The emergence of quantum computers poses a significant risk to Bitcoin's security, prompting developers to consider proactive measures. Google's recent research suggests that a powerful quantum computer could potentially compromise Bitcoin's core cryptography in under nine minutes.
With approximately 6.5 million bitcoin tokens, valued at hundreds of billions of dollars, vulnerable to quantum attacks, the stakes are high. These coins are stored in addresses that a quantum computer could directly target, including those belonging to Bitcoin's pseudonymous creator, Satoshi Nakamoto. The potential compromise would undermine Bitcoin's fundamental principles of 'trust the code' and 'sound money.' To mitigate this threat, developers are exploring two primary avenues of attack and proposing various solutions.
A quantum computer can derive a private key from a public key, allowing it to drain coins from vulnerable addresses. There are two types of exposure: long-exposure attacks, which target idle coins on the blockchain, and short-exposure attacks, which target coins in transit or waiting in the memory pool.
Pay-to-public key (P2PK) addresses and Taproot (P2TR) are susceptible to long-exposure attacks, while coins in the mempool are vulnerable to short-exposure attacks. Several initiatives are underway to address these vulnerabilities. BIP 360 proposes removing public keys from the blockchain, introducing a new output type called Pay-to-Merkle-Root (P2MR). This would prevent quantum computers from reverse-engineering private keys.
However, this proposal only protects new coins and does not address the 1.7 million BTC already exposed in old addresses. SPHINCS+ and SLH-DSA are post-quantum signature schemes built on hash functions, which are less vulnerable to quantum attacks. However, these schemes have larger signature sizes, which could increase block space demand and raise transaction fees. Other proposals, such as SHRIMPS and SHRINCS, aim to reduce signature sizes while maintaining post-quantum security.
Tadge Dryja's Commit/reveal scheme is a soft fork that separates transaction execution into two phases: Commit and Reveal. This proposal protects transactions in the mempool from quantum attacks by allowing the network to verify the authenticity of transactions. Hourglass V2 targets the quantum vulnerability tied to older, exposed addresses by limiting the spending of old coins to one bitcoin per block.
This proposal aims to slow the potential bleeding in the event of a quantum attack, preventing a catastrophic market collapse. While these proposals are still in development, the ongoing discussion and exploration of solutions demonstrate the Bitcoin community's awareness of the quantum threat and their commitment to addressing it.