<p>We're deep in speculative territory here but, theoretically, if the elliptic curve algorithm were broken the entire Bitcoin system would immediately collapse.</p>

<p>Let's consider the case where you've successfully guarded your own funds somehow. How many public keys would still be out there vulnerable to such an attack? </p>

<p>Even though your "base" survived the attack, every other user out there who had UTXO on reused addresses would've been nuked and Bitcoin would have collapsed. You'd be the exceptional survivor. It'd be all over the news, dollar value would've gone to near zero, miners would stop and cut losses and so on. </p>

<p>So, in my view, there is no way to protect yourself <em>individually</em> against the eventual breakage of the elliptic curve discrete logarithm problem. Even if 90% of Bitcoin users had unspent UTXO's in safe unused addresses, the 10% that were hacked would cause immense damage to Bitcoin in a social sense. </p>

<p>Since Bitcoin obeys Metcalfe's law, network value being number of users squared, if enough users dropped out of the ecosystem, due to this kind of development in cryptanalysis, it'd surely deal a major blow to the community. </p>

<p>Not to mention another possibility: such a quantum computer could try <a href="https://bitcoin.stackexchange.com/questions/21646/what-is-the-chance-of-someone-randomly-finding-the-private-key-for-an-existing">brute forcing</a> astronomic quantities of random numbers into private keys all day. Eventually they'd stumble on valuable wallets which could cause the community upheaval of "having broken Bitcoin" and its consequences. So having a known public key wouldn't necessarily be the only attack vector. I'm sure there are other possible attacks using quantum computing, perhaps unknown unknowns that would add immense risk to the system.</p>

<p>Math is the Bitcoin guardian, if it's somehow found to be vulnerable no man would be left standing in my opinion.</p>

CC BY-SA 4.0
2019-10-17T20:11:27.463Z
I agree with everything you wrote, but this didn't provide an answer to the actual question: how can a user create an address, such that they will be able to safely recover coins in a post-QC world? For the sake of the question, lets imagine that users have all agreed upon a certain pre-QC block that they will fork from, so vulnerable funds have not been stolen / all network value destroyed. Perhaps this situation is unlikely, but this question is still interesting from an academic perspective.
chytrik
CC BY-SA 4.0
2019-10-17T20:28:13.290Z
@chytrik It's a nice theoretical question. I don't think there's a way to do anything *after* QC has broken the system. In a scenario where QC has already broken ECDLP it'd be catastrophic. Of course Core developers won't let it happen, unless something truly revolutionary happens in the near future.
Jose Fonseca
CC BY-SA 4.0
2019-10-17T20:39:04.763Z
If the onset of the attack was obvious (example, at block *X* we see every single P2PK UTXO consumed to create a single UTXO), then rolling back to a pre-attack block and forking the network to add safeguards against the QC *is* possible. I'm really just interested in hearing more about what sort of ideas there are to recover coins safely on this forked chain, such as the BIP32 seed ZKP Andrew mentioned. Evidently there **is** math that holds up against a QC attack, so how can users employ this math to their advantage, today? I do assume an unexpected QC will cause huge damage, in any case.
chytrik
CC BY-SA 4.0
2019-10-17T21:38:00.130Z
@chytrik I understand that you want to look at specific cryptographic technologies to be deployed at that scenario. Fine, but what I mean is this scenario would be unsolvable in practice. It's like debating what you'd do about the swimming pool water after a nuclear attack. Let's assume we're at the point where it's been decided to roll back to a pre-attack block, everything else *ceter paribus*. This is where my answer above kicks in: all those UTXO's pre-fork are vulnerable. Whatever you derive from the keys, to save those keys, is already broken!
Jose Fonseca
CC BY-SA 4.0
2019-10-17T21:39:39.327Z
@chytrik So let's say you find a cryptographic solution to convert all those pubkeys to the new system. The attacker also has this data available to him. So post-mortem there is no way to recover this blockchain, it's gone.
Jose Fonseca
CC BY-SA 4.0
2019-10-17T23:04:04.593Z
I don't think that is necessarily true, as evidenced by Andrew's suggestion of using a ZKP of the BIP 32 seed as a mechanism to safely recover funds. The BIP32 key derivation function is not secured through the ECDLP, so if I understand correctly, a QC that breaks ECDLP would not necessarily be able to work backwards through the BIP32 key derivation to obtain the seed. Thus a user could provide proof that they have first-hand knowledge related to the address in question (a ZKP of the seed), in a way that someone with a QC could not.
chytrik
CC BY-SA 4.0
2019-10-17T23:09:29.447Z
@chytrik That's an interesting solution. Curious if QC wouldn't be as efficient against the BIP32 KDF.
Jose Fonseca
CC BY-SA 4.0
2019-10-17T23:14:39.303Z
Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/100026/discussion-between-chytrik-and-jose-fonseca).
chytrik
CC BY-SA 4.0
2019-10-17T13:34:35.533Z
2019-10-17T13:34:35.533Z
Jose Fonseca
<p><a href="https://bitcoin.stackexchange.com/questions/91049/why-does-hashing-public-keys-not-actually-provide-any-quantum-resistance">An interesting question was posted recently, discussing the idea of hashed addresses being (not meaningfully) quantum resistant.</a> </p>

