<blockquote>
  <p>asymmetric ciphers</p>
</blockquote>

<p>Ones based on specific primitives, like RSA and ECDSA specifically. </p>

<blockquote>
  <p>Symmetric algorithms are supposed to be safe.</p>
</blockquote>

<p>With approximately half the number of bits of security due to <a href="https://en.wikipedia.org/wiki/Grover%27s_algorithm" rel="nofollow noreferrer">Grover's algorithm</a>.</p>

<blockquote>
  <p>Which components of the bitcoin blockchain would be exposed to quantum attacks?</p>
</blockquote>

<p>The security of SHA256 would be halved, ECDSA would be weaked beyond usability. In Bitcoin raw ECDSA keys are typically only exposed during the portion of time when the transaction is signed and when it is confirmed, assuming that there are not large chain reorganisations ("double spending") during this time, the window of opportunity is relatively limited. </p>

<p>Due to the way many pieces of software re-use keys, this is not the case for a large portion of the total Bitcoin in existence however. More than 10B USD worth of UTXOs are stored in addresses with known ECDSA public keys, which would be the obvious target for anybody to steal. </p>

<blockquote>
  <p>Are these components relevant the the blockchain's full functionality if they get "broken" or just minor nuisance but no major negative impact? </p>
</blockquote>

<p>Generally speaking, all money would be vulnerable to being stolen without consequence or interaction from its owner.</p>

<blockquote>
  <p>what could be feasible methods to make these above components more resistant against quantums?</p>
</blockquote>

<p>Bitcoin has upgrade paths available to it to use quantum safe cryptography like hash based signatures if such a thing were necessary in the future, but there's not a lot of strong evidence to suggest that true quantum computers that are capable of running the sort of algorithms will ever exist. We would expect to see gradual progress towards it rather than a definitive success story about it anyway, which gives a lot of room for making these sorts of changes.  </p>

<p>Why don't we use hash based cryptography today? It's fairly awful and to be avoided unless necessary.                           Signatures are extremely large, public keys are even larger, and they don't allow for interesting constructions like is the case with ECDSA / Schnorr. </p>

CC BY-SA 4.0
2020-01-23T17:54:50.340Z
2020-01-29T01:08:19.487Z
2020-01-29T01:08:19.487Z
Claris
<p>in just a few years I believe that quantums will exist that break asymmetric ciphers, and bitcoin is based on asymmetric ones like public-key-cryptography, correct? Symmetric algorithms are supposed to be safe.</p>

<p>Question is to experts here:</p>

<p>1) Which components of the bitcoin blockchain would be exposed to quantum attacks?</p>

<p>2) Are these components relevant the the blockchain's full functionality if they get "broken" or just minor nuisance but no major negative impact?  </p>

<p>3) What do bitcoin (core)devs brainstorm currently, what could be feasible methods to make these above components more resistant against quantums?</p>

<p>Thanks for insights</p>

<private-key><hash><encryption><quantum-computing>
A security need for Bitcoin to fork to quantum resistant algorithm in a few years?
johnsmiththelird
# A security need for Bitcoin to fork to quantum resistant algorithm in a few years?

(Asked by: username_0 on 2020-01-23)

in just a few years I believe that quantums will exist that break asymmetric ciphers, and bitcoin is based on asymmetric ones like public-key-cryptography, correct? Symmetric algorithms are supposed to be safe.

Question is to experts here:

1) Which components of the bitcoin blockchain would be exposed to quantum attacks?

2) Are these components relevant the the blockchain's full functionality if they get "broken" or just minor nuisance but no major negative impact?

3) What do bitcoin (core)devs brainstorm currently, what could be feasible methods to make these above components more resistant against quantums?

Thanks for insights

**Tags:** private-key, hash, encryption, quantum-computing


---

## 1 answers

### Answer by username_1 on 2020-01-23. Score: 8 | Accepted answer

> asymmetric ciphers

Ones based on specific primitives, like RSA and ECDSA specifically.

> Symmetric algorithms are supposed to be safe.

With approximately half the number of bits of security due to [Grover's algorithm](https://en.wikipedia.org/wiki/Grover%27s_algorithm).

> Which components of the bitcoin blockchain would be exposed to quantum attacks?

The security of SHA256 would be halved, ECDSA would be weaked beyond usability. In Bitcoin raw ECDSA keys are typically only exposed during the portion of time when the transaction is signed and when it is confirmed, assuming that there are not large chain reorganisations ("double spending") during this time, the window of opportunity is relatively limited.

Due to the way many pieces of software re-use keys, this is not the case for a large portion of the total Bitcoin in existence however. More than 10B USD worth of UTXOs are stored in addresses with known ECDSA public keys, which would be the obvious target for anybody to steal.

> Are these components relevant the the blockchain's full functionality if they get "broken" or just minor nuisance but no major negative impact?

Generally speaking, all money would be vulnerable to being stolen without consequence or interaction from its owner.

> what could be feasible methods to make these above components more resistant against quantums?

Bitcoin has upgrade paths available to it to use quantum safe cryptography like hash based signatures if such a thing were necessary in the future, but there's not a lot of strong evidence to suggest that true quantum computers that are capable of running the sort of algorithms will ever exist. We would expect to see gradual progress towards it rather than a definitive success story about it anyway, which gives a lot of room for making these sorts of changes.

Why don't we use hash based cryptography today? It's fairly awful and to be avoided unless necessary. Signatures are extremely large, public keys are even larger, and they don't allow for interesting constructions like is the case with ECDSA / Schnorr.


---

