J. Lopp's Post-Quantum Migration BIP

[Wind_FURY]

Laughable.

Everyone could make a debate/have an opinion that Bitcoin is "relatively safe" or "hacks and these sorts of things" have happened in Bitcoin before so "it's OK", or pretend that the Quantum Threat is not a real issue.

But I will tell you, that as long as Bitcoin is NOT Quantum Resistant, THEN investor-confidence in it as a Store Of Value and user-confidence for it as a Medium Of Exchange will go down.

[Satofan44]

Laughable.

Everyone could make a debate/have an opinion that Bitcoin is "relatively safe" or "hacks and these sorts of things" have happened in Bitcoin before so "it's OK", or pretend that the Quantum Threat is not a real issue.

But I will tell you, that as long as Bitcoin is NOT Quantum Resistant, THEN investor-confidence in it as a Store Of Value and user-confidence for it as a Medium Of Exchange will go down.

Nonsense, stop writing FUD bullshit -- this is not any better than the spam FUD that you are vehemently against. These kind of generalized statements and exaggerations of quantum threats are useless. Read the details of a discussion and participate on an according level. If you can't, then it is better to shut up instead. Recently you have been on a FUD campaign, whether it is about block rewards or quantum computers -- the pattern is clear. The real risk of quantum computers is very low.
If you had understood anything that is being written you would be disposing merits on these posts, instead it is evident that your signature campaign is the reason to write yet another useless post that has no substance of any kind.  

It is not an existential threat and they are not the only coins that will remain vulnerable. Some people will fail to upgrade to addresses that don't have their public keys exposed over time. This is inevitable. These are the possibilities:

1) Freeze temporarily or permanently (they can't be moved under any conditions).
2) Confiscate (reintroduce back into supply for some reason, say mining schedule).
3) Leave them as they are and let them get taken and reintroduced into the market.

The trade off is not worth it.

Back to the basics. Coins get hacked all the time, it has no impact on the function of store of value.    A one-time large hack does not have an impact on monetary functions, not that there is a high likelihood that it would happen to begin with. We've been down this road before in many topics, but Wind_FURY like many signature spammers does not read previous posts in a thread. These things have been addressed in detail and nuance by many different individuals across many threads.

[Wind_FURY]

Laughable.

Everyone could make a debate/have an opinion that Bitcoin is "relatively safe" or "hacks and these sorts of things" have happened in Bitcoin before so "it's OK", or pretend that the Quantum Threat is not a real issue.

But I will tell you, that as long as Bitcoin is NOT Quantum Resistant, THEN investor-confidence in it as a Store Of Value and user-confidence for it as a Medium Of Exchange will go down.

Nonsense, stop writing FUD bullshit -- this is not any better than the spam FUD that you are vehemently against. These kind of generalized statements and exaggerations of quantum threats are useless. Read the details of a discussion and participate on an according level. If you can't, then it is better to shut up instead. Recently you have been on a FUD campaign, whether it is about block rewards or quantum computers -- the pattern is clear. The real risk of quantum computers is very low.
If you had understood anything that is being written you would be disposing merits on these posts, instead it is evident that your signature campaign is the reason to write yet another useless post that has no substance of any kind.  

It is not an existential threat and they are not the only coins that will remain vulnerable. Some people will fail to upgrade to addresses that don't have their public keys exposed over time. This is inevitable. These are the possibilities:

1) Freeze temporarily or permanently (they can't be moved under any conditions).
2) Confiscate (reintroduce back into supply for some reason, say mining schedule).
3) Leave them as they are and let them get taken and reintroduced into the market.

The trade off is not worth it.

Back to the basics. Coins get hacked all the time, it has no impact on the function of store of value.    A one-time large hack does not have an impact on monetary functions, not that there is a high likelihood that it would happen to begin with. We've been down this road before in many topics, but Wind_FURY like many signature spammers does not read previous posts in a thread. These things have been addressed in detail and nuance by many different individuals across many threads.

What's "FUD bullshit"? I'm talking about a perceived threat, which I admit, may not or may not be true. But as long as it's there, and if there are not any assurances made that the threat isn't eliminated, then truly the confidence in that which is threatened will go down.

Or do you actually disagree that Bitcoin should be Quantum Resistant? You don't believe that Quantum Computers that could break SHA-256 are coming?

[tromp]

You don't believe that Quantum Computers that could break SHA-256 are coming?

Quantum computers only get a quadratic speed up on breaking hash functions (with Grover's algorithm),
so that threat is negligible compared to the breaking of ECDLP with the exponential speedup of Shor's algorithm.