<p>As Andrew's answer on that question points out, paying to a hashed address does not 'quantum-proof' your coins, however there is a mention of using a zero-knowledge proof of a BIP32 seed to recover coins safely, against the threat of a quantum computer capable of breaking the elliptic curve discrete logarithm problem (ECDLP). </p>

<p>If this is possible, then clearly there are advantages to more complex constructions for addresses (the BIP32 key-derivation function being apparently more quantum-proof, in this case). </p>

<hr>

<p>So my question is: what address constructions <em>are</em> known to provide some level of safety from a quantum computer defeating the ECDLP? How is this safety provided? How can a user create addresses today, to allow themselves the best chance of having their Bitcoin-wealth survive a highly capable quantum computer?</p>

<p><em>Note that this question is meant to explore what a user can do now to mitigate the risk of the 'worst-case-scenario' of ECDLP being broken suddenly and unexpectedly soon; with time to plan there are obviously less scary ways to switch to a quantum-secure algorithm.</em></p>

<p>EDIT: for the sake of this question, lets assume that users have unanimously agreed to fork the chain from a certain block that was mined before the quantum-computer attack began, and the fork will lock all coins that are easily stolen by the QC (P2PK outputs, reused addresses, etc). Consider the case in which <em>every</em> bitcoin is stored at an address which will allow safe recovery, suddenly the potential damage to the network is lessened greatly. Even if this is unlikely, I think it is academically interesting. </p>

<security><address-generation><quantum-computing>
How can I protect my funds in the event a quantum computer breaks the ECDLP that Bitcoin relies on?
chytrik
# How can I protect my funds in the event a quantum computer breaks the ECDLP that Bitcoin relies on?

(Asked by: username_0 on 2019-10-17)

[An interesting question was posted recently, discussing the idea of hashed addresses being (not meaningfully) quantum resistant.](https://bitcoin.stackexchange.com/questions/91049/why-does-hashing-public-keys-not-actually-provide-any-quantum-resistance)

As Andrew's answer on that question points out, paying to a hashed address does not 'quantum-proof' your coins, however there is a mention of using a zero-knowledge proof of a BIP32 seed to recover coins safely, against the threat of a quantum computer capable of breaking the elliptic curve discrete logarithm problem (ECDLP).

If this is possible, then clearly there are advantages to more complex constructions for addresses (the BIP32 key-derivation function being apparently more quantum-proof, in this case).

---

So my question is: what address constructions *are* known to provide some level of safety from a quantum computer defeating the ECDLP? How is this safety provided? How can a user create addresses today, to allow themselves the best chance of having their Bitcoin-wealth survive a highly capable quantum computer?

*Note that this question is meant to explore what a user can do now to mitigate the risk of the 'worst-case-scenario' of ECDLP being broken suddenly and unexpectedly soon; with time to plan there are obviously less scary ways to switch to a quantum-secure algorithm.*

EDIT: for the sake of this question, lets assume that users have unanimously agreed to fork the chain from a certain block that was mined before the quantum-computer attack began, and the fork will lock all coins that are easily stolen by the QC (P2PK outputs, reused addresses, etc). Consider the case in which *every* bitcoin is stored at an address which will allow safe recovery, suddenly the potential damage to the network is lessened greatly. Even if this is unlikely, I think it is academically interesting.

