post-quantum coin > recovery > schemes requiring large proofs in the outputs, where the validity of the > proof > determined whether or not the transaction is valid, and

potentially dangerous quantum enviroment valid, whether that happens in 5 years or 100. Sooner or later, upgrades will be needeed, but the response must be technical and opt-in (migration

after a quantum computer appears? > Also, we can always use time travel. If there is no consensus, then just timelock every OP_CHECKSIG call to a few years, and think about it later

accrued through quantum retrieval to miners in the form of high fees. I have some good news: it can be done without any soft-forks, if needed. If the main goal is to restrict spendability

of achieving quantum resilience is shared between our proposal and the earlier one from Lopp et al. (co-authored by the Pauli Group). However, the critical differentiator lies not

> which quantum-resistant signature scheme becomes standard. At that point, > if Bitcoin adopts the same standard as mobile devices, Bitcoin will also > gain native mobile

by a Quantum adversary after the reveal TX is opened, by inverting one of the pubkeys and making a fresh new signature. This changes the HMAC key that would've been used in an authentic

between "quantum secure" outputs/script commitments and signatures. quantum vulnerable output + quantum vulnerable signature --> Vulnerable to long-exposure

to-quantum-resistant-hash-p2qrh/1811/11 > . > > Therefore, our starting position when considering upgrades to the > scripting system should be to keep to Tapscript

that > quantum-vulnerable address types P2WKH and P2WSH already took the bc1q​ > prefix. > > More important will be other small minutiae like naming the output type >

post-quantum security upgrades. I hope that when that moment comes, a mechanism for reclaiming permanently lost coins is part of that discussion. To those who object on purely ideological

resistance, quantum computers get a quadratic speedup finding preimages due to Grover's algorithm. A more detailed analysis of this is in [0] (see Theorem 2 and Table 1). >

Pay to Quantum Resistant Hash) PR : - P2QRH (Pay to Quantum Resistant Hash) is now taproot (P2TR) but with the quantum vulnerable key-spend path removed. - PQ signatures have been moved

till > quantum computers capable of breaking classical cryptography become > available, a hybrid option with ML-DSA+ed25519 or FN-DSA+ed25519 seems a > good bet (at risk

before a quantum attacker inverts their pubkey and publishes their own announcement If the user has the ability and awareness to actively prepare for Q-day like this, why wouldn'

locked in quantum-vulnerable hashed addresses. I don't think anyone wants a commit/reveal protocol to become the sole primary method of transferring BTC. We're more or

using a quantum-protected address in the commitment stage. In the reveal transaction, we open the commitment by revealing sign(static_msg, sk), spending both the QR and EC UTXOs

discussion around quantum computing, which raises the question of how much numerical precision we may eventually need. I'm not opposed to extending precision further—but if

post-quantum signatures. If research shows that these signature schemes are sufficiently JPEG resistant, and I think it will, then a discount is very attractive. > I don'

worried about quantum menaces, a much better approach would be > the P2TRH (Pay To Taproot Hash), > even with the loss of batch verification, combined with advising users to >

transition to quantum-resistant addresses that I haven't seen brought up is that block size is limited. In such a scenario, it could be highly beneficial for parties that benefit

migrate to quantum safety, then Bitcoin code is future proofed. It will still require months (if BTC blocks normal transactions) to years (as a supported address type but not required

. A quantum network runs 45x faster than the same qubits assigned to a single machine. https://arxiv.org/abs/2211.15465 Quantum networks also require less wiring, and a 6000 node

> If I'm understanding correctly, the trick is about proving that y(y1 = y2) both in Big Script and Small Script. Yes, the trick is about

potential for quantum resistance) via a new witnessv1 program length or a new witness version, this approach will be similar in weight. * The biggest challenge with this approach that

post-quantum world, finding k such that r is 21 >>>> > bytes or less is efficient for the attacker. >>>> > >>>> >>>> Aside

post-quantum cryptographic algorithm like SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) would be a significant and complex undertaking. Here's an analysis

-relevant quantum computer (CRQC) is exponentially faster than a 1000 qubit one. There's also the > capability for cross-links for multiple chips to communicate with each

that the quantum miner would have received if they mined honestly. This attack (or variants thereof) provides essentially the same benefits as classical 51% attacks, including double