Will Quantum Computers Spell the Doom of Bitcoin?

[Kprawn]

kprawn at the moment sha (any level) is not the target of QC. the real target is something like ECDSA.
this is because sha is more of a binary logic problem which limits QC's efficiency and ability. but ECDSA is a vector problem something QC can solve easier.
 
this means QC can be thousands of times more efficient solving a vector problem compared to a normal computer.
but QC can be only a couple times more efficient at a binary problem compared to a normal computer.

if i had a d-wave system. id prefer to 'crack' ecdsa way before wasting a few lifetimes cracking sha.

but even before worrying about QC. id be looking into solving the LN risk. (of signing using the same key many times a week). after all devs say try not to use the same key more then once due to what it may reveal. so LN has to think that through when developing a method to sign locked funds of a specific keypair.
that is a bigger risk to sort through right now

anyway back to the bitcoin ecdsa problem
my opinion is where each keypair should have its own specific curve rather than everyone using the same y² = x³ + 7. curve. thus adding some more randomness to prevent brute forcing.

but when changing to a new ecdsa mechanism for the keypairs, might aswell change to a different sha level too

Thanks for the reply Franky1, but it still does not answer the question. I want to know, if stronger Algorithms have been tested yet, and

if it required the same resources or if additional resources would be needed to use it. Most of these stronger algorithms are not used,

because it's too resource intensive and slow. < If I understand it correctly > Most of these SHA algorithms were created by the NSA, so

it is just logical to think that they too would be compromised.. if QC could be strong enough to crack it. 

[franky1]

Thanks for the reply Franky1, but it still does not answer the question. I want to know, if stronger Algorithms have been tested yet, and

if it required the same resources or if additional resources would be needed to use it. Most of these stronger algorithms are not used,

because it's too resource intensive and slow. < If I understand it correctly > Most of these SHA algorithms were created by the NSA, so

it is just logical to think that they too would be compromised.. if QC could be strong enough to crack it.  

using testnet, does not involve:
the 7 year historic data
or the exohashes of mining power.
ontop of that if its then playing around with different algo's then it is not a fair "bitcoin test".

but other algo's have been tested. yes.
and thats where some of the other alts came to be.

but concerning bitcoin future scenario's specifically
the argument flips around from:
'should we change bitcoin to use Y instead of X'
to a debate of:
'oh no, old coin holders(ie: nakamoto) wont move funds over to Y, so should we destroy old coins, with a deadman switch to stop d-wave users from getting "free" coin'.

[Yakamoto]

Quantum computers are definitely going to pose an interesting challenge for Bitcoin to overcome, however, I believe it will be relatively easy to develop such a solution once the computers become commonplace and people start learning how they are programmed and what they are able to do.

For right now it doesn't look like a big issue we have to worry about.

[piloder]

Still lots of question are unanswered regarding when does real working quantum computer prototype will be out for public so better not to worry about getting any attack on bitcoin network soon. Quantum computers still looks like a science friction.

[cjmoles]

I think that it is important to keep up with technology and be prepared to adapt to new innovations.  If it's not quantum computing that threatens bitcoin, then it may be some other innovation that could motivate new exploitation attempts.  That's why it's important to have a platform that's readily adaptive.  Long term governance stalemates may pose the biggest threat to the bitcoin platform applying such reasoning.

[JasonXG]

All it will do is make mining super fast for early investors and it will go back to the same after more and more people buy quantum computers. I really dont understand the big deal here. Its just newer and newer faster and better technology. Its always been that way.

[cjmoles]

All it will do is make mining super fast for early investors and it will go back to the same after more and more people buy quantum computers. I really dont understand the big deal here. Its just newer and newer faster and better technology. Its always been that way.

Well, the problem with faster and more efficient technologies is the amount of time required to hash thru large amounts of calculations.  Part of the security of the bitcoin platform relies on the length of time and resources available required to brute force elliptic curve cryptography....Faster, more efficient machines are more capable of brute force attacks. 

Reference:  https://www.schneier.com/blog/archives/2015/10/why_is_the_nsa_.html

[extrabyte]

Not on every case the Quantum computers can destroy something or decrypt something neither affecting the bitcoin if the core dev are prepared for this phenomena, a simple question and answer I found on wiki which can contribute on the discussion :

Q: "Is Bitcoin vulnerable to quantum computing?"
A: "Yes, most systems relying on cryptography in general are, including traditional banking systems. However, quantum computers don't yet exist and probably won't for a while. In the event that quantum computing could be an imminent threat to Bitcoin, the protocol could be upgraded to use post-quantum algorithms. Given the importance that this update would have, it can be safely expected that it would be highly reviewed by developers and adopted by all Bitcoin users."

[cjmoles]

Not on every case the Quantum computers can destroy something or decrypt something neither affecting the bitcoin if the core dev are prepared for this phenomena, a simple question and answer I found on wiki which can contribute on the discussion :

Q: "Is Bitcoin vulnerable to quantum computing?"
A: "Yes, most systems relying on cryptography in general are, including traditional banking systems. However, quantum computers don't yet exist and probably won't for a while. In the event that quantum computing could be an imminent threat to Bitcoin, the protocol could be upgraded to use post-quantum algorithms. Given the importance that this update would have, it can be safely expected that it would be highly reviewed by developers and adopted by all Bitcoin users."

