From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Sun, 20 Jul 2025 10:48:33 -0700 Received: from mail-yb1-f188.google.com ([209.85.219.188]) by mail.fairlystable.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1udY9J-0006rf-1v for bitcoindev@gnusha.org; Sun, 20 Jul 2025 10:48:33 -0700 Received: by mail-yb1-f188.google.com with SMTP id 3f1490d57ef6-e72b0980138sf5336108276.1 for ; Sun, 20 Jul 2025 10:48:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1753033707; x=1753638507; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-sender:mime-version :subject:references:in-reply-to:message-id:to:from:date:sender:from :to:cc:subject:date:message-id:reply-to; bh=u+eM1zu+Z7qvmHkVqZHft07Fsm/ypP11+6/YSLIfcvU=; b=EnjYqbxOYAGkeXs9ojOTOjzxzfMBTAcztLl/mdydX1/wZ6qMWCO79WRtlBWROoMfKv uPG6nkHotNbIi3/fYradsrpIKvAYpC+m99toBO/hbNYdDU4az0JY6J+OAYh6kASrS2hD OQ+MsLEREVnXhtRuk/bez/Cac/fIGR8PARcbAfpKOYl9gBhFjdygl4pHmOvq5djvnftt b3+Z0QioPCIPDlH8Lk7zPBgCjAW3kIcpf7EwY4SF6pwgIyQnEga5Hnse9f8YK04kh4Uo cPbi/yK4GFbGWu7F4325oyS4efnfsSPBTp2OyHEpeUt1GAYiXV/YgmG/J249zte86agN GY/Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups-com.20230601.gappssmtp.com; s=20230601; t=1753033707; x=1753638507; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-sender:mime-version :subject:references:in-reply-to:message-id:to:from:date:from:to:cc :subject:date:message-id:reply-to; bh=u+eM1zu+Z7qvmHkVqZHft07Fsm/ypP11+6/YSLIfcvU=; b=naDTuG9laElTD8mUycMG14w8YpWXDlJYyEvYz5w1XJKgnIjXhQp5RvU5pEzk9dUqJm +W6QkLpQG3XkQRBnN5trGDscJAbLiXr50QAP+8XbqAfBM4xol4FE13TsHNg8lO2Y7x2R q6VrROPcGpAyYKh+e34+V7REpnh/0Yn0VtVRSjPsv47f2Cg2fKhFj+aZMwWTF7DcJRN6 ULY9S5/cHmjLvkkI+wm0A9bY1Jn/JFYSMPkV0aGrTvP1XOTavQMe1bBbx9Da6d7DyVJU xvvhiIhvvFgEOk9h9GNzEJXtzKSQGZgg3unLVP6kv0xQvdD7r3NitaXawH/woleEYi0C 0ZYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1753033707; x=1753638507; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-sender:mime-version :subject:references:in-reply-to:message-id:to:from:date:x-beenthere :x-gm-message-state:sender:from:to:cc:subject:date:message-id :reply-to; bh=u+eM1zu+Z7qvmHkVqZHft07Fsm/ypP11+6/YSLIfcvU=; b=MwCaMSJChNwiQ/gZ4jQ8x5b6pKlyFEOBX2TknFv6uVFcf/OLqpcvWFoNuRG87npqT1 LGcWuFq8ULT9Rz0KtegyJAdYLJ1Iyllfugc0nRWxJCSPZpGJty1cG+zh8gcKN4KqrYlZ 4uKecPchtwTpzDKxibU2DnzjgjTtPKGFmhYhMKeYiaVVK4cpAOvVirhRMNYtA0q7fkAh 0S8cjSgwze6ry+uwxGZ81kaLeaH3chSclCH4LmEDYjEkhYt5JBsJ3dGX0UBSi6GtNjoN pNoTKx8ogf5qhN+Gdme6sulF1rf2d1Hp7qlYmA8JyezGbrgdsHgmCN9GfT68EVlpCw7w 33ug== Sender: bitcoindev@googlegroups.com X-Forwarded-Encrypted: i=1; AJvYcCUvMNBpbDZA3Ag7wxBi+llQ5wF4vy2cDQ60gUwFMZEvmbjv1FzR16WdUEOxcd7tQyjH0z0VREX3GmRf@gnusha.org X-Gm-Message-State: AOJu0YyJ3opO4j/yYxGlmXemvUASHhR8kCKoN3pOb0VDLUB/RzrjHfZa 9Idvr78TTATz1d5+ICtRRPGLVk/QHqhWNK3eCY3HavlmUHHbIVvQlFf8 X-Google-Smtp-Source: AGHT+IGkhcupD7VdSXpe3RtaRR0SaQjOS7XPqIfE5pGXWljNOsnWVVeebaaXSZcpl76KDbShdBH2Dg== X-Received: by 2002:a05:6902:2005:b0:e87:b0fc:479 with SMTP id 3f1490d57ef6-e8bc24398demr22072862276.5.1753033706935; Sun, 20 Jul 2025 10:48:26 -0700 (PDT) X-BeenThere: bitcoindev@googlegroups.com; h=AZMbMZf5FDT2yhHC1PH/4MXjey+liBk1z20iiliUjyE4WsScGQ== Received: by 2002:a05:6902:610c:b0:e82:492d:12c with SMTP id 3f1490d57ef6-e8bd449aa55ls3748275276.0.