**Tags:** security, address-generation, quantum-computing


---

## 1 answers

### Answer by username_1 on 2019-10-17. Score: 5

We're deep in speculative territory here but, theoretically, if the elliptic curve algorithm were broken the entire Bitcoin system would immediately collapse.

Let's consider the case where you've successfully guarded your own funds somehow. How many public keys would still be out there vulnerable to such an attack?

Even though your "base" survived the attack, every other user out there who had UTXO on reused addresses would've been nuked and Bitcoin would have collapsed. You'd be the exceptional survivor. It'd be all over the news, dollar value would've gone to near zero, miners would stop and cut losses and so on.

So, in my view, there is no way to protect yourself *individually* against the eventual breakage of the elliptic curve discrete logarithm problem. Even if 90% of Bitcoin users had unspent UTXO's in safe unused addresses, the 10% that were hacked would cause immense damage to Bitcoin in a social sense.

Since Bitcoin obeys Metcalfe's law, network value being number of users squared, if enough users dropped out of the ecosystem, due to this kind of development in cryptanalysis, it'd surely deal a major blow to the community.

Not to mention another possibility: such a quantum computer could try [brute forcing](https://bitcoin.stackexchange.com/questions/21646/what-is-the-chance-of-someone-randomly-finding-the-private-key-for-an-existing) astronomic quantities of random numbers into private keys all day. Eventually they'd stumble on valuable wallets which could cause the community upheaval of "having broken Bitcoin" and its consequences. So having a known public key wouldn't necessarily be the only attack vector. I'm sure there are other possible attacks using quantum computing, perhaps unknown unknowns that would add immense risk to the system.

Math is the Bitcoin guardian, if it's somehow found to be vulnerable no man would be left standing in my opinion.

> **Comments:**
> **username_0**: I agree with everything you wrote, but this didn't provide an answer to the actual question: how can a user create an address, such that they will be able to safely recover coins in a post-QC world? For the sake of the question, lets imagine that users have all agreed upon a certain pre-QC block that they will fork from, so vulnerable funds have not been stolen / all network value destroyed. Perhaps this situation is unlikely, but this question is still interesting from an academic perspective.  
> **username_1**: @username_0 It's a nice theoretical question. I don't think there's a way to do anything *after* QC has broken the system. In a scenario where QC has already broken ECDLP it'd be catastrophic. Of course Core developers won't let it happen, unless something truly revolutionary happens in the near future.  
> **username_0**: If the onset of the attack was obvious (example, at block *X* we see every single P2PK UTXO consumed to create a single UTXO), then rolling back to a pre-attack block and forking the network to add safeguards against the QC *is* possible. I'm really just interested in hearing more about what sort of ideas there are to recover coins safely on this forked chain, such as the BIP32 seed ZKP Andrew mentioned. Evidently there **is** math that holds up against a QC attack, so how can users employ this math to their advantage, today? I do assume an unexpected QC will cause huge damage, in any case.  
> **username_1**: @username_0 I understand that you want to look at specific cryptographic technologies to be deployed at that scenario. Fine, but what I mean is this scenario would be unsolvable in practice. It's like debating what you'd do about the swimming pool water after a nuclear attack. Let's assume we're at the point where it's been decided to roll back to a pre-attack block, everything else *ceter paribus*. This is where my answer above kicks in: all those UTXO's pre-fork are vulnerable. Whatever you derive from the keys, to save those keys, is already broken!  
> **username_1**: @username_0 So let's say you find a cryptographic solution to convert all those pubkeys to the new system. The attacker also has this data available to him. So post-mortem there is no way to recover this blockchain, it's gone.  
> **username_0**: I don't think that is necessarily true, as evidenced by Andrew's suggestion of using a ZKP of the BIP 32 seed as a mechanism to safely recover funds. The BIP32 key derivation function is not secured through the ECDLP, so if I understand correctly, a QC that breaks ECDLP would not necessarily be able to work backwards through the BIP32 key derivation to obtain the seed. Thus a user could provide proof that they have first-hand knowledge related to the address in question (a ZKP of the seed), in a way that someone with a QC could not.  
> **username_1**: @username_0 That's an interesting solution. Curious if QC wouldn't be as efficient against the BIP32 KDF.  
> **username_0**: Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/100026/discussion-between-username_0-and-username_1-username_1).  

---