Good point.  If the community is prepared to adapt to the pace of technology, then there are no worries.  However, if the community is resistant to change or reluctant to embrace the possibilities presented by innovation, then there may be a problem looming.  That's why topics like this are important....it takes the community to understand the shortcomings of the technology in order for them to be better equipped to adapt to the security needs of the network. The core developers, major minors, pool operators, or significant stake holders cannot do it alone.  Bitcoin's strength relies upon the inertial power of the entire network.

[Wind_FURY]

The day that a quantum computer is able to decrypt and take Bitcoin apart is the day that says that quantum computing has arrived. Will it destroy the Bitcoin economy? Sure it might but let us look at the bigger picture here. Putting our own self interests aside the test for a quantum computer to break Bitcoin opens the door of more possibilities and opportunities for humanity. It is an innovation enabler. It is still a threat, but a welcome one.

[severaldetails]

Honestly I do not think that the first thing people do with a quantum computer is to use it for bitcoin somehow.
And I don't see that this technology will be available for practical use within the next decades.
By then I am relatively convinced that bitcoin will be replayced by another currency.

[cjmoles]

Honestly I do not think that the first thing people do with a quantum computer is to use it for bitcoin somehow.
And I don't see that this technology will be available for practical use within the next decades.
By then I am relatively convinced that bitcoin will be replayced by another currency.

You've got a good point.  Trying to crack bitcoins code will not be at the top of the task list for those who have the resources required to get their hands on one.  So, it will probably be many years after quantum computing becomes available that those who have the tendency to do such things have the opportunity to get their hands on one long enough to be a threat to the network.

[extrabyte]

Not on every case the Quantum computers can destroy something or decrypt something neither affecting the bitcoin if the core dev are prepared for this phenomena, a simple question and answer I found on wiki which can contribute on the discussion :

Q: "Is Bitcoin vulnerable to quantum computing?"
A: "Yes, most systems relying on cryptography in general are, including traditional banking systems. However, quantum computers don't yet exist and probably won't for a while. In the event that quantum computing could be an imminent threat to Bitcoin, the protocol could be upgraded to use post-quantum algorithms. Given the importance that this update would have, it can be safely expected that it would be highly reviewed by developers and adopted by all Bitcoin users."

Good point.  If the community is prepared to adapt to the pace of technology, then there are no worries.  However, if the community is resistant to change or reluctant to embrace the possibilities presented by innovation, then there may be a problem looming.  That's why topics like this are important....it takes the community to understand the shortcomings of the technology in order for them to be better equipped to adapt to the security needs of the network. The core developers, major minors, pool operators, or significant stake holders cannot do it alone.  Bitcoin's strength relies upon the inertial power of the entire network.

I think that nobody would allow or approve something like this to not implement new security features because it is very important for the bitcoin community and for the core dev their-self. These years the most important part of a project is the privacy and the security which are highly sensitive.

[cjmoles]

Not on every case the Quantum computers can destroy something or decrypt something neither affecting the bitcoin if the core dev are prepared for this phenomena, a simple question and answer I found on wiki which can contribute on the discussion :

Q: "Is Bitcoin vulnerable to quantum computing?"
A: "Yes, most systems relying on cryptography in general are, including traditional banking systems. However, quantum computers don't yet exist and probably won't for a while. In the event that quantum computing could be an imminent threat to Bitcoin, the protocol could be upgraded to use post-quantum algorithms. Given the importance that this update would have, it can be safely expected that it would be highly reviewed by developers and adopted by all Bitcoin users."

Good point.  If the community is prepared to adapt to the pace of technology, then there are no worries.  However, if the community is resistant to change or reluctant to embrace the possibilities presented by innovation, then there may be a problem looming.  That's why topics like this are important....it takes the community to understand the shortcomings of the technology in order for them to be better equipped to adapt to the security needs of the network. The core developers, major minors, pool operators, or significant stake holders cannot do it alone.  Bitcoin's strength relies upon the inertial power of the entire network.

I think that nobody would allow or approve something like this to not implement new security features because it is very important for the bitcoin community and for the core dev their-self. These years the most important part of a project is the privacy and the security which are highly sensitive.

Well, people are constantly attacking the network and some are doing so not so covertly....It doesn't take much of an imagination to think that there may be some groups willing to break bitcoin's code who're actually valued members of the community themselves....In fact, I was just reading about this project here on our own forum who claim to have had some success with their own bitcoin collider project:  https://bitcointalk.org/index.php?topic=1573035.0  Imagine what such groups could do with more powerful resources!

