<p>No, there is no explicit, publicly-disclosed plan for this situation.</p>
<p>However, there is an implicit plan: when it becomes know that practical quantum computers are on the near-term horizon, the programmers responsible for maintaining Bitcoin at that point will create a <a href="https://bitcoin.org/en/developer-guide#term-hard-fork" rel="nofollow noreferrer">hard fork</a> or <a href="https://bitcoin.org/en/developer-guide#term-soft-fork" rel="nofollow noreferrer">soft fork</a> to introduce a new signature type, likely something based on <a href="https://en.wikipedia.org/wiki/Lamport_signature" rel="nofollow noreferrer">Lamport signatures</a> or <a href="https://en.wikipedia.org/wiki/Merkle_signature_scheme" rel="nofollow noreferrer">Merkle signatures</a>.</p>
<p>Users will upgrade their wallets to wallets which support the new signature type and spend their bitcoins from their old private keys to their new private keys.  This is pretty much identical to what Android users had to do for the <a href="https://bitcoin.org/en/alert/2013-08-11-android" rel="nofollow noreferrer">SecureRandom bug</a>.</p>
<p>This is all very easy if done in non-rushed manner, and fast quantum computing is still a ways off, which is one reason nobody is working on this now.  The other reason is that the proposed new signature types are all much larger than the <a href="http://perso.univ-rennes1.fr/sylvain.duquesne/master/standards/sec2_final.pdf" rel="nofollow noreferrer">secp256k1</a> ECDSA signatures we use now, so using them would increase block chain bloat.</p>
<p>Note: the question mentions the cracking of private keys from public keys, which could be done on a fast quantum computer using <a href="https://en.wikipedia.org/wiki/Shor%27s_algorithm" rel="nofollow noreferrer">Shor's algorithm</a>.  However, in the comments, the OP (B.T.) focuses on cracking SHA256 (which would likely be done using a different algorithm; I don't know which).</p>
<p>The answer above focuses on the private key problem, but the solution for the proof of work problem is the same: a hard fork or soft fork to change the hashing algorithm to make its most difficult value even more difficult.  Again, as long as we have months or years to make the change, this is an easy upgrade, so there's no sense in performing it prematurely.</p>

CC BY-SA 4.0
2014-11-23T02:49:32.897Z
2022-05-06T23:12:34.323Z
2022-05-06T23:12:34.323Z
David A. Harding
<p>Lets say someone started making real viable quantum computers that were affordable enough that large companies could buy one. And lets say a quantum algorithm was devised to crack the private keys of bitcoin public keys in days rather than years. </p>

<p>Is there a plan for that possibility? What would happen? Would there be a smooth migration to another system? Would bitcoin be able to update somehow to protect itself from such a breach?</p>

CC BY-SA 3.0
2014-11-14T22:12:24.833Z
The answer: No there isn't any backup, as it's assumed to be impossible - however, If there was a quantum algorithm that could crack sha256, then there are huge implications - bitcoin would be a minor target. You would be able to break the security of virtually all "secured" website, banks, government sites, etc.
user2813274
CC BY-SA 3.0
2014-11-14T23:43:51.807Z
Of course there is no backup, but the question is, what would be done in such a scenario? Arguing that the world will be chaos is not a solution.
B T
CC BY-SA 3.0
2014-11-14T23:45:28.347Z
I also disagree that it will be a minor target. If/when this happens (decades from now), there will likely be trillions of dollars of bitcoins out there. The question could be posed another way: sha256 *will* become crackable sometime in the next 1000 years. What plan can minimize the destruction of that scenario?
B T
CC BY-SA 3.0
2014-11-15T00:08:39.933Z
The value of bitcoin would decrease and approach 0 as that became feasible over the next 1000 years - right now it is a minor target - as for in X amount of years into the far future, my crystal ball says I am right.
user2813274
CC BY-SA 3.0
2014-11-15T15:32:19.997Z
I suppose it is possible to create a checkpoint at a specific date, say xx.yy.zzzz, s.t. all the transactions upto this day are unmodifiable. Then you apply whatever new protocols you want to use on new transactions maintaining backward compatibility. I would also ask for an expert opinion though.
Bitswazsky
CC BY-SA 3.0
2014-11-15T16:33:04.233Z
Related: http://bitcoin.stackexchange.com/questions/8702/if-sha256-and-or-ripemd-160-were-broken-would-all-bitcoin-addresses-be-compromi
Nick ODell
CC BY-SA 3.0
2014-11-18T16:35:55.717Z
Couldn't a hardfork be implemented by miners to replace the current cryptographic system with a new one? I have not looked at the bitcoin source code close enough, but if there is some decent design behind it, the cryptographic system in place currently should be able to replaced by something better without huge implication. Like @user2813274 was eluding to, bitcoin is a relatively small fish in the sea if quantum computers were able to crack modern cryptographic protocols.
Chris Stewart
<security><cryptography><quantum-computing>
Is there a fallback plan if bitcoin's underlying cryptography is cracked?
B T
# Is there a fallback plan if bitcoin's underlying cryptography is cracked?