-pod-prod-06-us; Sun, 20 Jul 2025 10:48:22 -0700 (PDT) X-Received: by 2002:a05:690c:b96:b0:70e:6333:64ac with SMTP id 00721157ae682-718370b0d82mr231714127b3.10.1753033702157; Sun, 20 Jul 2025 10:48:22 -0700 (PDT) Received: by 2002:a05:690c:3147:b0:710:fccf:6901 with SMTP id 00721157ae682-7194e37fa7ams7b3; Sun, 20 Jul 2025 10:39:49 -0700 (PDT) X-Received: by 2002:a05:690c:48c4:b0:70e:2c7f:2ed4 with SMTP id 00721157ae682-7183691b3bcmr231613007b3.0.1753033187977; Sun, 20 Jul 2025 10:39:47 -0700 (PDT) Date: Sun, 20 Jul 2025 10:39:47 -0700 (PDT) From: Marin Ivezic To: Bitcoin Development Mailing List Message-Id: <1e39e6bd-8da4-45b1-9dc9-feacd923417dn@googlegroups.com> In-Reply-To: References: <37ed2e5d-34cd-4391-84b8-5bcc6d42c617n@googlegroups.com> <4d9ce13e-466d-478b-ab4d-00404c80d620n@googlegroups.com> Subject: Re: [bitcoindev] Re: A Post Quantum Migration Proposal MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_246690_1416585505.1753033187207" X-Original-Sender: marin@appliedquantum.com Precedence: list Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com List-ID: X-Google-Group-Id: 786775582512 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Score: -0.7 (/) ------=_Part_246690_1416585505.1753033187207 Content-Type: multipart/alternative; boundary="----=_Part_246691_2133930374.1753033187207" ------=_Part_246691_2133930374.1753033187207 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Even a year ago it was totally fair to question the feasibility of CRQCs.= =20 After all the recent scientific and engineering wins, that is not in=20 question anymore. Eventual arrival of CRQC is pretty much a consensus now= =20 in quantum and cyber communities. But that question is almost irrelevant now. The world is acting like CRQCs= =20 are coming, so we should act like it too. Regulators and governments are=20 issuing quantum readiness roadmaps, banks have started their programs,=20 insurers are carving out quantum risks, shareholders and analysts are=20 questioning quantum readiness on earnings calls=E2=80=A6 and the media is e= ating it=20 all up. The general public awareness is rapidly growing. Rightly or wrongly, users will soon expect to see some assurances or plans= =20 on how bitcoin will resist the quantum threat. And if our response is that= =20 a few on the list think CRQC are laughable, the confidence will take a big= =20 hit. The proposed BIP makes lots of sense. With that and BIP-360, a plan is=20 shaping. And then we need three almost independent discussions: 1. We could technically solve Phase C (Post-Quantum Legacy Recovery) for=20 any impacted BIP-39 wallets. This is the (relatively) easy one. 2. How do we make it all a bit more =E2=80=9Ccrypto-agile=E2=80=9D? 3. And finally the philosophical discussion on how to treat legacy non-HD= =20 wallets - burn them or allow them to be =E2=80=9Cstolen=E2=80=9D / =E2=80= =9Cliberated=E2=80=9D. Best,=20 Marin On Sunday, July 20, 2025 at 6:07:01=E2=80=AFPM UTC+2 conduition wrote: > Hi Peter, > > I think everyone here is well-aware of the possibility > that CRQCs may not ever appear, but that doesn't change > the fact we must have a plan ready to handle them. Lopp's > proposal does exactly that, and in a way that can be > rolled out incrementally as the