[Meuh6879]

Segregated witness soft fork

Segregated witness (segwit) is a soft fork that, if activated, will
allow transaction-producing software to separate (segregate) transaction
signatures (witnesses) from the part of the data in a transaction that is
covered by the txid. This provides several immediate benefits:

   Elimination of unwanted transaction malleability: Segregating the witness
      allows both existing and upgraded software to calculate the transaction
      identifier (txid) of transactions without referencing the witness, which can
      sometimes be changed by third-parties (such as miners) or by co-signers in a
      multisig spend. This solves all known cases of unwanted transaction
      malleability, which is a problem that makes programming Bitcoin wallet
      software more difficult and which seriously complicates the design of smart
      contracts for Bitcoin.

   Capacity increase: Segwit transactions contain new fields that are not
      part of the data currently used to calculate the size of a block, which
      allows a block containing segwit transactions to hold more data than allowed
      by the current maximum block size. Estimates based on the transactions
      currently found in blocks indicate that if all wallets switch to using
      segwit, the network will be able to support about 70% more transactions. The
      network will also be able to support more of the advanced-style payments
      (such as multisig) than it can support now because of the different weighting
      given to different parts of a transaction after segwit activates (see the
      following section for details).

   Weighting data based on how it affects node performance: Some parts of
      each Bitcoin block need to be stored by nodes in order to validate future
      blocks; other parts of a block can be immediately forgotten (pruned) or used
      only for helping other nodes sync their copy of the block chain.  One large
      part of the immediately prunable data are transaction signatures (witnesses),
      and segwit makes it possible to give a different "weight" to segregated
      witnesses to correspond with the lower demands they place on node resources.
      Specifically, each byte of a segregated witness is given a weight of 1, each
      other byte in a block is given a weight of 4, and the maximum allowed weight
      of a block is 4 million.  Weighting the data this way better aligns the most
      profitable strategy for creating blocks with the long-term costs of block
      validation.

   Signature covers value: A simple improvement in the way signatures are
      generated in segwit simplifies the design of secure signature generators
      (such as hardware wallets), reduces the amount of data the signature
      generator needs to download, and allows the signature generator to operate
      more quickly.  This is made possible by having the generator sign the amount
      of bitcoins they think they are spending, and by having full nodes refuse to
      accept those signatures unless the amount of bitcoins being spent is exactly
      the same as was signed.  For non-segwit transactions, wallets instead had to
      download the complete previous transactions being spent for every payment
      they made, which could be a slow operation on hardware wallets and in other
      situations where bandwidth or computation speed was constrained.

   Linear scaling of sighash operations: In 2015 a block was produced that
      required about 25 seconds to validate on modern hardware because of the way
      transaction signature hashes are performed.  Other similar blocks, or blocks
      that could take even longer to validate, can still be produced today.  The
      problem that caused this can't be fixed in a soft fork without unwanted
      side-effects, but transactions that opt-in to using segwit will now use a
      different signature method that doesn't suffer from this problem and doesn't
      have any unwanted side-effects.

   Increased security for multisig: Bitcoin addresses (both P2PKH addresses
      that start with a '1' and P2SH addresses that start with a '3') use a hash
      function known as RIPEMD-160.  For P2PKH addresses, this provides about 160
      bits of security---which is beyond what cryptographers believe can be broken
      today.  But because P2SH is more flexible, only about 80 bits of security is
      provided per address. Although 80 bits is very strong security, it is within
      the realm of possibility that it can be broken by a powerful adversary.
      Segwit allows advanced transactions to use the SHA256 hash function instead,
      which provides about 128 bits of security  (that is 281 trillion times as
      much security as 80 bits and is equivalent to the maximum bits of security
      believed to be provided by Bitcoin's choice of parameters for its Elliptic
      Curve Digital Security Algorithm [ECDSA].)


We make a better world/network ... but you can choose to not use it ... if you want.


   More efficient almost-full-node security Satoshi Nakamoto's original
      Bitcoin paper describes a method for allowing newly-started full nodes to
      skip downloading and validating some data from historic blocks that are
      protected by large amounts of proof of work.  Unfortunately, Nakamoto's
      method can't guarantee that a newly-started node using this method will
      produce an accurate copy of Bitcoin's current ledger (called the UTXO set),
      making the node vulnerable to falling out of consensus with other nodes.
      Although the problems with Nakamoto's method can't be fixed in a soft fork,
      Segwit accomplishes something similar to his original proposal: it makes it
      possible for a node to optionally skip downloading some blockchain data
      (specifically, the segregated witnesses) while still ensuring that the node
      can build an accurate copy of the UTXO set for the block chain with the most
      proof of work.  Segwit enables this capability at the consensus layer, but
      note that Bitcoin Core does not provide an option to use this capability as
      of this 0.13.1 release.

   Script versioning: Segwit makes it easy for future soft forks to allow
      Bitcoin users to individually opt-in to almost any change in the Bitcoin
      Script language when those users receive new transactions.  Features
      currently being researched by Bitcoin Core contributors that may use this
      capability include support for Schnorr signatures, which can improve the
      privacy and efficiency of multisig transactions (or transactions with
      multiple inputs), and Merklized Abstract Syntax Trees (MAST), which can
      improve the privacy and efficiency of scripts with two or more conditions.
      Other Bitcoin community members are studying several other improvements
      that can be made using script versioning.