Bitcoin Forum
August 08, 2025, 08:24:29 PM *
News: Latest Bitcoin Core release: 29.0 [Torrent]
 
   Home   Help Search Login Register More  
Poll
Question: Should wallet software providers warn you if you transact publishing the public key of an address containing other funds?
Yes - 9 (69.2%)
No - 2 (15.4%)
Should be an optional setting - 2 (15.4%)
Don't know / Neutral - 0 (0%)
Total Voters: 13

Pages: « 1 [2]  All
  Print  
Author Topic: Should wallets warn if you re-use addresses due to quantum computers?  (Read 331 times)
roemer
Newbie
*
Offline Offline

Activity: 42
Merit: 0


View Profile WWW
July 21, 2025, 05:22:44 PM
 #21

The currency would crash and everyone move to a different currency if the wallets were cracked. It would then becomine a premine which destroys the reputation of the network and no one would use it.

I cant imagine that would happen due to the amount large scale investors in charge of quantum computing and the currency itself.
Forsyth Jones
Legendary
*
Offline Offline

Activity: 1624
Merit: 1551


I love Bitcoin!


View Profile WWW
July 21, 2025, 05:26:24 PM
 #22

Freedom to use Bitcoin in a more insecure way? That's not better for the user in any way.
Are you saying that simply not having a warning about address reuse makes using Bitcoin unsafe?

This is not really true, you can still receive transactions to old addresses and even if the Receive tab of the wallet does not show it you can locate it in your transaction history.
I thought it wasn't necessary to write this, as it's so obvious. Of course, previous addresses, even if they no longer appear in the user interface, remain valid.

Therefore, it is incorrect to state that a user is forced to use new addresses. It is rather the wallet design pushing the user to modify their behavior and avoid address reuse. This does help and all wallets should do this in addition to the warning, but it is incorrect to phrase it this way. In addition to wallet design an educational campaign is needed on why address re-use is to be avoided.
It's the same thing, even if the wallet's design "pressures" the user not to reuse addresses, it's the same as being forced to use a new address.

This does help and all wallets should do this in addition to the warning
The problem is, not everyone thinks the same way you do.

Satofan44
Member
**
Offline Offline

Activity: 112
Merit: 253


View Profile
July 21, 2025, 06:34:27 PM
 #23

Freedom to use Bitcoin in a more insecure way? That's not better for the user in any way.
Are you saying that simply not having a warning about address reuse makes using Bitcoin unsafe?
I'll help you, enter this into ChatGPT: Please explain what "more insecure way" means for a non native speaker. What I wrote does not match the content of your question.

This is not really true, you can still receive transactions to old addresses and even if the Receive tab of the wallet does not show it you can locate it in your transaction history.
I thought it wasn't necessary to write this, as it's so obvious. Of course, previous addresses, even if they no longer appear in the user interface, remain valid.

Therefore, it is incorrect to state that a user is forced to use new addresses. It is rather the wallet design pushing the user to modify their behavior and avoid address reuse. This does help and all wallets should do this in addition to the warning, but it is incorrect to phrase it this way. In addition to wallet design an educational campaign is needed on why address re-use is to be avoided.
It's the same thing, even if the wallet's design "pressures" the user not to reuse addresses, it's the same as being forced to use a new address.

This does help and all wallets should do this in addition to the warning
The problem is, not everyone thinks the same way you do.
No, pressuring or pushing and forcing are not the same things. The difference is literally part of the definition of the words. If you are forced to do something one way, then you can't do it another way. If you are pressured or pushed to modify your behavior, you can still do things differently. Very different and important distinction especially when you talk about security.

The currency would crash and everyone move to a different currency if the wallets were cracked. It would then becomine a premine which destroys the reputation of the network and no one would use it.

I cant imagine that would happen due to the amount large scale investors in charge of quantum computing and the currency itself.
Weak and useless FUD. Nobody is going to start using your shitcoin with or without quantum computers cracking wallets, get over it.
d5000 (OP)
Legendary
*
Offline Offline

Activity: 4368
Merit: 9186


Decentralization Maximalist


View Profile
July 21, 2025, 07:26:49 PM
 #24

[...] the security of Bitcoin as a whole doesn't rely on how many addresses are vulnerable. It is based on whether any of them are. In other words if one address were vulnerable then the whole system would have been considered vulnerable.[...]This is why I've always said the move to a new algorithm should be done through a hard fork with a deadline and any coins that don't move before that deadline should be considered unspendable.
Thanks for your explanation. I can understand the logic now even if I don't really agree. For example, we have already some vulnerable addresses now such as these created with low entropy. That's a small percentage (hopefully) but they exist, but I wouldn't consider them a security threat.

