Is the proposed BIP 360 the correct way to achieve quantum attack resistance?

[d5000]

Every major breakthrough in quantum computing gets hailed as “the end of Bitcoin” except for the part where people conveniently forget that if some computer can break the math that secures Bitcoin, we’re all in big trouble anyway.  That same math secures the entire traditional banking system, all the encrypted websites people rely on, all the military communications, and all the passwords people store online.

I get this, but there is a little difference: the convenience and speed of an upgrade to QC-resistant cryptography.

Banks often use SaaS cloud software platforms, or at least quite standardized software. The software vendors can simply upgrade the cryptography and then the platforms would be secure again. And the signature size isn't so much a problem too.

On Bitcoin instead, an upgrade potentially can take a lot of time. Not because simply integrating FALCON or some other cryptosystem would be a really big deal, but because all "quantum resistant" protocols have big signature sizes, and thus you will have to try to integrate this in the plan, because if everybody rushes to upgrade from ECDSA to FALCON we would run into a huge block space bottleneck. We would probably need a new Segwit witness discount for these signatures. And have to estimate how high will be the additional blockspace needed for the "transition rush" as a lot of people would like to secure their funds ASAP.

Then there has to be decided if there's done something with P2PK and other vulnerable outputs, or not, which can lead to heated discussions and even to a hard fork.

So the planning for the post-quantum world is a little bit more complex in Bitcoin. But I agree that it's overdramatized. From today's point of view addresses which were not re-used are safe and there are ways to protect and move them even if a QC exists which can hack a key in 10 minutes. All solutions are on the table, with the exception of P2PK and friends where probably no ideal solution exists, but a redistribution of old "lost" funds would also not kill Bitcoin.

[B1-66ER]

Every major breakthrough in quantum computing gets hailed as “the end of Bitcoin” except for the part where people conveniently forget that if some computer can break the math that secures Bitcoin, we’re all in big trouble anyway.  That same math secures the entire traditional banking system, all the encrypted websites people rely on, all the military communications, and all the passwords people store online.

I get this, but there is a little difference: the convenience and speed of an upgrade to QC-resistant cryptography.

Banks often use SaaS cloud software platforms, or at least quite standardized software. The software vendors can simply upgrade the cryptography and then the platforms would be secure again. And the signature size isn't so much a problem too.

On Bitcoin instead, an upgrade potentially can take a lot of time. Not because simply integrating FALCON or some other cryptosystem would be a really big deal, but because all "quantum resistant" protocols have big signature sizes, and thus you will have to try to integrate this in the plan, because if everybody rushes to upgrade from ECDSA to FALCON we would run into a huge block space bottleneck. We would probably need a new Segwit witness discount for these signatures. And have to estimate how high will be the additional blockspace needed for the "transition rush" as a lot of people would like to secure their funds ASAP.

Then there has to be decided if there's done something with P2PK and other vulnerable outputs, or not, which can lead to heated discussions and even to a hard fork.

So the planning for the post-quantum world is a little bit more complex in Bitcoin. But I agree that it's overdramatized. From today's point of view addresses which were not re-used are safe and there are ways to protect and move them even if a QC exists which can hack a key in 10 minutes. All solutions are on the table, with the exception of P2PK and friends where probably no ideal solution exists, but a redistribution of old "lost" funds would also not kill Bitcoin.

So basically your freakout is similar to miners about next halving?

Best,

[dkbit98]

I heard some wallets already started working on adding bc1z segwit v2 addresses from bip-360 proposal, but thus is still in early development phase.

What I don't understand is how adding new type of addresses is going to give quantum protection to bitcoin, unless all bitcoin is moved from old to new addresses?

[d5000]

So basically your freakout is similar to miners about next halving?

Freakout? Lol no. I'm only in the camp that "we should plan a bit ahead, but no rush". And BIP 360, in its new iteration, seems a good way forward to me.

What I don't understand is how adding new type of addresses is going to give quantum protection to bitcoin, unless all bitcoin is moved from old to new addresses?

Only re-used addresses (where the public key was published on chain, i.e. people have spent money from that address) and some special kinds of addresses which are barely used (P2PK, and some P2TR) are vulnerable currently.

So it's not that everybody must move. Most people can relax and wait.

Once the new addresses arrive, it may be an option for those who hodl large amounts of coins and thus wouldn't be worried about the fees.

It has of course to be said that the current BIP-360 does not include quantum-secure cryptography yet (this is a second step and probably years ahead). But they allow to create Taproot scripts without the P2TR vulnerability more easily.

[stwenhao]

and some P2TR

Not some. All P2TR. If you can spend by key, then you can completely ignore all TapScript behind it. And even if someone used some NUMS point, then still: when secp256k1 will be broken, private keys for these points will be known, too.

The only unaffected P2TR or P2PK are those with invalid public keys, but they cannot be moved by anyone.