<p>Schnorr signatures are proven to be secure and robust against chosen-message attacks in the random oracle model. In practice, this implies that as long as the condensation function behaves ideally,
the only way to &quot;break&quot; Schnorr's scheme is to solve the discrete logarithm problem.</p>
<p>Conversely, the construction of ECDSA does not guarantee its safety. The ECDSA scheme contains two independent condensation functions. One function <code>H</code> is used to hash the message and the other function F to calculate the signature component <code>r</code>. The value r is calculated by applying the condensation function <code>F</code> to the x-abstract of the point <code>(x1, y1)</code>. The safety of the scheme is proved when both functions satisfy the random oracle model but practically, the function F does not.</p>
<p>While both are based on discrete logarithm problem, no one of them is secure against quantum computing. We are far away from such of attacks, so you don't have to worry.</p>

CC BY-SA 4.0
2022-12-15T15:13:27.607Z
2022-12-15T15:22:35.673Z
2022-12-15T15:22:35.673Z
Pegasus
<p>An additional thing to consider is the fact that taproot addresses are not hashed like other bitcoin addresses. This means that were a sufficiently powerful quantum computer to be built, it could go through taproot addresses, derive their private key, and steal their funds. Because there's no quantum algorithm for reversing a hash, a quantum computer must wait for you to spend from that address (or do something else that reveals the underlying public key) before it can attack you.</p>
<p>The short of this means that you would practically need a much more powerful quantum computer to steal your money from a non-taproot address than a taproot address.</p>

CC BY-SA 4.0
2023-06-09T16:26:31.287Z
2023-06-09T16:26:31.287Z
B T
<p>I'm looking for an address type for long term storage of bitcoin but I don't know what to choose. I'm not sure if Taproot is more secure than segwit.</p>
<p>Another question I have about Taproot, is that if it uses Schnorr Signatures instead of ECDSA, is it then stronger against quantum computing compared to the other address types or not?</p>

<security><ecdsa><schnorr-signatures><p2tr><quantum-computing>
Is Taproot the best address against quantum computers attack?
Dodi Alf
# Is Taproot the best address against quantum computers attack?

(Asked by: username_0 on 2022-12-15)

I'm looking for an address type for long term storage of bitcoin but I don't know what to choose. I'm not sure if Taproot is more secure than segwit.

Another question I have about Taproot, is that if it uses Schnorr Signatures instead of ECDSA, is it then stronger against quantum computing compared to the other address types or not?

**Tags:** security, ecdsa, schnorr-signatures, p2tr, quantum-computing


---

## 2 answers

### Answer by username_1 on 2022-12-15. Score: 3

Schnorr signatures are proven to be secure and robust against chosen-message attacks in the random oracle model. In practice, this implies that as long as the condensation function behaves ideally,
the only way to "break" Schnorr's scheme is to solve the discrete logarithm problem.

Conversely, the construction of ECDSA does not guarantee its safety. The ECDSA scheme contains two independent condensation functions. One function `H` is used to hash the message and the other function F to calculate the signature component `r`. The value r is calculated by applying the condensation function `F` to the x-abstract of the point `(x1, y1)`. The safety of the scheme is proved when both functions satisfy the random oracle model but practically, the function F does not.

While both are based on discrete logarithm problem, no one of them is secure against quantum computing. We are far away from such of attacks, so you don't have to worry.


---

### Answer by username_2 on 2023-06-09. Score: 0

An additional thing to consider is the fact that taproot addresses are not hashed like other bitcoin addresses. This means that were a sufficiently powerful quantum computer to be built, it could go through taproot addresses, derive their private key, and steal their funds. Because there's no quantum algorithm for reversing a hash, a quantum computer must wait for you to spend from that address (or do something else that reveals the underlying public key) before it can attack you.

The short of this means that you would practically need a much more powerful quantum computer to steal your money from a non-taproot address than a taproot address.


---

