Understanding Quantum Computing's Potential Impact on Bitcoin

Coinbase’s Head of Investment Research, David Duong, highlights the looming risks posed by advancements in quantum computing, which extend beyond just the security of Bitcoin’s private keys, potentially affecting the economic and security frameworks of the entire network. Despite these concerns, he emphasizes that the current capabilities of quantum technology are not yet a threat to Bitcoin's cryptographic security, indicating these challenges are more of a long-term issue rather than an immediate concern.

Key Takeaways

Advances in quantum computing could threaten Bitcoin's security in the future but are not an immediate concern.
The main risks center around potential long-range and short-range attacks on Bitcoin transactions.
Strategies for mitigating quantum risks include integrating post-quantum cryptography and adopting safe practices for key management.
Experts suggest that while risks are real, they remain on the horizon rather than a pressing issue.

The Twin Threats Facing Bitcoin

In an in-depth analysis, Duong noted that one primary risk will emerge on a day often called "Q-day." This refers to a future point in time when quantum computers may have the power to breach Bitcoin’s cryptographic defenses using advanced algorithms such as Shor’s and Grover’s.

Duong explained that Bitcoin's security is founded on two crucial cryptographic elements: ECDSA, which protects transaction signatures and ownership, and SHA-256, essential for proof-of-work mining and maintaining the integrity of the blockchain. He stated, "That means quantum computers actually pose two separate threats."

He highlighted that quantum-capable systems could jeopardize the cryptographic protections of private keys, increasing the risk of unauthorized spending from Bitcoin addresses that are vulnerable. This signature-related danger can be divided into two categories:

Long-range attacks against Bitcoin outputs with public keys already exposed on the blockchain.
Short-range attacks that could preemptively attack transactions as public keys surface in the mempool.

Currently, Duong estimates that about 6.51 million Bitcoin, or approximately 32.7% of total supply, could be susceptible to such long-range quantum attacks as of block 900,000. This exposure mainly arises from repetitive address usage and specific scripting formats that disclose public keys directly on the blockchain, such as Pay-to-Public-Key (P2PK), bare multisignature (P2MS), and Taproot (P2TR). Many older outputs, especially from the early days of Bitcoin (the Satoshi era), contribute to this vulnerability.

"Every output is vulnerable to short-range attacks at the moment of spending, which elevates the urgency of a comprehensive transition towards quantum-resistant signatures even if the immediate chance of attack is relatively low," Duong emphasized.

Beyond concerns about key security, Duong noted that quantum-enabled mining could enhance mining efficiencies, posing challenges to Bitcoin’s existing consensus economics and network security. "We believe quantum mining remains a lower-priority concern for now due to scaling restrictions, so the focus should be on migrating signatures," he explained.

Preparing Bitcoin for Quantum Threats

In the latter part of his discussion, Duong outlined several strategies to alleviate risks associated with quantum technology. The most important approach involves the long-term integration of post-quantum cryptography into the Bitcoin network, utilizing algorithms designed to resist quantum attacks. He mentioned the US National Institute of Standards and Technology's shortlist of potential post-quantum cryptographic standards, which includes CRYSTALS-Dilithium, SPHINCS+, and FALCON.

Additionally, Duong referenced research from Chaincode Labs that proposes two potential avenues for Bitcoin in the event of a quantum breakthrough. Should a rapid advancement occur, an emergency migration plan might need to be implemented within two years. However, if advancements are gradual, a longer-term strategy would involve adopting quantum-resistant signatures through a soft fork, potentially taking up to seven years. This timeline considers practical challenges like larger signature sizes, slower verification processes, and the adjustment needed in wallets, nodes, and fee markets.

Other technical proposals, such as BIP-360, BIP-347, and Hourglass, also aim to tackle the quantum threat.

"Best practices suggest avoiding address reuse, transferring at-risk UTXOs to unique destinations, and creating client-facing documents to implement quantum-ready operations. This approach is supported by current knowledge that vulnerable scripts are not actively being used, and setting limits on funds per address can reduce concentration risk," he stated.

Finally, Duong clarified that quantum computing should not be regarded as an "imminent threat." This opinion is supported by various industry experts, including Jameson Lopp from Casa, Adam Back of Blockstream, and Charles Hoskinson from Cardano, who agree that while quantum risks are a genuine concern, they are not urgent.

Nonetheless, caution remains. David Carvalho from Naoris Protocol warns that potential compromises could emerge within 2–3 years, and the Quantum Doomsday Clock project even speculates that Bitcoin's encryption may be at risk of breaking by March 8, 2028.