{"id":10350,"date":"2025-01-15T12:26:29","date_gmt":"2025-01-15T19:26:29","guid":{"rendered":"https:\/\/jasonsblog.ddns.net\/?p=10350"},"modified":"2025-01-15T12:47:48","modified_gmt":"2025-01-15T19:47:48","slug":"bitcoin-vs-the-quantum-computer-threat-timeline-and-solutions-2025-2035","status":"publish","type":"post","link":"https:\/\/jasonsblog.ddns.net\/index.php\/2025\/01\/15\/bitcoin-vs-the-quantum-computer-threat-timeline-and-solutions-2025-2035\/","title":{"rendered":"Bitcoin vs. The Quantum Computer Threat: Timeline and Solutions (2025\u20132035)"},"content":{"rendered":"\n

A very good review of where we are with the threat to Bitcoin<\/a> posed by Quantum computers. In simple terms, a lot of cryptography deals with large prime numbers multiplied together which on modern computers happens quite fast, but going the other way to find those numbers is far from fast. This is the threat of quantum computers, that time penalty to break encryption comes way down. Consequently, I like the zero proof methodology which provides privacy, and there was a very interesting cryptocurrency Zcash based on the Zerocash protocol<\/a> that was using a form of this methodology. I held some at one point and played with it, and this highlights the value of the many alternative cryptocurrencies in that new concepts and methodologies can be tested in the real world with real transactions, with the best proven methodologies making their way to Bitcoin or other payment layers to be based upon Bitcoin.<\/p>\n\n\n\n

https:\/\/cointelegraph.com\/magazine\/bitcoin-quantum-computer-threat-timeline-solutions-2024-2035\/<\/a><\/p>\n\n\n

<\/div><\/div><\/div>\n\n\n
Quantum computers aren’t an imminent threat to Bitcoin, and it won\u2019t affect all wallets \u2014 but it is a real problem and there are solutions.<\/h5>\n\n\n\n
\"\"<\/figure>\n\n\n\n

By Kyle Torpey<\/p>\n\n\n\n

Recent breakthroughs in quantum computing have led market commentators to, once again, claim that Bitcoin\u2019s future is under threat.<\/strong>

Google\u2019s Willow quantum chip and its ability to significantly reduce the number of errors as it scales up the number of qubits are the newest source of generating fear, uncertainty and doubt about the prospects of Bitcoin\u2019s survival in a post-quantum computing world.<\/p>\n\n\n\n

The key concern is that a sufficiently advanced quantum computer will be able to break various forms of cryptography used in Bitcoin (and many other cryptocurrencies), effectively making the system unusable and worthless. For example, someone could attack the network with a 51% attack by mining with a quantum computer or steal coins held in addresses by more easily guessing the private keys associated with them.<\/p>\n\n\n\n

So, is this a genuine and imminent threat? And what can developers do, if required, to fix this much-discussed issue?<\/p>\n\n\n\n

According to longtime Bitcoin researcher Ethan Heilman, keeping Bitcoin\u2019s cryptography secure from quantum computers and other potential threats will be a never-ending battle for developers.<\/p>\n\n\n\n

\u201cBitcoin needs to protect people\u2019s funds over generational timescales,\u201d Heilman tells Magazine. <\/p>\n\n\n\n

\n

The history of cryptography is one of change and adoption to new attacks, faster computers and better algorithms. So, the grand challenge for those working on Bitcoin cryptography is: How do you protect coins over decades or even centuries, given the mercurial nature of cryptographic security?\u201d<\/p>\n<\/blockquote>\n\n\n\n

Is Google\u2019s Willow quantum computer a threat to Bitcoin in 2024?<\/h2>\n\n\n\n

The first thing to note about the potential threat quantum computers pose to Bitcoin is that the issue is completely overblown at this time. Willow is one of the frontrunners in quantum computing built up to this point, but it\u2019s nowhere near what would be needed to threaten the cryptography used in Bitcoin.<\/p>\n\n\n\n

\"Quantum
Willow marketing image. (Google)<\/em><\/figcaption><\/figure>\n\n\n\n

According to a 2022 research study<\/a> by Universal Quantum, which is a spin-off company associated with the University of Sussex, a quantum computer with 13 million qubits would take a day to crack a private key associated with a vulnerable Bitcoin address. Google\u2019s Willow only has 105 qubits.<\/p>\n\n\n\n

