MIME-Version: 1.0
From: Tristan Hoy <tristan.hoy@gmail.com>
Date: Tue, 13 Feb 2018 01:13:11 +1100
Message-ID: <CAFEpHQHP7XXBYUP6CF1OeYoBpj0UwK+qpYG-14_zQZDX4Md7UA@mail.gmail.com>
To: bitcoin-dev@lists.linuxfoundation.org
Content-Type: multipart/alternative; boundary="f403045ec64672bd810565047a51"
Subject: [bitcoin-dev] Transition to post-quantum
Precedence: list

--f403045ec64672bd810565047a51
Content-Type: text/plain; charset="UTF-8"

Hi all,

Recently I've been exploring what a post-quantum attack on Bitcoin would
actually look like, and what options exist for mitigating it.

I've put up a draft of my research here:
https://medium.com/@tristanhoy/11271f430c41

In summary:
1) None of the recommended post-quantum DSAs (XMSS, SPHINCS) are scalable
2) This is a rapidly advancing space and committment to a specific
post-quantum DSA now would be premature
3) I've identified a strategy (solution 3 in the draft) that mitigates
against the worst case scenario (unexpectedly early attack on ECDSA)
without requiring any changes to the Bitcoin protocol or total committment
to a specific post-quantum DSA that will likely be superseded in the next
3-5 years
4) This strategy also serves as a secure means of transferring balances
into a post-quantum DSA address space, even in the event that ECDSA is
fully compromised and the transition is reactionary

The proposal is a change to key generation only and will be implemented by
wallet providers.

Feedback would be most appreciated.

Regards,

Tristan

--f403045ec64672bd810565047a51
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi all,<div><br></div><div>Recently I&#39;ve been explorin=
g what a post-quantum attack on Bitcoin would actually look like, and what =
options exist for mitigating it.</div><div><br></div><div>

<span style=3D"color:rgb(34,34,34);font-family:arial,sans-serif;font-size:s=
mall;font-style:normal;font-variant-ligatures:normal;font-variant-caps:norm=
al;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;t=
ext-transform:none;white-space:normal;word-spacing:0px;background-color:rgb=
(255,255,255);text-decoration-style:initial;text-decoration-color:initial;f=
loat:none;display:inline">I&#39;ve put up a draft of my research here:=C2=
=A0<a href=3D"https://medium.com/@tristanhoy/11271f430c41">https://medium.c=
om/@tristanhoy/11271f430c41</a></span>

<br></div><div><br></div><div>In summary:</div><div>1) None of the recommen=
ded post-quantum DSAs (XMSS, SPHINCS) are scalable<br></div><div>2) This is=
 a rapidly advancing space and committment to a specific post-quantum DSA n=
ow would be premature</div><div>3) I&#39;ve identified a strategy (solution=
 3 in the draft) that mitigates against the worst case scenario (unexpected=
ly early attack on ECDSA) without requiring any changes to the Bitcoin prot=
ocol or total committment to a specific post-quantum DSA that will likely b=
e superseded in the next 3-5 years</div><div>4) This strategy also serves a=
s a secure means of transferring balances into a post-quantum DSA address s=
pace, even in the event that ECDSA is fully compromised and the transition =
is reactionary</div><div><br></div><div>The proposal is a change to key gen=
eration only and will be implemented by wallet providers.</div><div><br></d=
iv><div>Feedback would be most appreciated.</div><div><br></div><div>Regard=
s,</div><div><br></div><div>Tristan</div></div>

--f403045ec64672bd810565047a51--