality is?" has no proven answer as of now.

The "it is run through several hashes" doesn't really mean much, apart from the possibility that one of the hash functions has a property that allows one to crack it specifically (which is not excluded of course).   In as much as hash functions are not broken crypt-analytically, there's no benefit in running several of them in series.  What counts is the bit length of the result.  Grover's algorithm doesn't care how many times one has applied how many hash functions: it looks at the global mapping from input to output with the given prescription (OK, practically, it does matter, because the system that has to apply the quantum correlations will be more complex if several hash functions are called successively, which will be a pain for those making the computer), and it doesn't need this prescription to contain any particular property: just the rule that tells you how to calculate the overall result.
In a way, I find it strange that the bitcoin address has a double SHA-256, followed by a RIPEMD-160, which reduces the 'security' from 256 bits to 160 bits.  I guess one of the motives was that there was a fear that there was a back door in SHA-256 (of NIST origin), and another back door in RIPEMD-160 (of Belgian academic origin), but that both of them combined would kill each back door mutually or something of the kind.  The overall structure of RIPEMD and SHA-256 is actually quite analogous, so if there were a structural weakness in one, most probably that weakness would carry over to the other.

For a bitcoin address, the thing that matters is the hardest puzzle for a hash function: pre-image resistance.  In fact, I'm not aware of any "official" hash function that ever had a serious pre-image attack, even for hash functions that are now considered totally broken for collision attacks.  MD5, for instance, has only a very lightly weakened pre-image security, although it is essentially totally broken considering collision attacks (takes only a few seconds on a normal PC).

So this double SHA-256 followed by RIPEMD-160 can only have a meaning for back door paranoia, not for cryptanalytic resistance ; and the true security has been lowered from 256 bits to 160 bits.

I would be more worried about the security of my wifi connection than the BTC chain security.

A fork would be a solution

I think this issue will not happen in the future because The Blockchain Developers have many tools to prevent this crack in the near future.
Do not worry about that . just go and buy come bitcoins to hold them for long-term period as future investment .
I guess it will be at 3,000 usd in this year.

Stupid post.

NO! Quantum computers aren't magic you moron. Rather than computing with 1's and 0's (or bits) they use sequences (qubits). They just aren't binary. This is completely useless for trying to crack encryption. Why the hell would this help at all? This is like trying to use an asic to play a video game. You need a damn GPU! Both are powerful in their own way but are 100% useless for doing the other task.

Go ahead and lock the thread now. Maybe you should do a quick Google.

https://en.wikipedia.org/wiki/Quantum_computer (https://en.wikipedia.org/wiki/Quantum_computer)

edit: and if some some crazy magical unicorn pixy dust out of your ass way something cracked SHA-256, online banking would also be hacked. I have a feeling the hacker would be going after the trillions of dollars/euros etc rather than ... $20Billion worth of bitcoins. Who gives a crap about bitcoins in this instance??

blockchain developers...  ::) ::) ::)

I think it is not possible .

Never get your information from the source that builds or has an interest in the subject, just look at robots, artificial intelligence and all of that, those things have been one generation away for a long time and there is no reason to think we are even close to get hard AI.

This is a topic that should definitely be a sticky in the Technical Discussion section.
The same question gets asked literally every two weeks. Topic could be closed and OP pointed to the sticky,
at least until there was some further information on this subject.

Well, years could be possible yes.
China is on his way to do this
http://www.pcworld.com/article/3194574/hardware/china-adds-a-quantum-computer-to-high-performance-computing-arsenal.html
But to crack the SHA-256 i don't think so.

If I knew, I would not post that information to a public forum.

SHA256 doesn't need to be crackable to bring Bitcoin to knees:

Source: https://www.iotatoken.com/IOTA_Whitepaper.pdf

Could quantum computers be a problem?

These people think so: https://theqrl.org/

If a Quantum computer can already crack the SHA256 algorithm then we are all doomed here. There is no future for bitcoin if someone is able to crack it, no matter who this someone is. Since Quantum computers are mostly in the hands of the governments which don't like bitcoin , they would have already used it to crack bitcoin and to end it.

I think for the moment this is not possible and is the hope that for a lot of years this will not happen that keeps us going and  to believe in bitcoin strength.

Exactly. Also remember that in the event of a super power quantum computer trying to break the sha256 hash they will need however to compete with the majority of miners together which secure the network by definition. It would be a fail cause I think that noone can override the power of a peer to peer network of such capabilities as the one of Bitcoin in the future when this kind of attack could happen.

Can a full-scale quantum computer revert SHA256? No.
Can a full-scale quantum computer own Bitcoin blockchain? Yes.

Nothing to discuss below this point, IMO.

How do we know that right now the available quantum computers aren't mining Bitcoin?
What else would be more profitable to do for them? aren't the current QCs perfect for mining?
What happens if a QC was in fact mining Bitcoin but before the difficulty adjustment stopped?
And started again after the target has passed?

what about decentralized super computers? elastic xel just showed POC where elasticPL mined bitcoin block.

POC video can be found here: https://vimeo.com/216378462

update can be found here: https://bitcointalk.org/index.php?topic=1396233.msg18910971#msg18910971

You said it your self "supercomputer" not quantum computer, you could also call ASICboost machines as a super miner.
Since when mining is a crime? no matter with what kind of hardware you are mining as long as you don't skip the work
Only concern about quantum computers is about their ability to crack down the prime number sequence and find private keys not what if they were mining bitcoin.
Already IBM/ DARPA/ Google and US have their own QCs but still in early stages of development, they are now more like the 30 years ago mobile phones which people used to call them bricks because they were big and heavy.

Well, if full-scale quantum computers are used in mining, they would simply "up" the difficulty, in the same way that the introduction of ASICS did.  You would have miners with quantum computers "competing" for blocks and all the rest left behind, like the CPU miners were left behind by ASIC miners.

Of course, the problem with PoW as a cryptographic security mechanism is that it is a quite ridiculous "security" in the sense that the work to be done by an attacker is comparable to the work done by the "good guys" ; and in the case of technological evolution, the work to be done by an attacker is MUCH LESS than the total work done by all the good guys (work done as in economic cost of work done).
For instance, with ASIC miners, it is very easy to overdo all the work that miners did the first few years of bitcoin, for much less cost than these miners did spend on it.
So if ever there is a quantum computer that can mine, miners should use it directly, and the "old part of the chain" will be easy to redo with the quantum computer at hand ; but competition between quantum computers will still make the "head" of the chain ; like ASICS now make the head of the chain, but the old tail is relatively easy to do over.