<p>It is currently understood that quantum computers could theoretically offer a quadratic speed-up in cracking hash function preimages using <a href="https://en.wikipedia.org/wiki/Grover%27s_algorithm" rel="nofollow noreferrer">Grover's algorithm</a>, and cubic speed-up in finding hash collisions using <a href="https://en.wikipedia.org/wiki/BHT_algorithm" rel="nofollow noreferrer">Brassard-Høyer-Tapp algorithm</a>.
It is also <a href="https://www.researchgate.net/figure/Comparison-of-conventional-and-quantum-security-levels-of-typical-ciphers-12_tbl1_332863808" rel="nofollow noreferrer">understood</a> that elliptic-curve cryptography would be the the first to go as it could be completely broken using <a href="https://en.wikipedia.org/wiki/Shor%27s_algorithm" rel="nofollow noreferrer">Shor's algorithm</a>.
We summarize this in the table below:</p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>Primitive</th>
<th>Conventional Computing Security Level</th>
<th>Quantum Computing Security Level</th>
</tr>
</thead>
<tbody>
<tr>
<td>ECC-256</td>
<td>128 bits</td>
<td>0 bits</td>
</tr>
<tr>
<td>SHA-256</td>
<td>256 bits (preimage) / 128 bits (collision)</td>
<td>128 bits (preimage) / 85 bits (collision)</td>
</tr>
<tr>
<td>HASH-256</td>
<td>256 bits (preimage) / 128 bits (collision)</td>
<td>128 bits (preimage) / 85 bits (collision)</td>
</tr>
<tr>
<td>RIPEMD-160</td>
<td>160 bits (preimage) / 80 bits (collision)</td>
<td>80 bits (preimage) / 53 bits (collision)</td>
</tr>
<tr>
<td>HASH-160</td>
<td>160 bits (preimage) / 80 bits (collision)</td>
<td>80 bits (preimage) / 53 bits (collision)</td>
</tr>
</tbody>
</table>
</div>
<p>From that we can say it is not so much about the algorithm - it is more about the hash function output size. Quantum computing doesn't break the algorithm but offers a speed-up for ANY algorithm, so all we'd need to do is pick one and increase the hash output size to 384 bits so we can maintain the 128 bits of security against collision attacks. BLAKE2 or SHA-3 would be good candidates. Even the SHA-2 familiy SHA-384 would be OK.</p>
<p>Actually implementing this in Bitcoin protocol would not be trivial, because a change of hash function would break a lot of software out there.</p>

CC BY-SA 4.0
2022-10-31T10:17:49.657Z
2022-10-31T10:17:49.657Z
bca-0353f40e
<p>Other threads already answer very clearly that quantum comps could easily "break" /attack bitcoins chain. </p>

<p>Now: Are there any ideas among the bitcoin devs circulating out there, how to save bitcoin from future quantum attacks? its only a couple years away right?</p>

<p>What could be viable options to change and make btc quantum proof, changing hashing algorithm to which new algorithm? </p>

<p>Thanks!</p>

<p>__</p>

CC BY-SA 4.0
2019-03-04T21:48:49.013Z
Possible duplicate of [What effects would a scalable Quantum Computer have on Bitcoin?](https://bitcoin.stackexchange.com/questions/6062/what-effects-would-a-scalable-quantum-computer-have-on-bitcoin)
chytrik
CC BY-SA 4.0
2019-03-04T22:54:11.287Z
it is not a real duplicate. your referenced link talks about the effect. So it only partly answers my question (yes, bitcoin would break easily by quantum comps).

But 2nd question is still valid:  Are there currently any code changes discussed for the future by btc core devs?  And how could solutions to this quantum problems look like, changing hashing algorithm to which new algorithm?

or is this really too far away in the future? I think not
johnsmiththelird
CC BY-SA 4.0
2019-03-05T00:03:22.930Z
The hashing algorithm is probably the most quantum-resistant piece of cryptography right now in Bitcoin. Barring any specific breaks, SHA256 and RIPEMD160 are as quantum-resistant as hash functions can be (there is an inevitable square-root speedup that applies to any hash function). Much more can be said about the quantum resistance of digital signatures.
Pieter Wuille
CC BY-SA 4.0
2019-03-05T16:54:19.317Z
@PieterWuille  hi thx. i did not know that sha256 is secure. makes sense, its symmetric

-Then pls tell me, which precise parameters of bitcoins chain would be susceptible to quantum attacks (u said signatures, what else)? 

