The quantum / AI problem has almost been solved.

[d5000]

Having seen the proposals floating around to mitigate the danger of quantum thefts, I have come to the conclusion that, in late 2026, almost every problem has been solved already.

Here's a little overview:

Until a quantum hack takes 10 minutes or less, the standard practice of not-reusing addresses is enough to protect your funds.

If the quantum attack takes 10 minutes or less (which is very far away probably, I think 2030 is far too "optimistic" from QC-developer's view), then a commit-reveal scheme like proposed by Tadge Dryja and others can simply be required to move funds from ECDSA keys safely. There is no urgent need to migrate to post-quantum addresses prematurely.

Quantum-resistant addresses / keys: Proposals like SHRINCS and SHRIMPS provide relatively small signature sizes, so while there will be less capacity than now, the sizes would be manageable, perhaps with a moderate block size increase. Taking into account that half of the blocks are currently occupied by Runes and similar stuff, the SHRINCS signature size (~5 times the ECDSA signature) looks much less scary.

Taproot vulnerability: BIP-360 solves the problem of the vulnerable key-spend path in P2TR transactions.

P2PK / P2MS / P2TR with published public keys: This is the hardest problem to solve if you don't want to confiscate coins (which should stay taboo). But there are three basic ideas which combined, would make attacks on coins very costly:

- Hourglass: Only allowing a limited number of vulnerable coins per block to be transferred.  
- Landmines: Require a timelock and additionally a collateral. If an ownership proof from before Q-day is provided during the timelock, the collateral can also be collected by the rightful owner. (Thread)
- Long timelock: Require a long timelock to transfer the vulnerable coins, e.g. 1 year, or even as long as the coins have not been moved (this would specially protect Satoshi's coins and other old coins, it would be de facto unfeasible to steal them if you have to freeze them for 10+ years). An exception should be made for coins where an ownership proof is provided.

These proposals can be combined and would attach a risk to an attack on P2PK and similar vulnerable coins.

So: why is there still FUD about quantum computers? I think we can now think about implementation - and then relax, we'll be better prepared than most banks

The proposal would also cover the case that an AI discovers some hidden method to compute the private key from the public key.

Or am I missing something?

[Alvin_talk]

Nice summary!

Atleast any time I see those unnecessary FUD post about quantum and ai, I now have a thread I can refer them to. From the look of things, we already have all we need to combat quantum threats, all that is just needed is for the community to fully concentrate on implementing these proposals instead spreading FUD.

But it's quite unfortunate that even after reading these things, some users are still as scared as hell when they hear the word "QUANTUM". I'll assume such users don't have the balls to confront the realities before them, instead they allow themselves to be enveloped with adrenaline of fear of quantum, such a shame.

[Luzin]

Or am I missing something?

Nothing.
Your analysis is very good, but I think it might not be that simple. It's not just a matter of theft, but there are many other weaknesses that might be discovered. Quantum is not a reason to panic but a reason for how BIP is very necessary by bringing opinions together. It's a pity that currently there is no agreement or best solution. Perhaps the best thing is to immediately conduct further research so that a BIP is created that is approved as a consensus. This way Bitcoin will be safe not only from theft. Because I feel certain that quantum technology will definitely come and we do not know it for sure. Taking the best steps as quickly as possible is the best choice. IMO

[d5000]

Atleast any time I see those unnecessary FUD post about quantum and ai, I now have a thread I can refer them to.

That's exactly why I wrote it, as a reference. I also posted it deliberately in "Bitcoin Discussion" and not in the technical forums because it should reach those who think they aren't technically literate. I see now that it's maybe a bit too technical, so it's likely I will edit the OP a bit and make it more newbie friendly.

It's not just a matter of theft, but there are many other weaknesses that might be discovered.

Yes, but that's the case with all software.

Quantum is not a reason to panic but a reason for how BIP is very necessary by bringing opinions together. It's a pity that currently there is no agreement or best solution. [...] Taking the best steps as quickly as possible is the best choice. IMO

I agree that the developers should be heading for a comprehensive set of BIPs - also to scrap BIP-361 definitively, imo (that's the BIP that wants to freeze the P2PK coins).

Some of the solutions are quite new however. For example, the landmines were proposed earlier this month only. Until this gets into a BIP, can take some months more. And the "long timelock" idea is also only a few months old and had no comment at all, I'm a bit surprised because it's such a simple solution.

I think there should be no excessive rush. If we have a good series of BIPs in late 2027 then I'm already okay with it. Above all the selection of the quantum-resistant algorithm should need thorough testing. Especially due to the capability of AI to find vulnerabilities and mathematical shortcuts. We must use these techniques defensively before this is implemented.

The problem is that if we select the wrong algorithm, a lot of coins may become vulnerable again. Lattice-based algorithms for example, which were favoured during some time for quantum resistance, are now again in doubt because an AI has found a mathematical shortcut for some of them.

[Chilwell]

Atleast any time I see those unnecessary FUD post about quantum and ai, I now have a thread I can refer them to.

That's exactly why I wrote it, as a reference. I also posted it deliberately in "Bitcoin Discussion" and not in the technical forums because it should reach those who think they aren't technically literate. I see now that it's maybe a bit too technical, so it's likely I will edit the OP a bit and make it more newbie friendly.

Honestly speaking if you have done that it will get to everybody, because I also thought of it when I was reading it the message is cleared but the newbies will find it very difficult to understand. Actually I myself also find it very difficult to get along, a post that will normally take me 7 to 10 minutes to go through has taken me almost 20 minutes plus, because I don't know much about technical.

I have to use tools to break it down so that I can understand so many things there, if not it will be very difficult for someone who don't know much about technical to read it fluently, i also have the intention of translating to my local board, but right now that you are about to edit some things to make it readable for everyone, I will wait and see then I will take it there so that they can understand it with my local language.