My stance against Jameson Lopp's approach is based on simply trying to evaluate the "catastrophe potential" of the following threats:

- market disruptions and feelings of unsafety due to massive sales of quantum hacked vulnerable coins
- disruptions and inefficiencies due to the (much) higher data consumption of post-quantum signatures like FALCON-512
- the possibility that one of the "post quantum" schemes discussed today isn't as secure as thought (which was one of the main points in the early BIP360 discussion)

And I think Lopp underestimates the problems of the second and third threat. That's why I'm favouring an optional approach. A stricter "no reuse" policy in wallets including warnings would fit with this approach.

I think it would be worthwhile to do a deeper analysis of this situation,
I had (last year or so) seen a better analysis, but unfortunately I lost the link and haven't found it. I agree that a more detailed view would be desirable to really assess the magnitude of the problem.

Do you have an idea what an exchange could do instead of their current setups? I don't think not reusing cold storage wallets is feasible for them right now.
I'm no expert at that matter. From my knowledge it should be possible to create a setup where a cold wallet only receives coins (this doesn't add the vulnerability of course) and regularly, when coins are needed for the hot wallet, is "renewed" (i.e. all coins sent to another address, dividing the coins between "hot wallet" and "continue in cold wallet". But of course this could create higher fee costs than a single, re-used cold wallet where utxos could be directed individually to the hot wallet.

Multisig wallet looks like a good idea to improve security.

@Forsynth Jones: Thanks for the mention of Sparrow. It's a wallet I always wanted to test but never did (because at the end it didn't deliver the features I would consider important in comparison to Electrum). I may take the opportunity to do that finally Wink and check out their warning policy.

Ambatman
Hero Member
*****
Online Online

Activity: 728
Merit: 859


Don't tell anyone


View Profile WWW
July 22, 2025, 02:47:16 PM
 #25


You are very wrong. Address reuse is advised for privacy so far quantum computers are not yet a threat. It is quantum computers that will later let it be of security concern.
Not quite perse.
Here you can see where there was a flaw in random number generator for ECDSA and some addresses were affected
https://bitcointalk.org/index.php?topic=581411.0

If the address wasn't reused or remained unspent, then the movement of their funds wouldn't had been possible.

Unspent address protected by SHA256 and RIPEMD160(which hide their public key) and ECDSA (which secures the private key)

Reused address( the one after spending) have their public key exposed so their security relies solely on ECDSA which is susceptible to future quantum attack and vulnerability in ecdsa generation. 

I believe we talking about P2pkH.

Satofan44
Member
**
Offline Offline

Activity: 112
Merit: 253


View Profile
July 22, 2025, 03:04:03 PM
 #26

[...] the security of Bitcoin as a whole doesn't rely on how many addresses are vulnerable. It is based on whether any of them are. In other words if one address were vulnerable then the whole system would have been considered vulnerable.[...]This is why I've always said the move to a new algorithm should be done through a hard fork with a deadline and any coins that don't move before that deadline should be considered unspendable.
Thanks for your explanation. I can understand the logic now even if I don't really agree. For example, we have already some vulnerable addresses now such as these created with low entropy. That's a small percentage (hopefully) but they exist, but I wouldn't consider them a security threat.
I agree that the logic is clear, but the conclusion is completely false. There have always been and there will always be vulnerable addresses. There is nothing that can be done about this. This is not how Bitcoin's security model works. What matters primarily is whether the system or protocol as a whole is broken or not.

My stance against Jameson Lopp's approach is based on simply trying to evaluate the "catastrophe potential" of the following threats:

- market disruptions and feelings of unsafety due to massive sales of quantum hacked vulnerable coins
- disruptions and inefficiencies due to the (much) higher data consumption of post-quantum signatures like FALCON-512
- the possibility that one of the "post quantum" schemes discussed today isn't as secure as thought (which was one of the main points in the early BIP360 discussion)

And I think Lopp underestimates the problems of the second and third threat. That's why I'm favouring an optional approach. A stricter "no reuse" policy in wallets including warnings would fit with this approach.
Optional new address type and stricter "no reuse" policy combined with social educational campaigns would be a good combination, and much less controversial. Don't let perfect be the enemy of good. Still, the question remains open as to what kind of signature type should we use for the new address type.

