What to do with Satoshi Stash? Jameson Lopp has a view.

[fillippone]

A new blog post appeared on Jameson Lopp

Against Allowing Quantum Recovery of Bitcoin


In this article, Jameson Lopp addresses the potential threat quantum computing poses to Bitcoin's security. Jameson outlines scenarios where quantum computers could potentially exploit Bitcoin's current cryptographic vulnerabilities to access funds, especially those in addresses with exposed public keys.
Lopp argues that permitting such quantum-based recovery would lead to wealth redistribution favouring entities with early access to quantum technology, undermining Bitcoin's principles of decentralisation and property rights.
He proposes some measures, such as implementing quantum-resistant cryptographic schemes, something that is relatively trivial, but above all, potentially rendering vulnerable funds (such as Patoshi funds), unspendable, to preserve the network's integrity and trust:

In Summary
While the moral quandary of violating any of Bitcoin's inviolable properties can make this a very complex issue to discuss, the game theory and incentives between burning vulnerable coins versus allowing them to be claimed by entities with quantum supremacy are a much simpler issue.
I, for one, am not interested in rewarding quantum capable entities by inflating the circulating money supply just because some people lost their keys long ago and some laggards are not upgrading their bitcoin wallet's security.
We can hope that this scenario never comes to pass, but hope is not a strategy.
The game is afoot!

The position is not new: I first heard of it in his talk at the "Future of Bitcoin Conference 2024," a video that is, by the way, linked in the above blogpost.



I highly recommend viewing this video before reading the blog post.

This proposal leaves me with mixed feelings.

What is your position on this proposal?

[Faisal2202]

I did not liked the board saying "safeguarding Satoshi's Stash" everyone's Satoshi's are important. Well I read the blog (only 80%) it was good, if some rich dude or whale gets their hand on a quantum computer, they will surely need some great resources for that, I mean owners are not just going to release QCs as they releases AI models which I doubt they were already using for a long time.

Same way, QCs owners will only publicize it after lots of documentations, government might involve too because not only BTC is vulnerable to it. World has been digitalized and most of the technologia are vulnerable to QCs.

Proper supply should be tracked, like who bought it, proper usage should be taught, so combined rich people definitely need many resources to pull this off.

I think it would be better if someone from Usa or any other country, with functional QCs comes forward and says we will, break the old or most vulnerable wallets, and not seize, or release the supply back to the market, but will give it back to the right full owner by taking some commission. But it will still dump the btc due to the reasons it was famous will be no more like,

Conservatism
Forward Compatibility
Censorship Resistance

[Felicity_Tide]

A new blog post appeared on Jameson Lopp

Against Allowing Quantum Recovery of Bitcoin


In this article, Jameson Lopp addresses the potential threat quantum computing poses to Bitcoin's security. Jameson outlines scenarios where quantum computers could potentially exploit Bitcoin's current cryptographic vulnerabilities to access funds, especially those in addresses with exposed public keys.
Lopp argues that permitting such quantum-based recovery would lead to wealth redistribution favouring entities with early access to quantum technology, undermining Bitcoin's principles of decentralisation and property rights.
He proposes some measures, such as implementing quantum-resistant cryptographic schemes, something that is relatively trivial, but above all, potentially rendering vulnerable funds (such as Patoshi funds), unspendable, to preserve the network's integrity and trust:

~snip

The position is not new: I first heard of it in his talk at the "Future of Bitcoin Conference 2024," a video that is, by the way, linked in the above blogpost.



I highly recommend viewing this video before reading the blog post.

This proposal leaves me with mixed feelings.

What is your position on this proposal?

I think the video already gives the insight to the blog post.
This issue has also been raised several times, but this particular one raises more question with possibilities.
So many questions running through my mind while watching the video.

First, we are still a bit far from witnessing all these proposed vulnerabilities, but the need to start putting preparation at heart is not a bad idea at all. There is a high probability that powerful high quantum computers will be in existence soon( I think we already have few, but not sure of how powerful they are).

The proposal to allow quantum computers bring back lost coins into circulation isn't a healthy one imo. Who exactly are they proposing to handle the coins over to?, because the last time I checked, they are already mined but lost. Bitcoin enthusiasts needs to be careful with what they propose, as making some drastic decisions to the protocol might complicate things.

And I believe the community can find a solution not just because of the valuable addresses at risk, but because of the need to protect the Bitcoin protocol, since almost everyone might likely be affected if things eventually goes south.

[Catenaccio]

I did not liked the board saying "safeguarding Satoshi's Stash" everyone's Satoshi's are important.

Basically you are right and every satoshi worths the same, but if you think more deeply, you will recognize that Satoshi's stash is oldest in Bitcoin commmunity. Bitcoin blockchain is like layers of blocks and Satoshi's stash belongs to oldest layers that are deepest in the Bitcoin blockchain.

