Bitcoin Forum
May 31, 2026, 01:50:58 PM *
News: Latest Bitcoin Core release: 31.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: « 1 2 3 4 5 6 7 8 9 10 11 [12]  All
  Print  
Author Topic: J. Lopp's Post-Quantum Migration BIP  (Read 4239 times)
Satofan44
Sr. Member
****
Offline

Activity: 406
Merit: 1081


Don't hold me responsible for your shortcomings.


View Profile
April 23, 2026, 12:30:59 PM
Last edit: April 23, 2026, 02:25:38 PM by Satofan44
Merited by stwenhao (1)
 #221

I'll note that we have collapsed phases B and C together because it's clear that this already controversial proposal does itself no favors without a recovery option.
The chance it has of passing even with recovery built in/guaranteed is very low, but without it it is destined to fail.

The primary reason I wrote is as optional (nearly a year ago) was due to the lack of R&D on the matter.
You plan to update the BIP then?

Just in the past few months we've seen significant advancements in this particular area. In fact, it looks like it should be possible to support quantum safe recovery not only for HD wallets, but also for P2PK addresses
Care to post some that you find viable as potential candidates? Information is scattered, even on this forum there are countless of duplicate quantum threads and this issue is definitely not the main focus for many therefore it would be appreciated if you could share some here directly.

that haven't had their public key exposed.
And for these, there is no hope?

Beyond that, I just want to say that I find this subject to be particularly fascinating because it involves half a dozen thorny issues that are all gnarled together. Never before have we been faced with such a complicated theoretical dilemma where all of the options are terrible!
True, but some negative outcomes can still be extremely better than other negative outcomes. With Bitcoin, other than in security questions of existential importance, the best answer when in doubt was to do nothing -- change nothing, or change the least amount of possible. As we can see, shitcoins have been doing all sorts of shit all the time and practically 99.9% of the things that they have done are worse than what Bitcoin has (putting aside centralization vs. decentralization topics).



Quote
what will be the practical implication for users?
It will cause a lot of FUD, but mainly only multiparty addresses will be affected in practice. However, if collisions will be there, then you will no longer know, if any new 160-bit address cannot be spent in a different way, which was not yet revealed on-chain.
I am still waiting, or demanding, a BIP from you.  Tongue Do your duty.

stwenhao
Hero Member
*****
Offline

Activity: 699
Merit: 1878


View Profile
April 23, 2026, 01:53:20 PM
Merited by vapourminer (4), ABCbits (1), Satofan44 (1)
 #222

Quote
but also for P2PK addresses that haven't had their public key exposed
You should probably bold the second part instead. Not exposing the public key is crucial in this sentence. It simply means, that if you have some presigned timelocked transactions, sending coins from P2PK to P2PK, then obviously the destination P2PK is not yet exposed, if it was never broadcasted anywhere. Which means, that a proof can be constructed, that you know it, and later it can be revealed. Then, even if everyone will know the private key, the previous commitment will enforce the proper destination.

Quote
I am still waiting, or demanding, a BIP from you.
Existing BIPs are not set in stone, they can be updated. I already put my comments in some discussions there. It is more likely, that I will discuss, what is already there, instead of creating yet another BIP. Also because existing ones are not that detailed, so they need to be expanded anyway.

Quote
the best answer when in doubt was to do nothing
Which is also why we don't need more BIPs, dealing with the same topic. It would only create confusion, and it could end up in the same way, as block size BIPs, where you have many of them, and none is implemented on BTC. Only altcoins like BCH used them to some extent in practice, and for the actually deployed Segwit, block size increase was fully optional, and if it would be deployed without Segwit discount, then we would still have 1 MB blocks.

Proof of Work puzzle in mainnet, testnet4 and signet.
statoshi
Newbie
*
Offline

Activity: 29
Merit: 79


View Profile WWW
April 23, 2026, 02:41:55 PM
Merited by vapourminer (4), ABCbits (3), Pmalek (3), Satofan44 (1)
 #223

You plan to update the BIP then?

Of course; it's currently just an informational draft. It needs plenty of R&D in order to reach an implementable specification.