Indeed, Google themselves told<\/a> The Verge that Willow is not a threat to modern cryptography. Additionally, Nvidia CEO Jensen Huang stated<\/a> that \u201cvery useful quantum computers\u201d are probably still twenty years away, which implies their real world applications will be limited for some time.<\/p>\n\n\n\n

On a recent episode of ARK Invest\u2019s Bitcoin Brainstorm podcast, Blockstream co-founder and CEO Adam Back also pushed back on those claiming the quantum threat to Bitcoin is imminent. <\/p>\n\n\n\n

\u201cIt\u2019s kind of tempting to propose a bet to some of them because they\u2019re saying that we should watch out by 2028\u2014like, no way,\u201d he said<\/a>.<\/p>\n\n\n\n

\"The
The gang talks quantum computers and Bitcoin. (ARK Invest\/YouTube)<\/em><\/figcaption><\/figure>\n\n\n\n

However, the potential threat posed to Bitcoin by quantum computing has been a known issue for a long time, and discussions around it \u2014 or at least discussions around the theoretical breaking of SHA-256 algorithm used in the mining process \u2014 date all the way back to a time when Bitcoin creator Satoshi Nakamoto was still involved<\/a> in the project. Upgrades to quantum-resistant Bitcoin addresses or other alterations to the cryptography used in Bitcoin can be implemented when needed.<\/p>\n\n\n\n

As a side note, this is far from a Bitcoin-only problem, as the cryptography used in the traditional banking system is also vulnerable to attacks from quantum computers and currently poses a much bigger target.<\/p>\n\n\n\n

When will quantum computers break Bitcoin? Expert predictions for 2030\u20132035<\/h2>\n\n\n\n

Bitcoin developers and other interest parties are generally skeptical and cautious about the potential threat.<\/p>\n\n\n\n

\u201cI just want to make sure that we\u2019re thinking about this correctly,\u201d said ARK Invest CEO Cathie Wood on the recent quantum computing-focused episode of Bitcoin Brainstorm.<\/p>\n\n\n\n

\n

I don\u2019t want to dismiss any possibilities because I do think technologies are moving ahead faster and faster.\u201d<\/p>\n<\/blockquote>\n\n\n\n

While there are still a fairly large number of different innovations that need to be made in quantum computing for it to become a serious threat to Bitcoin, it makes sense to start discussing the issue more seriously today.<\/p>\n\n\n\n

Most estimates do not see quantum computing as a threat to the cryptography used in Bitcoin until the 2030s at the earliest. Notably, the National Institute for Standards and Technology (NIST) recommends<\/a> migrating to new cryptographic systems by 2035 to mitigate forward-secrecy risks related to future quantum threats. However, Bitcoin would still be safe under this level of threat, as it is not impacted<\/a> by forward secrecy risks, according to Ledger chief technology officer Charles Guillemet.<\/p>\n\n\n\n

Additionally, IBM\u2019s quantum computing roadmap points to a few thousand qubits by 2033. That\u2019s still far short of the millions of qubits likely needed to break the cryptography in Bitcoin.<\/p>\n\n\n\n

Analysts from Bernstein still see the quantum threat to Bitcoin as decades away.<\/p>\n\n\n\n

Indeed, the estimates from Bitcoin developers and industry personnel in terms of when quantum computing will pose a genuine threat range are wide, and some refer to quantum computing as an outright scam<\/a>. In a recent discussion<\/a> on quantum resistance on the Bitcoin Development Mailing List, estimates ranged from a decade or two to \u201cnot in my lifetime.\u201d<\/p>\n\n\n\n

Despite this, there is a growing call for the issue to be taken seriously right now, as recent advancements indicate further progress may just be a matter of time at this point. \u201cI think today the message needs to be: yes, unequivocally, worry about this now,\u201d theoretical computer scientist Scott Aaronson recently wrote<\/a>. \u201cHave a plan.\u201d<\/p>\n\n\n\n

\"Quantum
The total number of unsafe Bitcoin is not as great as you might think. (Deloitte)<\/em><\/figcaption><\/figure>\n\n\n\n

The good news is that around 75% of all Bitcoin wallets are already safe from potential attacks due to the type of Bitcoin address they are stored in, according to a previous study<\/a> from accounting giant Deloitte. Specifically, P2PK addresses and reused P2PKH addresses are the types of addresses that are vulnerable to quantum attacks. Of course, non-reused P2PKH addresses would also become vulnerable as quantum computers become more powerful because their signed transactions can be viewed in the mempool before they are confirmed (assuming the transactions aren\u2019t made out of band and sent directly to a miner).

