The emergence of quantum computing has sparked intense discussion, particularly after Google's announcement that a sufficiently powerful quantum machine could potentially breach legacy blockchains with less computational power than initially thought. For XRP holders, the answer to the question of vulnerability is nuanced, with experts suggesting that XRP's architecture offers better protection against quantum threats than Bitcoin's. XRP operates on the XRP Ledger, an open-source and decentralized blockchain, which is utilized by Ripple for facilitating cross-border transactions. Let's examine this in detail, step by step.
The primary concern with quantum computing is its potential to exploit the cryptographic underpinnings of blockchains, specifically the private key that serves as a secret password for signing and executing transactions on the distributed ledger. A public key is mathematically derived from the private key, and this public key is used to generate a wallet address that can be shared with others to receive funds.
The quantum vulnerability arises from the possibility that a powerful enough machine running Shor's algorithm could theoretically reverse-engineer a private key from an exposed public key, thereby draining the associated funds. Typically, a public key is exposed to the network when a transaction is sent, and when funds are received, only the address is recorded on the blockchain. This means that the quantum vulnerability is tied to account activity, specifically sending transactions, rather than the balance or the duration for which an address has been held. Recently, a quantum vulnerability audit of the XRP Ledger found that approximately 300,000 XRP accounts, holding about 2.4 billion XRP, have never sent any funds and have only received funds, meaning their public keys have never been exposed to the network.
These accounts are inherently quantum-safe by default. However, there are dormant whale accounts that have transacted in the past, exposing their public keys, but these transactions occurred at least five years ago.
These accounts are considered exposed and inactive. If a quantum computer were to be developed tomorrow, these whales would be at risk. The audit identified two such accounts on the XRP Ledger, collectively holding 21 million XRP, which, although a significant amount, constitutes only 0.03% of the circulating supply. It's worth noting that this vulnerability assumes these accounts are dormant and not actively managed, meaning they are not utilizing the 'key rotation' feature available on the XRP Ledger.
This feature allows users to swap their signing key without moving funds, effectively changing the lock on their account without having to move the account itself. This means that the funds remain safe, no send transaction is required, and anyone holding the old key is locked out of the account. Technically, this feature is available to all users, but the issue arises with long-dormant accounts that may have lost access to their keys, are no longer active, or are simply not paying attention, making them vulnerable. Mayukha Vadari, a staff software engineer at Ripple, highlighted the 'escrow feature' as an additional defense mechanism against quantum risks.
She explained that funds locked in escrow with a time lock are secure not because of cryptographic measures, but due to logical constraints - a time lock simply prevents withdrawal until a specified time has passed. While the time lock protects the funds, the account that locked those funds can still carry quantum risks like any other XRPL account.
An attacker could potentially take control of the account, cancel or modify the escrow, or simply wait for the time lock to expire. In comparison, the quantum threat to Bitcoin appears more severe for two primary reasons. Firstly, the scale of the issue is much larger.
A significant portion of early Bitcoin was mined using a format called P2PK, which directly exposes public keys in transaction outputs without requiring a spend transaction. This includes Satoshi Nakamoto's 1 million BTC, which has never been moved. According to Google's estimates, about 6.9 million BTC are vulnerable, equating to nearly 35% of Bitcoin's circulating supply - a substantial figure compared to XRP's 0.03%. All of these are essentially vulnerable to a potential quantum attack.
Furthermore, Bitcoin holders who recognize the threat and wish to protect their funds face a structural issue that XRP holders do not. Bitcoin's blockchain lacks a key rotation feature, leaving holders with only one option: moving funds to a new address whose public key has never been seen. However, when funds are moved from an old to a new address, the transaction is temporarily stored in the memory pool for about 10 minutes, during which time the public key of the old address is exposed.
A sufficiently powerful quantum machine could exploit this public key within those ten minutes. Although this risk is still largely theoretical, it highlights the relative structural vulnerability of Bitcoin holders. It's worth noting that Bitcoin developers have already begun proposing solutions to develop quantum resistance.