[Satofan44]

Or do you actually disagree that Bitcoin should be Quantum Resistant? You don't believe that Quantum Computers that could break SHA-256 are coming?

This is why I advised you to start looking for other discussions about this if you truly care about the knowledge regarding this subject matter. This was addressed too by many people in different threats. Mining is not vulnerable, addresses that are not reused are not vulnerable. Even under the worst case scenario only old coins on P2PK addresses and coins on addresses that are being reused are vulnerable. Furthermore, as talked about on previous pages -- the risk that is created by doing any kind of confiscation or freezing even once for the pretense of protecting Bitcoin against quantum computers is much higher than 1M coins being dumped on the market. It will set a precedence that under certain scenarios freezing is justifiable, which would turn BTC into Ethereum lite. 

You don't believe that Quantum Computers that could break SHA-256 are coming?

Quantum computers only get a quadratic speed up on breaking hash functions (with Grover's algorithm),
so that threat is negligible compared to the breaking of ECDLP with the exponential speedup of Shor's algorithm.

Yes this. The risk to SHA256 is non-existent using the current knowledge about how quantum computers can operate.

[Wind_FURY]

My friend sent me this link. He already told me, as I have already said from a previous post, that Scott Aaronson is a respected researcher in the world of Quantum Computing. I believe this webinar/talk/video stream should give us some answers/insights/thoughts.

Although, I would like gmaxwell's opinion about Scott Aaronson.

Will Quantum Computing Kill Bitcoin?

Is “Q-day” around the corner?

Quantum computing (QC) is often cited as the ultimate threat to cryptography, but how close are we really to a "Q-Day" scenario?

We’re putting together two renowned theoretical computer scientists – Scott Aaronson is the leading public authority on QC research and Eli Ben-Sasson is the leading public authority on post-quantum secure ZK.

Together, they cut through the hype to discuss the true state of QC research, the timeline for potential breakthroughs, and the potential impact and mitigations for Bitcoin and other blockchains.

https://streamyard.com/watch/B4XWkvjqYsn9

[Satofan44]

My friend sent me this link. He already told me, as I have already said from a previous post, that Scott Aaronson is a respected researcher in the world of Quantum Computing. I believe this webinar/talk/video stream should give us some answers/insights/thoughts.

Although, I would like gmaxwell's opinion about Scott Aaronson.

You know since people often bring up who luke-jr is in the discussions that relate to him therefore we have to be fair here. Let's take a look at what it says about this person.

Aaronson is Jewish, and has described himself as "radicalized in my Jewish and Zionist identities".
https://en.wikipedia.org/wiki/Scott_Aaronson

Unbiased, objective and reputable researcher. How about you ask a Zionist offspring of Jensen Huang whether real AI is just around the corner? Better sell some of your family members in exchange for some AI hardware.

Will Quantum Computing Kill Bitcoin?

No.

Is “Q-day” around the corner?

No.

Quantum computing (QC) is often cited as the ultimate threat to cryptography, but how close are we really to a "Q-Day" scenario?

Overblown by several proportions, similar to the AI bullshit just slightly less worse.
There, I answered your panicking and FUD once more. No Zionist Andersen was needed.

[Wind_FURY]

My friend sent me this link. He already told me, as I have already said from a previous post, that Scott Aaronson is a respected researcher in the world of Quantum Computing. I believe this webinar/talk/video stream should give us some answers/insights/thoughts.

Although, I would like gmaxwell's opinion about Scott Aaronson.

You know since people often bring up who luke-jr is in the discussions that relate to him therefore we have to be fair here. Let's take a look at what it says about this person.

Aaronson is Jewish, and has described himself as "radicalized in my Jewish and Zionist identities".
https://en.wikipedia.org/wiki/Scott_Aaronson

Unbiased, objective and reputable researcher. How about you ask a Zionist offspring of Jensen Huang whether real AI is just around the corner? Better sell some of your family members in exchange for some AI hardware.

Will Quantum Computing Kill Bitcoin?

No.

Is “Q-day” around the corner?

No.

Quantum computing (QC) is often cited as the ultimate threat to cryptography, but how close are we really to a "Q-Day" scenario?

Overblown by several proportions, similar to the AI bullshit just slightly less worse.
There, I answered your panicking and FUD once more. No Zionist Andersen was needed.

Laughable.

Merely because he doesn't have a religion, or a race, or a belief/philosophy that's the same as yours, you discredit all the work and research he has done with Google?

You act like you know more than him. Ser, you're a mere pleb in a signature campaign just like the rest of us.

Welcome to my ignore list.