If anything can dig deeply enough to Satoshi's stash, that means no satoshi of anyone is safe while oldest, deepest and assumedly safest satoshis were no longer safe.

Bitcoin blockchain.

The blockchain is often visualized as a vertical stack, with blocks layered on top of each other and the first block serving as the foundation of the stack. The visualization of blocks stacked on top of each other results in the use of terms such as "height" to refer to the distance from the first block, and "top" or "tip" to refer to the most recently added block.

One way to think about the blockchain is like layers in a geological formation, or glacier core sample. The surface layers might change with the seasons, or even be blown away before they have time to settle. But once you go a few inches deep, geological layers become more and more stable. By the time you look a few hundred feet down, you are looking at a snapshot of the past that has remained undisturbed for millions of years. In the blockchain, the most recent few blocks might be revised if there is a chain reorganization due to a fork. The top six blocks are like a few inches of topsoil. But once you go more deeply into the blockchain, beyond six blocks, blocks are less and less likely to change. After 100 blocks back there is so much stability that the coinbase transaction—​the transaction containing the reward in bitcoin for creating a new block—​can be spent. While the protocol always allows a chain to be undone by a longer chain and while the possibility of any block being reversed always exists, the probability of such an event decreases as time passes until it becomes infinitesimal.

[nutildah]

I am listening to the video, fast-forwarded through all the Alice->Bob stuff (although it is highly educational), and noticed Lopp said he wasn't sure satoshi ever commented on threats of quantum computing. He did indeed address the subject one time:

However, if something happened and the signatures were compromised (perhaps integer factorization is solved, quantum computers?), then even agreeing upon the last valid block would be worthless.

True, if it happened suddenly.  If it happens gradually, we can still transition to something stronger.  When you run the upgraded software for the first time, it would re-sign all your money with the new stronger signature algorithm.  (by creating a transaction sending the money to yourself with the stronger sig)

Like most things done by the Bitcoin Core devs, I'm sure they will approach proposed changes very carefully and slowly. First, private corporations like IBM and Google need to demonstrate that they can crack ECDS or something equally difficult. By that point, hopefully core devs will have something in place to roll out in a new version to either protect or destroy vulnerable coins.

The first real-world applications of such advanced quantum computing power will assuredly be military-related, but we might not know about their existence. By the time commercially-available QC have arrived, safeguards for Bitcoin will have been safely implemented.

[d5000]

I'm quite skeptical regarding the "burning" option. But I think the Bitcoin devs should think already in the next years about possibilities to offer alternative cryptographic schemes. I would even argue, "the faster the better", because the more time the user base has to upgrade, more upgrading will probably be done. The best option in my opinion is to offer several algorithms, as currently there seems to be no consensus about the "best" quantum proof scheme. Or directly offer a flexible set of operations allowing several schemes (Simplicity, perhaps? Something based on BitVM?). So the desperate can already try the option out.

Regarding the advantage/disadvantage of the "burn option":

I think the faster the threat emerges, the higher is the potential damage that could be done by the attackers. Thus, perhaps it would be an option to already prepare the code for an eventual "emergency", i.e. a burn option like Lopp proposes. It could be only a last resort fork, a kind of "nuclear option".

In the best case it never would be needed to be rolled out because most of the owners of the affected coins have already migrated when the attack is being detected. It could even make the attacker's cost/benefit equation more disadvantageous for them: At least at the start of the "quantum computing wave", they would have to invest a lot of time and money to crack a single address. If there is a possibility that their funds are being burnt, they would perhaps not even try it, and thus the resources invested in the attacks would stay small, giving those who have still not migrated the needed time to do it.

[Alpha Marine]

I think it would be better if someone from Usa or any other country, with functional QCs comes forward and says we will, break the old or most vulnerable wallets, and not seize, or release the supply back to the market, but will give it back to the right full owner by taking some commission. But it will still dump the btc due to the reasons it was famous will be no more like,

Whatever they say doesn't matter. They can say one thing and do something else as long as they can get away with it. You often hear software owners say they won't take user's private data, but that is not always the case. They say your data is safe with them, but that is not always the case. So even if they come and say this, I don't think we can hold their word for it.

I only have a basic understanding of QCs, but if they're truly able to access wallets, without the secret phrases then like you said, bitcoin is not all that is at risk, so I agree with what the blog said that there should be a way, on the wallets end, to prevent this from happening

[ABCbits]

What is your position on this proposal?

IMO the idea of "burning" (some people call it "freezing") is less worse than idea of redistribute Bitcoin from all vulnerable address, which also bring debate on how to perform the redistribution.