Care to post some that you find viable as potential candidates? Information is scattered, even on this forum there are countless of duplicate quantum threads and this issue is definitely not the main focus for many therefore it would be appreciated if you could share some here directly.

https://delvingbitcoin.org/t/pq-provers-for-p2pkh-outputs/2287
https://groups.google.com/g/bitcoindev/c/uUK6py0Yjq0/m/57bQJ3VSCQAJ
https://groups.google.com/g/bitcoindev/c/Q06piCEJhkI/m/6BN8qE3gAQAJ
https://x.com/roasbeef/status/2041940571720487192
https://github.com/Roasbeef/bip32-pq-zkp/blob/main/docs/reduced-variants.md

And for these, there is no hope?

At the moment no such recovery scheme has been thought up; that doesn't mean it's impossible. But I'm fairly skeptical since there is no private data available that's safe from a quantum attacker that the user could use to prove their ownership safely.

The only mitigation proposal I've seen that can target those funds is Hourglass V2 which is just a velocity throttling scheme.

the best answer when in doubt was to do nothing -- change nothing, or change the least amount of possible.

There are doubtless many who feel that way and they are free to do nothing.
Satofan44
Sr. Member
****
Offline

Activity: 406
Merit: 1081


Don't hold me responsible for your shortcomings.


View Profile
April 23, 2026, 02:56:51 PM
 #224

Thanks for the list.

And for these, there is no hope?
At the moment no such recovery scheme has been thought up; that doesn't mean it's impossible. But I'm fairly skeptical since there is no private data available that's safe from a quantum attacker that the user could use to prove their ownership safely.
This is the problem though, as this is going to be the most controversial part of any proposal that involves these methods. If there are good recovery mechanisms for P2PKH outputs then freezing them after some period of time can be more justified and will less likely lead to opposition. However, not having a recovery mechanism for all coins that have their keys exposed and most notably historical coins such as satoshi's alleged stash will cause significant opposition and controversy. Most of the rationale based around that is market-centered, related to the potential of somebody "dumping" these coins and this is not a very convincing line of argument for anyone who is maximalist-oriented (or a maxi). The world will not end in this scenario, there will be turbulence and negative price performance for some time, but we tend to not care too much about that.

The only mitigation proposal I've seen that can target those funds is Hourglass V2 which is just a velocity throttling scheme.
I do not see any reason not to implement something like this though in any case. Some could argue if they want to be persistent and annoying about some potential edge-scenarios where this might negatively effect 1 user out of a million but that is not worth considering.

the best answer when in doubt was to do nothing -- change nothing, or change the least amount of possible.
There are doubtless many who feel that way and they are free to do nothing.
You need to convince them too if you want to have any chance at all of reaching consensus on something like this. If you can't convince them, this is not going anywhere. The best alternative is to fork Bitcoin with such a proposal, but that historically has not worked out well for those that did do it.  Smiley

statoshi
Newbie
*
Offline

Activity: 29
Merit: 79


View Profile WWW
April 23, 2026, 04:18:18 PM
 #225

Most of the rationale based around that is market-centered, related to the potential of somebody "dumping" these coins and this is not a very convincing line of argument for anyone who is maximalist-oriented.

You're stating an assumption that many people seem to be holding. It's a naive assumption. Note that the BIP says nothing about market dumps / sales / etc. If a market dump by a quantum attacker was the only worry then you'd be correct, it would just create some temporary pain and we'd move on. I'll be addressing attack scenarios in my upcoming series of essays.

You need to convince them too if you want to have any chance at all of reaching consensus on something like this. If you can't convince them, this is not going anywhere. The best alternative is to fork Bitcoin with such a proposal, but that historically has not worked out well for those that did do it.  Smiley

Given that this is a soft fork, rough consensus will generally come down to hashrate and major economic players.

As of today, the threat is distant and thus no one is interested in activating such a proposal.

My thesis is that individual economic incentives will trump philosophy in the face of existential threat.
Satofan44
Sr. Member
****
Offline

Activity: 406
Merit: 1081


Don't hold me responsible for your shortcomings.


