Skip to content

BIP-360: QuBit - Pay to Quantum Resistant Hash #1670

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 49 commits into
base: master
Choose a base branch
from

Conversation

cryptoquick
Copy link

This spent several months gathering feedback from the mailing list and from other advisors. This is hopefully polished enough to submit upstream.

Let me know if you have any questions or feedback, and of course feel free to submit suggestions.

Thank you for your time.

@cryptoquick cryptoquick marked this pull request as draft September 27, 2024 18:18
Copy link
Member

@jonatack jonatack left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting (the question of resistance to quantum computing may have resurged lately with the publication of https://scottaaronson.blog/?p=8329, see also https://x.com/n1ckler/status/1839215426091249778).

@cryptoquick cryptoquick force-pushed the p2qrh branch 2 times, most recently from b6ed2c3 to d6d15ad Compare September 28, 2024 18:01
@jonatack
Copy link
Member

jonatack commented Oct 1, 2024

@cryptoquick Can you begin to write up the sections currently marked as TBD, along with a backwards compatibility section (to describe incompatibilities, severity, and suggest mitigations, where applicable/relevant)? We've begun to reserve a range of BIP numbers for this topic, pending continued progress here.

@jonatack jonatack added the PR Author action required Needs updates, has unaddressed review comments, or is otherwise waiting for PR author label Oct 9, 2024
@jonatack
Copy link
Member

@cryptoquick ping for an update here. Have you seen https://groups.google.com/g/bitcoindev/c/p8xz08YTvkw / https://github.com/chucrut/bips/blob/master/bip-xxxx.md? It may be interesting to review each other and possibly collaborate.

@jonatack
Copy link
Member

jonatack commented Mar 13, 2025

@cryptoquick I re-read through the review feedback of the past four months, but it is difficult and laborious to try to understand what you did to concretely address each comment.

Would you please indicate in response to each comment the link to the commit patch with the relevant change you made, and particular for the review feedback from @jonasnick and @vostrnad above?

There is also review feedback marked as resolved, but without a reply. Please help reviewers connect the dots :)

Those pointers would be very helpful, I think, in determining what was done and/or remains to be done in response, and would aid review.

@cryptoquick
Copy link
Author

@jonatack Thank you for the advice! I went back and did my best to provide some links to the relevant changes. Hope that helps.

Also, I've made a note to address this concern I overlooked:

https://github.com/bitcoin/bips/pull/1670/files#r1994349769

I'd appreciate any thoughts you have on that. Thanks!

…ch from merkle tree commitment to sorted vector hash commitment.
@cryptoquick
Copy link
Author

In the above changeset I rethought how we do the SegWit v3 scriptPubKey hash commitment... I think the merkle tree is nonsense at this point, since it cannot be sparse because all public key hashes must be known in advance in order to compute a complete commitment. Even in selective disclosure, all hashes have to be provided. @EthanHeilman originally suggested the merkle tree to me, so maybe there's something I'm missing, but for now I'm going back to concatenated hashes. Hopefully this simplifies the BIP a bit, also.

I also made sure we're more declarative of keytypes and thresholds in the attestation because bytes there will be cheap, especially if there's an increased attestation discount. The reason the attestation exists is because it can be discounted separately and its functionality limited to fixed signature operations.

@cryptoquick
Copy link
Author

In the above changeset I also updated the descriptor format to show a more complete example of how I expect selectively disclosed threshold multisigs to work.

@QbitsCode
Copy link

Is there somethin in a horizon, how can we reflect the current progression in percent. A clarfication meeting was requested to accelerate finalizing pqcBitcoin but no feedback.

@cryptoquick
Copy link
Author

@QbitsCode A community call isn't a bad idea. If there is one, we'll most likely announce it in our Telegram group.

Copy link
Contributor

@murchandamus murchandamus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

People appear to agree conceptually that we should be looking into PQ, but skimming the conversation on this PR, I must admit that I am a bit concerned regarding the seeming lack of approach buy-in.

There seem to be concerns about e.g., introducing too many different PQ Signature schemes introducing unnecessary complexity, the resulting scheme dropping support for existing features, and uncertainty about the properties of the attestation structure's properties. It also seems to me that it is not clear to me what the priority is:
If this is developing an emergency PQ-response that might be deployed on short notice, it would seem that going for less complexity would be fruiltful. If we are going for a fully-fledged, comprehensive response to PQ, it should e.g., not gratuitously drop support for scripting in outputs—don’t we still want HTLCs in a PQ future?

While you are reconsidering the structure of the attestation, perhaps it would be good to take another step back and collect more input on the big picture design goals before jumping back into the tweaking details of another variant of the same approach.

@cryptoquick
Copy link
Author

Thanks for chiming in once more, Murch.

There seem to be concerns about e.g., introducing too many different PQ Signature schemes introducing unnecessary complexity

You have good timing with this, since I just published libbitcoinpqc, which should be a one-stop shop focal point for PQC needed for BIP-360, similar to how libsecp256k1 was for BIP-340. You can check out that work here:
https://github.com/cryptoquick/libbitcoinpqc

The algorithmic complexity shouldn't be so bad now that it's abstracted in a useful way.