That said, there is already at least one in-development proposal for upgrading Bitcoin to address this threat.<\/p>\n\n\n\n

Bitcoin\u2019s quantum resistance: Current protection and future solutions<\/h2>\n\n\n\n

There are two key areas of concern around algorithms that are built specifically for use with quantum computers that give them massive gains over current methods for breaking encryption found with traditional computers. <\/p>\n\n\n\n

One of these is called Grover\u2019s algorithm and could be used via a quantum computer to gain an insurmountable advantage in the Bitcoin mining process and completely centralize Bitcoin\u2019s accounting system to the point where the network can effectively be attacked or censored via a 51% attack. Secondly, Shor\u2019s algorithm can be used on certain types of Bitcoin signature schemes to steal funds held in addresses. Shor\u2019s algorithm provides exponential gains as compared to traditional methods and is the more immediate threat.<\/p>\n\n\n\n

Notably, it is possible for Bitcoin wallets to prepare for the threat posed to Bitcoin address security today without having to make any changes to Bitcoin\u2019s consensus rules, which is known to be a rather slow and difficult process. A soft fork would eventually be necessary to eventually activate a consensus rule change for quantum resistance on the network. However, preparations can be made long before any quantum threat to Bitcoin is apparent.<\/p>\n\n\n\n

The process would be for wallets to start having an additional, quantum-secure signature scheme deployed in wallet software over the near term. Then, the nodes on the Bitcoin network could disable the previous, quantum-vulnerable signature schemes and require the new, quantum-resistant schemes to be used via a soft fork once the threat of quantum computers is imminent.<\/p>\n\n\n\n

QuBit: Bitcoin\u2019s proposed quantum-resistant upgrade explained<\/strong><\/h2>\n\n\n\n

A draft Bitcoin Improvement Proposal (BIP) known as QuBit<\/a> by the pseudonymous Hunter Beast introduces a new address type, Pay to Quantum Resistant Hash (P2QRH), which uses various quantum-resistant signature schemes to protect against attacks leveraging Shor\u2019s algorithm. The new address type could come with a 16x discount in terms of block space costs, providing an economic incentive for users to move over to the quantum-resistant addresses. A similar economic incentive was previously used to promote the adoption of Segregated Witness addresses on the network.<\/p>\n\n\n\n

The QuBit plan involves four stages: a quantum-resistant address standard, a Taproot-compatible quantum-resistant address standard, a soft fork and a quantum-secure address standard.<\/p>\n\n\n\n

Hunter Beast\u2019s work on P2QRH has been funded by Surmount Systems, which is an initiative to protect Bitcoin from potential threats related to quantum computing. P2QRH addresses make a quantum attack on a particular address uneconomical rather than impossible, similar to the role proof-of-work mining plays in Bitcoin.<\/p>\n\n\n\n

According to Hunter Beast, making addresses fully quantum secure would require further deployment of quantum computing hardware among Bitcoin users. However, this upgrade could also eventually be soft-forked in at a later date. Further protections for the mining process would be even further down the line and not viewed as a relevant consideration at this time.<\/p>\n\n\n\n

\"Meet
Meet the Quantum resistance. (GitHub\/cryptoquick)<\/em><\/figcaption><\/figure>\n\n\n\n

Notably, P2QRH does not implement a specific quantum-resistant hashing algorithm. Instead, users are able to choose from a few different supported standards, including SPHINCS+-256f and FALCON-1024. Quantum-resistant signature schemes are still relatively new and unproven, so it\u2019s difficult to pin down the best option for integration into Bitcoin. Additionally, the most trusted signature schemes also tend to be the largest, which could introduce new scalability issues.<\/p>\n\n\n\n

Alternative solutions: OP_CAT and STARK-based protection<\/strong><\/h2>\n\n\n\n

There is also the potential for new opcodes, such as OP_CAT, which is a previously deactivated opcode that some developers would like to see reactivated on Bitcoin to enable quantum-resistant addresses on Bitcoin. <\/p>\n\n\n\n