 

[ABCbits]

My friend sent me this link.
--snip--

I visited the link, but why it ask email address, first name and last name? I probably just being skeptical, but i find it's suspicious when the link should be just about video. But i found this statement from one of his blog post.

It’s like this: if you think quantum computers able to break 2048-bit cryptography within 3-5 years are a near-certainty, then I’d say your confidence is unwarranted. If you think such quantum computers, once built, will also quickly revolutionize optimization and machine learning and finance and countless other domains beyond quantum simulation and cryptanalysis—then I’d say that more likely than not, an unscrupulous person has lied to you about our current understanding of quantum algorithms.

On the other hand, if you think Bitcoin, and SSL, and all the other protocols based on Shor-breakable cryptography, are almost certainly safe for the next 5 years … then I submit that your confidence is also unwarranted. Your confidence might then be like most physicists’ confidence in 1938 that nuclear weapons were decades away, or like my own confidence in 2015 that an AI able to pass a reasonable Turing Test was decades away. It might merely be the confidence that “this still looks like the work of decades—unless someone were to gather together all the scientific building blocks that have now been demonstrated, and scale them up like a stark raving madman.” The trouble is that sometimes people, y’know, do that.

Beyond that, the question of “how many years?” doesn’t even interest me very much, except insofar as I can mine from it the things I value in life, like scientific understanding, humor, and irony.

Unless i misunderstood his statement, it seems he's also not sure when QC is mature enough to break signature cryptography that still used today.

[Satofan44]

Merely because he doesn't have a religion, or a race, or a belief/philosophy that's the same as yours, you discredit all the work and research he has done with Google?

His work at Google does not mean shit. There are countless people who worked there on a variety of things and went on to abuse those credentials to validate shitcoins that they have created afterwards. He's an extremist Zionist retard that is spewing whatever the big nosed money giver wants to hear.

I visited the link, but why it ask email address, first name and last name? I probably just being skeptical, but i find it's suspicious when the link should be just about video. But i found this statement from one of his blog post.

Just your friendly Zionist tricks from a very reputable and non-biased researcher. Obviously they need all that information to share a video.  

Unless i misunderstood his statement, it seems he's also not sure when QC is mature enough to break signature cryptography that still used today.

Nobody knows, that is the only right answer. Everything else is FUD. People create FUD for many reasons, some are just stupid like Wind_FURY and believe that time spent somewhere equals expertise or that "experts" have crystal-balls. You can see how clearly individuals fail to reason and apply objective evaluations depending on who is in question. When it is luke-jr, his prior behavior and views play a big role -- much bigger than his past work. When it is some random Zionist idiot, then suddenly the work matters more and not his personality and you should listen to him.   Either these things matter or they don't, failing to make equal comparison yields in conclusions that are entirely invalid.

How about you ask a Zionist offspring of Jensen Huang whether real AI is just around the corner? Better sell some of your family members in exchange for some AI hardware.

This is the answer to this sub-discussion of topic. Whoever doesn't understand it shouldn't continue this discussion.

[Wind_FURY]

My friend sent me this link.
--snip--

I visited the link, but why it ask email address, first name and last name? I probably just being skeptical, but i find it's suspicious when the link should be just about video. But i found this statement from one of his blog post.

What are you saying? That's it's a scam link? Why would he do that?

It’s like this: if you think quantum computers able to break 2048-bit cryptography within 3-5 years are a near-certainty, then I’d say your confidence is unwarranted. If you think such quantum computers, once built, will also quickly revolutionize optimization and machine learning and finance and countless other domains beyond quantum simulation and cryptanalysis—then I’d say that more likely than not, an unscrupulous person has lied to you about our current understanding of quantum algorithms.

On the other hand, if you think Bitcoin, and SSL, and all the other protocols based on Shor-breakable cryptography, are almost certainly safe for the next 5 years … then I submit that your confidence is also unwarranted. Your confidence might then be like most physicists’ confidence in 1938 that nuclear weapons were decades away, or like my own confidence in 2015 that an AI able to pass a reasonable Turing Test was decades away. It might merely be the confidence that “this still looks like the work of decades—unless someone were to gather together all the scientific building blocks that have now been demonstrated, and scale them up like a stark raving madman.” The trouble is that sometimes people, y’know, do that.

Beyond that, the question of “how many years?” doesn’t even interest me very much, except insofar as I can mine from it the things I value in life, like scientific understanding, humor, and irony.

Unless i misunderstood his statement, it seems he's also not sure when QC is mature enough to break signature cryptography that still used today.

I watched the stream, and he wasn't actually making a Doom's Day projection. He was merely saying that based on the milestones from all of their research being done in Google, he's merely becoming more optimistic that because of the current technological advancements, a working Quantum Computer could be built sooner than expected.