(Asked by: username_0 on 2014-11-14)

Lets say someone started making real viable quantum computers that were affordable enough that large companies could buy one. And lets say a quantum algorithm was devised to crack the private keys of bitcoin public keys in days rather than years.

Is there a plan for that possibility? What would happen? Would there be a smooth migration to another system? Would bitcoin be able to update somehow to protect itself from such a breach?

**Tags:** security, cryptography, quantum-computing

> **Comments:**
> **username_1**: The answer: No there isn't any backup, as it's assumed to be impossible - however, If there was a quantum algorithm that could crack sha256, then there are huge implications - bitcoin would be a minor target. You would be able to break the security of virtually all "secured" website, banks, government sites, etc.  
> **username_0**: Of course there is no backup, but the question is, what would be done in such a scenario? Arguing that the world will be chaos is not a solution.  
> **username_0**: I also disagree that it will be a minor target. If/when this happens (decades from now), there will likely be trillions of dollars of bitcoins out there. The question could be posed another way: sha256 *will* become crackable sometime in the next 1000 years. What plan can minimize the destruction of that scenario?  
> **username_1**: The value of bitcoin would decrease and approach 0 as that became feasible over the next 1000 years - right now it is a minor target - as for in X amount of years into the far future, my crystal ball says I am right.  
> **username_2**: I suppose it is possible to create a checkpoint at a specific date, say xx.yy.zzzz, s.t. all the transactions upto this day are unmodifiable. Then you apply whatever new protocols you want to use on new transactions maintaining backward compatibility. I would also ask for an expert opinion though.  
> **username_3**: Related: http://bitcoin.stackexchange.com/questions/8702/if-sha256-and-or-ripemd-160-were-broken-would-all-bitcoin-addresses-be-compromi  
> **username_4**: Couldn't a hardfork be implemented by miners to replace the current cryptographic system with a new one? I have not looked at the bitcoin source code close enough, but if there is some decent design behind it, the cryptographic system in place currently should be able to replaced by something better without huge implication. Like @username_1 was eluding to, bitcoin is a relatively small fish in the sea if quantum computers were able to crack modern cryptographic protocols.  

---

## 1 answers

### Answer by username_5 on 2014-11-23. Score: 8 | Accepted answer

No, there is no explicit, publicly-disclosed plan for this situation.

However, there is an implicit plan: when it becomes know that practical quantum computers are on the near-term horizon, the programmers responsible for maintaining Bitcoin at that point will create a [hard fork](https://bitcoin.org/en/developer-guide#term-hard-fork) or [soft fork](https://bitcoin.org/en/developer-guide#term-soft-fork) to introduce a new signature type, likely something based on [Lamport signatures](https://en.wikipedia.org/wiki/Lamport_signature) or [Merkle signatures](https://en.wikipedia.org/wiki/Merkle_signature_scheme).

Users will upgrade their wallets to wallets which support the new signature type and spend their bitcoins from their old private keys to their new private keys. This is pretty much identical to what Android users had to do for the [SecureRandom bug](https://bitcoin.org/en/alert/2013-08-11-android).

This is all very easy if done in non-rushed manner, and fast quantum computing is still a ways off, which is one reason nobody is working on this now. The other reason is that the proposed new signature types are all much larger than the [secp256k1](http://perso.univ-rennes1.fr/sylvain.duquesne/master/standards/sec2_final.pdf) ECDSA signatures we use now, so using them would increase block chain bloat.

Note: the question mentions the cracking of private keys from public keys, which could be done on a fast quantum computer using [Shor's algorithm](https://en.wikipedia.org/wiki/Shor%27s_algorithm). However, in the comments, the OP (B.T.) focuses on cracking SHA256 (which would likely be done using a different algorithm; I don't know which).

The answer above focuses on the private key problem, but the solution for the proof of work problem is the same: a hard fork or soft fork to change the hashing algorithm to make its most difficult value even more difficult. Again, as long as we have months or years to make the change, this is an easy upgrade, so there's no sense in performing it prematurely.


---