I think it would be better if someone from Usa or any other country, with functional QCs comes forward and says we will, break the old or most vulnerable wallets, and not seize, or release the supply back to the market, but will give it back to the right full owner by taking some commission. But it will still dump the btc due to the reasons it was famous will be no more like,

Looking at history, they'll just take it for themselves. Does anyone remember when US government seized BTC-e exchange, where BTC-e user never get their BTC back?

[Ambatman]

I understand the threat of quantum computing
But following his idea goes against Bitcoin monetary policy
Who decides what a vulnerable coin is?
And the burn option doesn't sit well with me. I believe it should be a last resort and not a plan A.

Yeah the burn idea may discourage quantum attack when implemented on time
But it sacrifices innocent users( even time locked Btc for kids or hires would be lost)
and it doesn't really solve the problem.

What is your position on this proposal?

Too extreme how would the common folk view it
That's it's possible for their coins to be burned by another
Where's the self custody and control in that.

I believe dev should start working now (I'm sure they might have started)
The faster the Better and if it would require migration
People would have the time to move on their own terms ( though some wouldn't since people still use legacy till date. Maybe the burn as punishment to encourage migration)

https://research.ibm.com/projects/quantum-safe-cryptography?utm_source=chatgpt.com

Cryptography resistance towards quantum computing has already been ongoing since it would be a threat to current world technology.

[d5000]

Who decides what a vulnerable coin is?

This would be easy in my opinion. Vulnerable coins are all those where the public key has been published: P2PK and re-used addresses. I would however limit the "burning" strictly to P2PK scripts. Re-used addresses are extremely common and it would take a lot of block space to move them, in most cases I think also the incentive to attack them is low. But in the case of P2PK, there are millions of coins affected.

IMO the idea of "burning" (some people call it "freezing") is less worse than idea of redistribute Bitcoin from all vulnerable address, which also bring debate on how to perform the redistribution.

For re-distribution, there would be a quite easy and uncontroversial method: adding the coins to the future mining rewards to make the halving curve a bit smoother. IMO if this is an option the rewards should be moved into the far future, for example when the regular reward has fallen below 0.1 BTC or so.

[Mia Chloe]

In this article, Jameson Lopp addresses the potential threat quantum computing poses to Bitcoin's security. Jameson outlines scenarios where quantum computers could potentially exploit Bitcoin's current cryptographic vulnerabilities to access funds, especially those in addresses with exposed public keys.

Well let's start with the obvious facts, you just can't stop technology from evolving and basically it simply means quantum computing could be the next evolution of computing but that doesn't really leave Bitcoin 100% vulnerable. Just like quantum computers can be created so also can the security on bitcoin be improved later on in the future at least on a logical basis.

To start with quantum computing is still very far ahead in the future of technology creating a quantum chip isn't as easy as most articles put it out and the thing is it brings concerns though the chances of we achieving it is still relatively far in time.

[cr1776]

One would think that prior to an attack on bitcoin other coins would be attacked first, e.g. Ethereum given the way I understand that public keys are exposed vs bitcoin, so there could be some warning from softer, vulnerable and valuable targets to attack such as alt coins, governments, and financial institutions.  

However, none of this changes the points made and the importance of looking at the issue sooner versus later given the long lead time that will be necessary since there could be little warning.  I have seen estimates in the 2030-2035 range for a potential attack and the US Federal government tells agencies they must transition by 2035 to a quantum safe scheme further emphasizing the potential urgency.  Of course, some argue it could take "decades" or even longer—if it ever happens at all—so there is significant uncertainty about when a successful attack might occur.

To me, this is a "prepare for the worst and hope for the best" scenario. As he noted, whether coins are "burned" or "stolen," the outcome is the same for their owners: they lose control of their assets. Logically, they might even prefer for their coins to be burned rather than stolen, as it would prevent dilution of any remaining holdings and help mitigate systemic damage to the ecosystem.

The original was posted to bitcoindev and there has been some discussion.

See:
https://groups.google.com/g/bitcoindev/c/uUK6py0Yjq0/m/NlRRiW-xAgAJ?utm_medium=email&utm_source=footer&pli=1

[d5000]

One would think that prior to an attack on bitcoin other coins would be attacked first, e.g. Ethereum given the way I understand that public keys are exposed vs bitcoin,

I've also thought about Ethereum. If I don't understand something wrong, they would be affected much more than Bitcoin, as almost everybody is re-using addresses due to the "account" model their smart contract scheme depends on. Thus perhaps there is much more pressure in the ETH community to come up with a "quantum safe" solution. As Bitcoin has perhaps a bit more time, BTC could use ETH as a guinea pig

ETH has the following "roadmap":

https://www.btq.com/blog/ethereums-roadmap-post-quantum-cryptography

In short, they are now already developing solutions to post zk-STARK proofs, and the version 3.0 they aspire to publish in 2027 would include Winternitz signatures. AFAIK this is however still not really a "replacement" for a full fledged public key cryptosystem.

https://groups.google.com/g/bitcoindev/c/uUK6py0Yjq0/m/NlRRiW-xAgAJ?utm_medium=email&utm_source=footer&pli=1

Interesting, thank you for linking. Matt Corallo seems to agree to a fast softfork enabling quantum-resistant cryptography, but others are more skeptic.