I didn't understand some of the more technical parts of the stream, although he tried to make everything ELI-5.

[WhyFhy]

You don't believe that Quantum Computers that could break SHA-256 are coming?

Quantum computers only get a quadratic speed up on breaking hash functions (with Grover's algorithm),
so that threat is negligible compared to the breaking of ECDLP with the exponential speedup of Shor's algorithm.

Quantum models assume Grovers algo is the ceiling for hashes because computation is treated as topology agnostic. A fragile assumption tbh.

One broken lever energy bias, analog leakage, or hybrid ML quantum feedback, the search space stops being flat. At that point, the “only quadratic” safety story for SHA-256 collapses.

Everyone’s obsessed with Shors algo. That’s fine, but topology correction is the first real risk. Your defending math in a world thats about to be ruled by physics.

[Wind_FURY]

You don't believe that Quantum Computers that could break SHA-256 are coming?

Quantum computers only get a quadratic speed up on breaking hash functions (with Grover's algorithm),
so that threat is negligible compared to the breaking of ECDLP with the exponential speedup of Shor's algorithm.

Quantum models assume Grovers algo is the ceiling for hashes because computation is treated as topology agnostic. A fragile assumption tbh.

One broken lever energy bias, analog leakage, or hybrid ML quantum feedback, the search space stops being flat. At that point, the “only quadratic” safety story for SHA-256 collapses.

Everyone’s obsessed with Shors algo. That’s fine, but topology correction is the first real risk. Your defending math in a world thats about to be ruled by physics.

How close are we, actually, to be in a world like that? Would you say that it will be within a decade? Because all the "Quantum Threat" narrative - and it's still sort of a narrative as of today, could discourage potential investors from investing into Bitcoin.

We can be absolutely sure that shitcoins like ZCash will take advantage of the situation and make marketing ploys that they have the "best path to Quantum Resistance".

[WhyFhy]

You don't believe that Quantum Computers that could break SHA-256 are coming?

Quantum computers only get a quadratic speed up on breaking hash functions (with Grover's algorithm),
so that threat is negligible compared to the breaking of ECDLP with the exponential speedup of Shor's algorithm.

Quantum models assume Grovers algo is the ceiling for hashes because computation is treated as topology agnostic. A fragile assumption tbh.

One broken lever energy bias, analog leakage, or hybrid ML quantum feedback, the search space stops being flat. At that point, the “only quadratic” safety story for SHA-256 collapses.

Everyone’s obsessed with Shors algo. That’s fine, but topology correction is the first real risk. Your defending math in a world thats about to be ruled by physics.

How close are we, actually, to be in a world like that? Would you say that it will be within a decade? Because all the "Quantum Threat" narrative - and it's still sort of a narrative as of today, could discourage potential investors from investing into Bitcoin.

We can be absolutely sure that shitcoins like ZCash will take advantage of the situation and make marketing ploys that they have the "best path to Quantum Resistance".

In my opinion? I think a few years at most with AI revising current topology.

You got to understand that AI changed and propagated trajectories on these kinds of things.

I agree on the zcash thing. So much so I even dusted off my z9 minis and running them again. It might not be the solution but Ill participate in the speculation.

The deeper I go into these rabbit holes the more I believe an attestation layer is the solution.

[d5000]

One broken lever energy bias, analog leakage, or hybrid ML quantum feedback, the search space stops being flat. At that point, the “only quadratic” safety story for SHA-256 collapses.

Can you provide some links to read more on that? It sounds interesting, but as a layperson I'm struggling to find material on these topics on a simple web search.

I guess however that are highly speculative scenarios, with a likelihood of under 5% but non-zero or so, as this has never been mentioned in any article I read about quantum threats on cryptography.

And how could an "attestation layer" look like?

[Satofan44]

One broken lever energy bias, analog leakage, or hybrid ML quantum feedback, the search space stops being flat. At that point, the “only quadratic” safety story for SHA-256 collapses.

Can you provide some links to read more on that? It sounds interesting, but as a layperson I'm struggling to find material on these topics on a simple web search.

I guess however that are highly speculative scenarios, with a likelihood of under 5% but non-zero or so, as this has never been mentioned in any article I read about quantum threats on cryptography.

Because it is extremely speculative on an order just 1 level less than "what if the whole universe explodes tomorrow?". Possible, but extremely speculative at this point. There is a bit too much optimism that ML, which is simply a fancy marketing slogan for a specific type of algorithms -- quite similar as to "AI". It may flip the world upside down one day, but it also may not.

In my opinion? I think a few years at most with AI revising current topology.