Blockstream\u2019s Jonas Nick recently published code for an experimental tool that could be used to generate quantum-resistant signatures using opcodes that could potentially be reactivated via the Great Script Restoration proposal. However, like any change to Bitcoin, OP_CAT could be seen as controversial, and there are potential centralization concerns related to the enabling of maximum extractable value (MEV)<\/a> associated with it.<\/p>\n\n\n\n

\u201cOP_CAT can be used to implement post-quantum cryptography on Bitcoin, but it would be horribly inefficient from a transaction size perspective,\u201d Hunter Beast tells Magazine.<\/p>\n\n\n\n

OP_CAT co-author Ethan Heilman agrees that Beast\u2019s proposal is likely to be implemented before the problem arises. \u201cHaving OP_CAT deployed would be a helpful tool during a cryptographic crisis. That said, I think we should, and likely will, solve this problem with dedicated quantum resistant outputs, such as QuBit (BIP-360), well before any such crisis arises.\u201d<\/p>\n\n\n\n

\"Bitcoin
Bitcoin researcher Ethan Heilman. (LinkedIn)<\/em><\/figcaption><\/figure>\n\n\n\n

There are trade-offs made with QuBit, such as an effective lowering of Bitcoin\u2019s onchain transaction capacity, but many consider this as more acceptable due to it acting as a strict security gain. Due to the larger size of quantum-resistant transactions, there have also been discussions around potentially combining the addition of quantum-resistant signatures with a block size increase. <\/p>\n\n\n\n

There is also the possibility of using Scalable Transparent ARguments of Knowledge (STARKs), which is zero-knowledge (ZK) proof technology, as another route for bringing quantum resistance to Bitcoin, which would come with added privacy and scalability benefits. This functionality could be enabled via OP_CAT or another opcode specifically for verifying ZK-proofs.<\/p>\n\n\n\n

\u201cSTARK support in Bitcoin could let miners non-interactively aggregate quantum resistant signatures into a single STARK, replacing the signatures with a single STARK,\u201d Heilman told Magazine.<\/p>\n\n\n\n

\n

This would eliminate the main drawback of such signature schemes and could also have privacy benefits. Many people, myself included, are looking into this, but this work is still early, and such changes are not very simple or easy.\u201d<\/p>\n<\/blockquote>\n\n\n\n

That said, STARKs are more practical for more flexible and malleable crypto systems, such as Ethereum or Solana. Indeed, Ethereum creator Vitalik Buterin has previously opined on the use of STARKs in a quantum emergency.<\/p>\n\n\n\n

In terms of the potential of using STARKs or other methods for quantum computing resistance even for non-upgraded addresses (as Buterin has outlined), Hunter Beast states, \u201cIt might be possible . . . The only problem with this approach is that while adding ZK opcodes is a soft fork, there\u2019ll likely be little agreement on which ones to add, and even if there is, for it to work. They would also need to disable all transactions that aren\u2019t made with modern HD wallets (ones that accept mnemonic seeds and produce new addresses each time they\u2019re used). A hardcoded private key won\u2019t work, and it\u2019s also uncertain how that would work with multisig. So, no, it\u2019s not really practical to do that.\u201d<\/p>\n\n\n\n

Bitcoiners value stability and consistency, so change is likely to be slow and gradual. But with preparations already being made despite no clear threat, it\u2019s likely this is an issue that can be dealt with in a timely fashion.

The reality of the potential threat quantum computing poses to Bitcoin was recently summarized<\/a> well by Blockstream CEO Adam Back on X: \u201cI think quantum readiness is the right balance \u2013 not like there is any current risk, nor likely for this decade, or probably the next,\u201d said Back. \u201cBut being ready is ok.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

A very good review of where we are with the threat to Bitcoin posed by Quantum computers. In simple terms, a lot of cryptography deals with large prime numbers multiplied together which on modern computers happens quite fast, but going the other way to find those numbers is far from fast. This is the threat […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-10350","post","type-post","status-publish","format-standard","hentry","category-tech"],"blocksy_meta":[],"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/10350","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=10350"}],"version-history":[{"count":4,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/10350\/revisions"}],"predecessor-version":[{"id":10355,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/10350\/revisions\/10355"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=10350"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=10350"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=10350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}