risk increases. And even > if CRQCs never break discrete log, we would do well to > invest the time in designing this migration path anyway. > We'd then have a playbook to handle other sources of > cryptanalytic breakthroughs in the future. > > I think you're worried the community may jump the gun and > deploy a freezing upgrade like phases A or B too early. I > share your concern but if anything I suspect the opposite > will happen. Nobody is going to be willing to freeze > anything unless imminent danger is readily apparent, and > fear-based reactions kick in. > > Once it does, things will happen fast, and we need a plan > ready for that day (if it comes). > > regards, > conduition > > > > On Saturday, July 19th, 2025 at 8:13 AM, Peter Todd = =20 > wrote: > > > On Mon, Jul 14, 2025 at 02:52:17PM -0400, Jameson Lopp wrote: > > > > > Correct, this time is different in that we're not talking about vague > > > unknown weaknesses. Rather, we're talking about a known algorithm tha= t > > > makes breaking cryptographic primitives orders of magnitude cheaper. > > > > > > We already have known algorithms that would break cryptographic=20 > primitives if > > sufficiently good analog computers actually existed. Or for that matter= ,=20 > "split > > the universe" brute forcing. No-one is worried about them because=20 > "sufficiently > > good" analog computers and multiverses are widely belived to not be=20 > physically > > realizable. > > > > For all the claims of progress on quantum computing hardware, the fact= =20 > still > > remains that no-one is even close to demonstrating cryptographic-releva= nt > > quantum computing capabilities and the actual cryptographic-relevant > > capabilities of real hardware are laughable. It's still an unknown=20 > whether or > > not they are physically possible, and outside of the part of the physic= s > > community that would like to sell you a quantum computer - or research > > developing one - they're widely belived to be not physical. > > > > Hence, these are still vague unknown weaknesses. Until progress is less= =20 > vague, > > actively freezing peoples' coins is not going to happen. > > > > -- > > https://petertodd.org 'peter'[:-1]@petertodd.org > > > > -- > > You received this message because you are subscribed to the Google=20 > Groups "Bitcoin Development Mailing List" group. > > To unsubscribe from this group and stop receiving emails from it, send= =20 > an email to bitcoindev+...@googlegroups.com. > > To view this discussion visit=20 > https://groups.google.com/d/msgid/bitcoindev/aHuKIKqvCZl5rcEX%40petertodd= .org > . --=20 You received this message because you are subscribed to the Google Groups "= Bitcoin Development Mailing List" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoindev+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/= 1e39e6bd-8da4-45b1-9dc9-feacd923417dn%40googlegroups.com. ------=_Part_246691_2133930374.1753033187207 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Even a year ago it was totally fair to question the feasibility of CRQCs. After all the recent scientific and engineering wins, that is not in question anymore. Eventual arrival of CRQC is pretty much a consensus now i= n quantum and cyber communities.