[fillippone]

IMO the idea of "burning" (some people call it "freezing") is less worse than idea of redistribute Bitcoin from all vulnerable address, which also bring debate on how to perform the redistribution.

The idea of redistributing Bitcoin is so wrong that I can't even begin to consider how to argue against it.

What if they "move" the burned coin to the "tail emission" of the protocol?
If you burn 1 million "weak" coins, you will add 1 million tail emission after the 32nd halving at one satoshi per block.
We should be ok for the next couple of billion years.

[Pablo-wood]

Looking at history, they'll just take it for themselves. Does anyone remember when US government seized BTC-e exchange, where BTC-e user never get their BTC back?

Even if they were intentions of releasing the coin to the so called original owners how do they verify their authenticity when they no longer have access to their private keys. If entities with QC supremacy cracks down the ECDSA they will obviously do away with it.

For re-distribution, there would be a quite easy and uncontroversial method: adding the coins to the future mining rewards to make the halving curve a bit smoother. IMO if this is an option the rewards should be moved into the far future, for example when the regular reward has fallen below 0.1 BTC or so.

This looks like a hard fork suggestion. Where the mining reward rules will have to be changed which will affect the initial standard halving schedule. This might lead to centralisation as large mining will stand a chance to benefit more.


Redistribution will remain a major concern if it eventually gets cracked. But my own funny suggestion is redistributing them to active addresses with UXTOs. I think it takes consensus to make a decision in the bitcoin ecosystem.

[yhiaali3]

It's difficult to decide because opinions are so diverse, but in my personal opinion, I think burning or freezing would be a more ethical and sound choice than the supposed redistribution that would be carried out by entities with quantum power, which would most likely be central governments.

[Darker45]

I don't think we would just wake up one day and one man is already capable of breaking into wallets. The progress is likely gradual. To those that are threatened by the rise of quantum capabilities, like Bitcoin, the solution should come first before the problem arrives. Or at least there's already sufficient preparation. I can only hope the 4th scenario of Lopp is what's going to happen.

Should the solution involves either freezing vulnerable funds or the same should be left available for whoever has the capability, I prefer the former. Both have heavy cons, but considering the huge amount of vulnerable funds, I'm imagining the market to fall hard. But that's not even the main concern. The main concern is that it's probably a chaotic scenario when people and institutions are racing against each other, investing heavily in their capabilities, to legally steal other people's money. That's not a nice sight to behold. That must sufficiently discourage others to even consider getting into Bitcoin.

Anyway, for the rest of us plebs who are fearful of this doomsday possibility:

If you're worried about elliptic curve cryptography being broken, then don't store any significant wealth in Bitcoin.

[d5000]

But my own funny suggestion is redistributing them to active addresses with UXTOs.

This would take a lot of block space, or some kind of "gigablock", also creating a lot of dust (you could exclude dust but that would be borderline unfair). Alternatively you could do some weird calculation and simply create the coins out of thin air and "add" them to balances, but I believe this would be strongly opposed. And both options would certanily need a hard fork too.

The outcome would  be however very similar to the "burn option". The Bitcoin distribution after this event will be the same than if the coins are burnt (with the exception of the "blocked" coins). The additional coins on paper would "create value", but also create a lot of sell pressure (like an airdrop), and at the end in terms of purchasing parity you have the same "value" on your addresses. So - is it worth the trouble?

[davis196]

Lopp argues that permitting such quantum-based recovery would lead to wealth redistribution favouring entities with early access to quantum technology, undermining Bitcoin's principles of decentralisation and property rights.

Jameson Lopp is right about this potential threat, but he misses the point that quantum computing might crash the BTC price, therefore all this "wealth redistribution" thing might not happen. Imagine somebody with a quantum computer brute forcing and gaining access to Satoshi's wallet. The BTC price would crash to 1K USD(or less) in no time, so this guy would end up with way less money than he expected. This defeats the whole purpose of using a pretty expensive quantum computer to gather some easy BTC. And of course, all the Bitcoin developers won't just sit there and do nothing. They will implement quantum resistant cryptography, which would make the whole "get easy BTC with a quantum computer" thing really difficult.

[Curious T]

I don't think there's anything we can do aside from finding ways to make sure this doesn't happen. We can stop billionaire corporations from building quantum computers and the fact they assure us that they will do no sure thing isn't enough. We also can't rely on the government to regulate them.
I personally don't think its something to be scared about because for now it's beyond expensive to build a quantum computer and I doubt any company that manages to do it will involve themselves in such a risky act.