View Profile
April 23, 2026, 04:49:22 PM
 #226

Most of the rationale based around that is market-centered, related to the potential of somebody "dumping" these coins and this is not a very convincing line of argument for anyone who is maximalist-oriented.
You're stating an assumption that many people seem to be holding. It's a naive assumption. Note that the BIP says nothing about market dumps / sales / etc. If a market dump by a quantum attacker was the only worry then you'd be correct, it would just create some temporary pain and we'd move on. I'll be addressing attack scenarios in my upcoming series of essays.
My focus on that statement is solely on historical coins like satoshi's. Scenario (for the question/statement): Assume that users and entities have upgraded (better) or been pushed to upgraded (worse), then there is no rationale for freezing those coins other than market related talk. What other harm could those coins possibly cause to the network or protocol? They literally can't do anything. For all we know it could be satoshi reintroducing his coin, which are assumed to be lost/dead, back into the circulating supply. This has no effect on the network from a technical standpoint.

In regards to the other coins and the situation where users and service providers are getting randomly and suddenly hacked and the ensuing chaos -- there I do agree there are existential level worries. Although even there, as I have noted previously elsewhere, users would be able to submit transactions privately to miners until things resolve. We would take a massive hit (and this kind of chaos is best avoided if possible), sure, but it is not like suddenly you will not be able to transact at all unless you want your coins to be stolen.

Quote
"Lost coins only make everyone else's coins worth slightly more. Think of it as a donation to everyone." - Satoshi Nakamoto

If true, the corollary is:

"Quantum recovered coins only make everyone else's coins worth less. Think of it as a theft from everyone."
You literally quote this in the BIP, and this is a market implication. While you may not be using the exact wording, this is the implication but anyway as I said my statement was focused on those coins.

You need to convince them too if you want to have any chance at all of reaching consensus on something like this. If you can't convince them, this is not going anywhere. The best alternative is to fork Bitcoin with such a proposal, but that historically has not worked out well for those that did do it.  Smiley
Given that this is a soft fork, rough consensus will generally come down to hashrate and major economic players.
Which seems like a good thing to you? And for me it is quite a terrible thing. If we can demonstrate that freezing can be done with only hashrate and the major economic players (the fewer the easier), then we will have made a case for government-forced freezing. Forcing users into compliance-consensus to do something like this with a hard fork is near impossible practically speaking, but successfully doing it with a soft fork will create a precedent that we will never be able to fully get away from. We can only hope that collectively we will be able to defend against a future freezing mandate, but shifting from decentralization guarantees of censorship-resistance into hope is not exactly an improvement. Is it?

I'd prefer some dumps in the million range over turning into something like Bittether any day.

As of today, the threat is distant and thus no one is interested in activating such a proposal.

My thesis is that individual economic incentives will trump philosophy in the face of existential threat.
In terms of entities or users upgrading fast to new address formats? Sure, I hope so to. In terms of freezing balances? I hope not.

statoshi
Newbie
*
Offline

Activity: 29
Merit: 79


View Profile WWW
April 23, 2026, 05:50:46 PM
Merited by Satofan44 (1)
 #227

What other harm could those coins possibly cause to the network or protocol? They literally can't do anything.

I wish that was true. This will be the subject of my next essay.

it is not like suddenly you will not be able to transact at all unless you want your coins to be stolen.

I wouldn't be so sure about that. Also covered in my next essay.

You literally quote this in the BIP, and this is a market implication.

It's a cute saying that massively simplifies an incredibly complex situation. In other words, it's marketing. If I made the BIP comprehensive regarding every potential undesirable outcome then it would be dozens of pages long.

Which seems like a good thing to you? And for me it is quite a terrible thing. If we can demonstrate that freezing can be done with only hashrate and the major economic players (the fewer the easier), then we will have made a case for government-forced freezing.

It's the game theory of this particular governance path. The "bad" thing that folks should be worried about, if they fear government forced freezing, is hashrate being concentrated in one jurisdiction.

For many years, that was China. Now, to a slightly lesser extent, it's the United States. I expect hashrate will continue to decentralize over the long term because the very nature of energy distribution is decentralized.
Pages: « 1 2 3 4 5 6 7 8 9 10 11 [12]  All
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!