I think it would be worthwhile to do a deeper analysis of this situation,
I had (last year or so) seen a better analysis, but unfortunately I lost the link and haven't found it. I agree that a more detailed view would be desirable to really assess the magnitude of the problem.
If you do find it, please share it here.

Do you have an idea what an exchange could do instead of their current setups? I don't think not reusing cold storage wallets is feasible for them right now.
I'm no expert at that matter. From my knowledge it should be possible to create a setup where a cold wallet only receives coins (this doesn't add the vulnerability of course) and regularly, when coins are needed for the hot wallet, is "renewed" (i.e. all coins sent to another address, dividing the coins between "hot wallet" and "continue in cold wallet". But of course this could create higher fee costs than a single, re-used cold wallet where utxos could be directed individually to the hot wallet.

Multisig wallet looks like a good idea to improve security.
Imagine this. All your wealth is in a single bank vault, the best bank vault that you could make. Every time you need some extra money in your wallet, you move all your wealth to another bank and take some money for yourself. Doing this each time creates a huge surface for human error and security compromise. This is why I don't believe there is a good and practical solution for exchanges and institutions.

@Forsynth Jones: Thanks for the mention of Sparrow. It's a wallet I always wanted to test but never did (because at the end it didn't deliver the features I would consider important in comparison to Electrum). I may take the opportunity to do that finally Wink and check out their warning policy.
Off topic, but what is it that it is missing for you compared to Electrum?



Not quite perse.
Here you can see where there was a flaw in random number generator for ECDSA and some addresses were affected
https://bitcointalk.org/index.php?topic=581411.0
It is just users who weren't there rehashing text that they have read elsewhere. Just because someone isn't aren't aware of something that doesn't mean that it didn't happen. Address reuse is both a privacy and security mistake, always has been.  Smiley
stwenhao
Sr. Member
****
Offline Offline

Activity: 373
Merit: 763


View Profile
July 24, 2025, 11:37:49 AM
 #27

Quote
Should wallets warn if you re-use addresses due to quantum computers?
Yes, of course. And they should also warn about many other things, for example that a partially signed transaction, which is signed with something else than SIGHASH_ALL, can be modified by third parties.

Quote
Your public key will be revealed when you broadcast a transaction spending from that address, which means the quantum attacker can RBF and steal your funds even though you only used your address once.
Even if secp256k1 will be fully broken, it will be still possible to use OP_CHECKSIG in a safe way, as long as SHA-256 will still be safe, and Proof of Work will be enforced properly. Some example: https://bitcointalk.org/index.php?topic=5551080.0

If someone will break secp256k1, without breaking SHA-256, then that person could clear puzzles from 60 to 40, but going further will still require gradually breaking SHA-256.

Quote
Aren't we using public key in P2TR outputs as well?
Yes, we are. But P2TR can be spend by key, or by TapScript. Spending by key can be blocked in the future, if needed, and then, quantum-safe paths will be executed inside TapScript. As long as SHA-256 is strong, this approach would work. It is not yet decided, if quantum-safe addresses will be deployed inside TapScript, or if a new address type will be made.

Quote
the move to a new algorithm should be done through a hard fork with a deadline and any coins that don't move before that deadline should be considered unspendable
Making coins unspendable can be done as a soft-fork. Even invalidating all existing UTXOs is still a soft-fork, see here: https://petertodd.org/2016/forced-soft-forks#radical-changes

Quote
This still makes me think that why was Taproot even created when we did not see its benefit than input consolidation.
Because it allows N-of-N multisig, which looks in exactly the same way, as a single user, spending things with a single signature.

Quote
Do you have an idea what an exchange could do instead of their current setups?
They could use HD wallets, and use a tree of public keys, to derive next addresses. Then, key derivation path could contain user ID, transaction ID, and other unique data. In this way, when each deposit will be done on a different address, they won't be broken all at once, as long as public keys, which are used to derive them, will remain hidden.

Quote
Multisignature helps but is that all that we have on the table right now?
No, Proof of Work can be used, too. But I guess not everyone wants to be a miner, and using optional Proof of Work to limit double-spending ability of some third parties also comes with a cost of grinding transaction hashes, which is huge, if there are many inputs and outputs.

Quote
Are you saying that simply not having a warning about address reuse makes using Bitcoin unsafe?
Well, if your coins are not KYCed, but you make a transaction on a chain, where everyone else went through KYC, then everyone knows, where you are. Which means, that by reusing your own address, you make everyone else's coins less private, because if you have a new key, then it introduces deniability, and then, people are no longer sure, which coins are owned by whom. By reusing addresses, coins owned by the same party can be linked together.