But that question is almost irrelevant now. The world is acting like CRQ= Cs are coming, so we should act like it too. Regulators and governments are is= suing quantum readiness roadmaps, banks have started their programs, insurers are carving out quantum risks, shareholders and analysts are questioning quantum readiness on earnings cal= ls=E2=80=A6 and the media is eating it all up. The general public awareness is rapidly growing.

Rightly or wrongly, users will soon expect to see some assurances or pla= ns on how bitcoin will resist the quantum threat. And if our response is that a few on the li= st think CRQC are laughable, the confidence will take a big hit.

The proposed BIP makes lots of sense. With that and BIP-360, a plan is s= haping. And then we need three almost independent discussions:
1. We c= ould technically solve Phase C (Post-Quantum Legacy Recovery) for any impacted BIP-39 wallets. This is the (relatively) easy one.
2. How do = we make it all a bit more =E2=80=9Ccrypto-agile=E2=80=9D?
3. And final= ly the philosophical discussion on how to treat legacy non-HD wallets - burn them or allow them to be =E2=80=9Cstolen=E2=80= =9D / =E2=80=9Cliberated=E2=80=9D.

Best,=C2=A0
Marin
On Sunday, July 20, 2025= at 6:07:01=E2=80=AFPM UTC+2 conduition wrote:
Hi Peter,

I think everyone here is well-aware of the possibility
that CRQCs may not ever appear, but that doesn't change
the fact we must have a plan ready to handle them. Lopp's
proposal does exactly that, and in a way that can be
rolled out incrementally as the risk increases. And even
if CRQCs never break discrete log, we would do well to
invest the time in designing this migration path anyway.
We'd then have a playbook to handle other sources of
cryptanalytic breakthroughs in the future.

I think you're worried the community may jump the gun and
deploy a freezing upgrade like phases A or B too early. I
share your concern but if anything I suspect the opposite
will happen. Nobody is going to be willing to freeze
anything unless imminent danger is readily apparent, and
fear-based reactions kick in.

Once it does, things will happen fast, and we need a plan
ready for that day (if it comes).

regards,
conduition



On Saturday, July 19th, 2025 at 8:13 AM, Peter Todd <pe...@petertodd.org> wrote:

> On Mon, Jul 14, 2025 at 02:52:17PM -0400, Jameson Lopp wrote:
>
> > Correct, this time is different in that we're not talking= about vague
> > unknown weaknesses. Rather, we're talking about a known a= lgorithm that
> > makes breaking cryptographic primitives orders of magnitude c= heaper.
>
>
> We already have known algorithms that would break cryptographic pr= imitives if
> sufficiently good analog computers actually existed. Or for that m= atter, "split
> the universe" brute forcing. No-one is worried about them bec= ause "sufficiently
> good" analog computers and multiverses are widely belived to = not be physically
> realizable.
>
> For all the claims of progress on quantum computing hardware, the = fact still
> remains that no-one is even close to demonstrating cryptographic-r= elevant
> quantum computing capabilities and the actual cryptographic-releva= nt
> capabilities of real hardware are laughable. It's still an unk= nown whether or
> not they are physically possible, and outside of the part of the p= hysics
> community that would like to sell you a quantum computer - or rese= arch
> developing one - they're widely belived to be not physical.
>
> Hence, these are still vague unknown weaknesses. Until progress is= less vague,
> actively freezing peoples' coins is not going to happen.
>
> --
> https://petertodd.org 'peter'[:-1]@= petertodd.org
>
> --
> You received this message because you are subscribed to the Google= Groups "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, = send an email to bitcoindev+...@= googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/aHuKIKqv= CZl5rcEX%40petertodd.org.

--
You received this message because you are subscribed to the Google Groups &= quot;Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoind= ev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoind= ev/1e39e6bd-8da4-45b1-9dc9-feacd923417dn%40googlegroups.com.
------=_Part_246691_2133930374.1753033187207-- ------=_Part_246690_1416585505.1753033187207--