There is no AI, there is absolutely no intelligence whatsoever. Exquisite algorithms are not intelligence.

[WhyFhy]

One broken lever energy bias, analog leakage, or hybrid ML quantum feedback, the search space stops being flat. At that point, the “only quadratic” safety story for SHA-256 collapses.

Can you provide some links to read more on that? It sounds interesting, but as a layperson I'm struggling to find material on these topics on a simple web search.

I guess however that are highly speculative scenarios, with a likelihood of under 5% but non-zero or so, as this has never been mentioned in any article I read about quantum threats on cryptography.

Because it is extremely speculative on an order just 1 level less than "what if the whole universe explodes tomorrow?". Possible, but extremely speculative at this point. There is a bit too much optimism that ML, which is simply a fancy marketing slogan for a specific type of algorithms -- quite similar as to "AI". It may flip the world upside down one day, but it also may not.

In my opinion? I think a few years at most with AI revising current topology.

There is no AI, there is absolutely no intelligence whatsoever. Exquisite algorithms are not intelligence.

Look at it through a Game Theory lens.

The literature lags the frontier by a decade. What I’m talking about isn't "proven theory", it's noticing the shape of the trajectory.
These are not conclusions, they’re directions.

You don’t need AI hype or quantum mythology to see the pattern.

The Incentives are Clear
Quantum + topology correction is a true zero-sum game. Winner takes all, literally.

Quantum gets built for profit. The first breakthroughs won't be published.

Whoever wins prioritizes topology, because that’s where the leverage is.

We already see ML correcting blind spots in areas we thought were provably optimal: compilers, chip layouts, simulation shortcuts, optimization landscapes.
So it’s reasonable to assume similar pressure will apply to quantum topology next.

This is why the search space stops being flat and the "only quadratic" safety story for SHA-256 collapses.

I'm not saying SHA-256 is doomed tomorrow.
I’m saying the assumption chain behind quadratic speedups is weaker than people think.
It’s a ~5% likelihood today only because the field hasn’t looked there yet.

Whether you call it AI, ML, heuristics, or algorithms, it dont matter. The point is, machines now find optimizations humans miss. That changes timelines.

A hash-only security model assumes the hash function stays flat. An attestation layer commits state.

Dismissing this as FUD assumes attackers are constrained by your mental model of what’s possible.

[Satofan44]

Dismissing this as FUD assumes attackers are constrained by your mental model of what’s possible.

Yes, and the universe could be destroyed tomorrow by things that we don't even know exist because our mental model and knowledge restrict us from imagining them. Should we run around warning people of this inevitable doom? I'll see it once it happens.

You are making a massive assumption there that quantum computers and ML will break SHA-256 and other stuff, and this overlooks the resilience of cryptography. Just because we have fancy algorithms that can find optimizations that doesn't mean everything that we use today is on the verge of collapse, or that it could collapse at all. You're just hyping up quantum threats with smarter looking content, that does not mean that you're doing anything more than hyping up. The timeline and probability of breakthroughs are completely unpredictable and unknown. Anyone who claims otherwise is a scammer of some kind, like the zionist retard that was linked here recently.

Quantum gets built for profit. The first breakthroughs won't be published.

This is completely speculative and has been largely not true for most part of history. This time it is different, right?  

[ABCbits]

Whether you call it AI, ML, heuristics, or algorithms, it dont matter. The point is, machines now find optimizations humans miss. That changes timelines.

And whether it's called optimization, pattern, shortcut or other term, i have doubt it would work well on properly created/designed cryptography due to the avalanche effect[1].

[1] https://crypto.stackexchange.com/a/114737

[WhyFhy]

Whether you call it AI, ML, heuristics, or algorithms, it dont matter. The point is, machines now find optimizations humans miss. That changes timelines.

And whether it's called optimization, pattern, shortcut or other term, i have doubt it would work well on properly created/designed cryptography due to the avalanche effect[1].

[1] https://crypto.stackexchange.com/a/114737

Ahh didn't know what this was called!
There still some (useless) predictability in range clusters.
https://bitcointalk.org/index.php?topic=5112311.msg66083902
Anyways I agree that it won't be clean in crypto at least not yet.
This will touch your daily lives before it ever reaches Bitcoin.
 

Here Google giving a crack at RSA 2048
https://thequantuminsider.com/2025/05/24/google-researcher-lowers-quantum-bar-to-crack-rsa-encryption/

"The analysis relies on algorithmic improvements and efficient system designs, including approximate arithmetic and compressed error-correction layouts, to lower the number of qubits needed."

Good to see they aren't currently enclosing this research. But once they hit something meaningful how long untill they disclose it?