Quote
This is why I don't believe there is a good and practical solution for exchanges and institutions.
It is all about not having all eggs in the same basket. Which simply means not having a single re-used address, but some HD wallet, where compromising a single key would compromise a single deposit, from a single user, and not everything, sent by everybody.

Of course, funds can be accumulated into bigger denominations, if needed. But in practice, quite often, they don't have to be. You don't need a huge transaction, collecting hundreds of satoshis into whole coins, and then another wave of transactions, splitting them back. If someone deposited 100k sats, and someone else requested a withdrawal of 99k sats, then that coin can be moved directly, with 1k sats in fees. Which means, that coins can be accumulated when needed, and a given coin doesn't have to be merged from 100k sats into 100 BTCs, and then splitted back into 99k sats.

Proof of Work puzzle in mainnet and testnet4.
d5000 (OP)
Legendary
*
Offline Offline

Activity: 4368
Merit: 9186


Decentralization Maximalist


View Profile
July 24, 2025, 05:43:31 PM
Merited by stwenhao (1), Satofan44 (1)
 #28

Yes, we are. But P2TR can be spend by key, or by TapScript. Spending by key can be blocked in the future, if needed, and then, quantum-safe paths will be executed inside TapScript.
Sorry for the "intrusion", I have just asked about this in another thread, and this would answer my question Wink -- do you know links with info about that possible "blocking" of P2TR key-paths?

What I have seen is this passage in Bitcoin Optech, is this what you're referring to?

Voided keypaths: some users may want to prevent usage of keypath spending in order to force scriptpath spending. That can be done now by using an unspendable key as the first parameter to tr(), but it’d be nice to allow wallets to store this preference in the descriptor itself and have it compute a privacy-preserving unspendable keypath.


Quote
Multisignature helps but is that all that we have on the table right now?
No, Proof of Work can be used, too. But I guess not everyone wants to be a miner, and using optional Proof of Work to limit double-spending ability of some third parties also comes with a cost of grinding transaction hashes, which is huge, if there are many inputs and outputs.
Here too ... could you elaborate a bit more or drop me a link to the concept as I don't know to what kind of PoW you're referring here? Thanks Smiley

If you do find it, please share it here.
Ok Smiley

Imagine this. All your wealth is in a single bank vault, the best bank vault that you could make. Every time you need some extra money in your wallet, you move all your wealth to another bank and take some money for yourself. Doing this each time creates a huge surface for human error and security compromise.
I believe it could be done in a way these movements can be minimized (e.g. once per week or so, using good prediction algorithms about the hot wallet's needs for coins) and in that case the security threat wouldn't be that high. In addition, they could simply use different addresses from a HD wallet with the same seed, to minimize the costs of the storage of the access data. Of course the opinion of an exchange/service operator would be cool here as I'm talking from a layman perspective.

Off topic, but what is it that it is missing for you compared to Electrum?
The main feature I'm missing at Electrum (and Sparrow doesn't provide either) is support of an alternative and less privacy-intrusive balance querying mechanism like BIP-157 (Neutrino) without the need of an own full node, or alternatively the possibilty to group addresses into sub-wallets as written in this thread. I've unfortunately realized it isn't as easy as I've depicted it in that thread (it's still relatively easy but not a thing of a few lines in the code like I initially supposed).

stwenhao
Sr. Member
****
Offline Offline

Activity: 373
Merit: 763


View Profile
July 24, 2025, 06:02:32 PM
Merited by d5000 (5)
 #29

Quote
do you know links with info about that possible "blocking" of P2TR key-paths?
For example, it is mentioned here: https://groups.google.com/g/bitcoindev/c/ydE5u5C0xVc

In general, if P2PK will be blocked on consensus level, or if it will be turned into non-standard, then exactly the same things can be done to Taproot outputs, which are spent by public key. Today, you can attach 64-byte Schnorr signature, and if it matches a given Taproot address, then it is considered valid. In the future, it can be rejected, and then, only spending by TapScript will be possible.

Quote
I don't know to what kind of PoW you're referring here?
It is in my signature, and I also made a separate topic about only that: https://bitcointalk.org/index.php?topic=5551080.0

To sum it up quickly: I think there is no need to fully invalidate OP_CHECKSIG as an opcode, because it can be used beyond just "<pubkey> OP_CHECKSIG", and can still be used for other purposes, for example to require a given amount of Proof of Work, to spend a given UTXO.

Proof of Work puzzle in mainnet and testnet4.
Pages: « 1 [2]  All
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!