- And what could be ways to prevent future attacks on those parameters? Any ideas circulating among btc dev community on how to "adjust" those parameters?   -

Or is the current consensus rather to wait for the crypto community till they provide new crypto schemes which are quantum proof (waiting for the NIST Post-Quantum Crypto  Competition ) ... thank u very much!
johnsmiththelird
<security><hash><encryption><quantum-computing>
How may bitcoins hash algorithm be secured in the future from quantum computing brute forcing?
johnsmiththelird
# How may bitcoins hash algorithm be secured in the future from quantum computing brute forcing?

(Asked by: username_0 on 2019-03-04)

Other threads already answer very clearly that quantum comps could easily "break" /attack bitcoins chain.

Now: Are there any ideas among the bitcoin devs circulating out there, how to save bitcoin from future quantum attacks? its only a couple years away right?

What could be viable options to change and make btc quantum proof, changing hashing algorithm to which new algorithm?

Thanks!

\_\_

**Tags:** security, hash, encryption, quantum-computing

> **Comments:**
> **username_1**: Possible duplicate of [What effects would a scalable Quantum Computer have on Bitcoin?](https://bitcoin.stackexchange.com/questions/6062/what-effects-would-a-scalable-quantum-computer-have-on-bitcoin)  
> **username_0**: it is not a real duplicate. your referenced link talks about the effect. So it only partly answers my question (yes, bitcoin would break easily by quantum comps).  But 2nd question is still valid:  Are there currently any code changes discussed for the future by btc core devs?  And how could solutions to this quantum problems look like, changing hashing algorithm to which new algorithm?  or is this really too far away in the future? I think not  
> **username_2**: The hashing algorithm is probably the most quantum-resistant piece of cryptography right now in Bitcoin. Barring any specific breaks, SHA256 and RIPEMD160 are as quantum-resistant as hash functions can be (there is an inevitable square-root speedup that applies to any hash function). Much more can be said about the quantum resistance of digital signatures.  
> **username_0**: @username_2  hi thx. i did not know that sha256 is secure. makes sense, its symmetric  -Then pls tell me, which precise parameters of bitcoins chain would be susceptible to quantum attacks (u said signatures, what else)?   - And what could be ways to prevent future attacks on those parameters? Any ideas circulating among btc dev community on how to "adjust" those parameters?   -  Or is the current consensus rather to wait for the crypto community till they provide new crypto schemes which are quantum proof (waiting for the NIST Post-Quantum Crypto  Competition ) ... thank u very much!  

---

## 1 answers

### Answer by username_3 on 2022-10-31. Score: 3

It is currently understood that quantum computers could theoretically offer a quadratic speed-up in cracking hash function preimages using [Grover's algorithm](https://en.wikipedia.org/wiki/Grover%27s_algorithm), and cubic speed-up in finding hash collisions using [Brassard-Høyer-Tapp algorithm](https://en.wikipedia.org/wiki/BHT_algorithm).
It is also [understood](https://www.researchgate.net/figure/Comparison-of-conventional-and-quantum-security-levels-of-typical-ciphers-12_tbl1_332863808) that elliptic-curve cryptography would be the the first to go as it could be completely broken using [Shor's algorithm](https://en.wikipedia.org/wiki/Shor%27s_algorithm).
We summarize this in the table below:

| Primitive | Conventional Computing Security Level | Quantum Computing Security Level |
| --- | --- | --- |
| ECC-256 | 128 bits | 0 bits |
| SHA-256 | 256 bits (preimage) / 128 bits (collision) | 128 bits (preimage) / 85 bits (collision) |
| HASH-256 | 256 bits (preimage) / 128 bits (collision) | 128 bits (preimage) / 85 bits (collision) |
| RIPEMD-160 | 160 bits (preimage) / 80 bits (collision) | 80 bits (preimage) / 53 bits (collision) |
| HASH-160 | 160 bits (preimage) / 80 bits (collision) | 80 bits (preimage) / 53 bits (collision) |

From that we can say it is not so much about the algorithm - it is more about the hash function output size. Quantum computing doesn't break the algorithm but offers a speed-up for ANY algorithm, so all we'd need to do is pick one and increase the hash output size to 384 bits so we can maintain the 128 bits of security against collision attacks. BLAKE2 or SHA-3 would be good candidates. Even the SHA-2 familiy SHA-384 would be OK.

Actually implementing this in Bitcoin protocol would not be trivial, because a change of hash function would break a lot of software out there.


---