If we are going for a fully-fledged, comprehensive response to PQ, it should e.g., not gratuitously drop support for scripting in outputs—don’t we still want HTLCs in a PQ future?

I'm not dropping support for witness scripts. The attestation is just like putting additional locks on coins in an address, in addition to whatever is expected to happen in the witness. I expect this to be compatible with a lot that's already been developed for Lightning and Taproot. I would like to verify that in practice however. A good start to that would be post quantum-flavored versions of rust-bitcoin, BDK, and LDK.

While you are reconsidering the structure of the attestation, perhaps it would be good to take another step back and collect more input on the big picture design goals before jumping back into the tweaking details of another variant of the same approach.

Perhaps, but another alternative is to put the work needed into proving out this design. There's too many variables to consider without something concrete to work from and think about. I'm definitely willing to do that in order to prove that BIP-360 works in various scenarios.

Comment on lines 390 to 392
This design maintains compatibility for [https://github.com/bitcoin/bips/blob/master/bip-0114.mediawiki BIP-114]
Taproot Merkelized Alternative Script Tree (MAST) merkle root in the commitment, which makes P2QRH a
quantum-resistant version of Taproot transactions. The TapScript itself must however be provided in the witness,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you mean to refer to BIP 341 here?

masoudahg00

This comment was marked as spam.

Welbert5753

This comment was marked as spam.

@bitcoin bitcoin deleted a comment from masoudahg00 Apr 5, 2025
@mraksoll4
Copy link

the idea itself is quite simple, we have a separate address, a separate storage of keys, a double signature. In the case of old wallets ignore the new pq signature when verify, new ones read both.

but we will most likely have to forgot about derevation logic in new address type atleast for now, yes it will make the wallet file thicker, and the blockchain will become thicker. But it will provide additional security, also do not forget that unlike the same ETH, Bitcoin blockchain can be kept on HDD without problems and pruned, when ETH only requires super fast SSD.. and there pq signatures will be real problem.

@junaga

This comment was marked as off-topic.

@jonatack
Copy link
Member

@cryptoquick any update here?

@cryptoquick
Copy link
Author

@jonatack I'm waiting for Ethan to finish his rewrite before adding new changes. Please bear with us, the wait will be worth it!

@junaga

This comment has been minimized.

@junaga

This comment was marked as duplicate.

@cryptoquick
Copy link
Author

@EthanHeilman has joined the chat.
cryptoquick#21
It's a big change, so I recommend reviewing the PR separately.
Any suggestions, especially answers to the questions / open checkmarks would be helpful, thanks!

* Rewrote rationale

* Fix bolded principles

* Actually fix bold

* Updates to talk about signature + public key size rather than just signature size

* Took a pass over rationale

* Started work on specification

* Adds example tapscript hybrid signatures

* More work on the specification

* Cleans up TODO

* Fixing grammar, other minor changes

* SHL --> SLH

* Apply suggestions from code review

Co-authored-by: Hunter Beast <[email protected]>

* Adds discussion of SQIsign

* Fixes broken llink to libbitcoinpqc

Co-authored-by: Hunter Beast <[email protected]>

* Fixes writing in SQIsign section

Co-authored-by: Hunter Beast <[email protected]>

* Add rational section on big signatures and public keys

* Fixes typos

* Adds script validation from BIP 341

* Add commas

* Add design section, stack element size increase now in PQ sigs

* Fixes typo

* Fixes typos and formatting

Co-authored-by: Hunter Beast <[email protected]>

* Add authorship to readme

* Add diagram of P2QRH merke tree, scriptPubKey and Witness

* Remove completed todo

* Add security section

* Clean up wording, moves some things around

* Minor rewording

* Review suggestions

Co-authored-by: Hunter Beast <[email protected]>

* Clarified size differences

* Changed header size and order

* does --> doUpdate bip-0360.mediawiki

Co-authored-by: Hunter Beast <[email protected]>

* Add related work section

* Better scale figure

* Respond to review comments

* remove double space

Co-authored-by: Armin Sabouri <[email protected]>

* Address review comments

* Addressing Ademan comments

* Sync source svg

* Address review

* Addresses review

* Apply suggestions from code review

Co-authored-by: Joey Yandle <[email protected]>

* Update bip-0360.mediawiki

Co-authored-by: Joey Yandle <[email protected]>

* Update bip-0360.mediawiki

Co-authored-by: Joey Yandle <[email protected]>

* Addressing review comments

* Addressing reviews

---------

Co-authored-by: Hunter Beast <[email protected]>
Co-authored-by: Armin Sabouri <[email protected]>
Co-authored-by: Joey Yandle <[email protected]>
@cryptoquick
Copy link
Author

The latest has been merged. This is a very different BIP now and took a lot of time and effort. We'll be making an announcement to the mailing list soon.

Thanks everyone to who reviewed, and thanks @EthanHeilman for all the help as co-author.

@cryptoquick
Copy link
Author

I just wanted to confirm who's reviewing this BIP? I've addressed several of the previous reviewer's asks, including getting a co-author and reducing the scope of the BIP by omitting the PQC components. I do appreciate everyone's time and any review help I can get! I realize we made a lot of big changes and that will take more time to review. I just wanted to make sure everything was addressed in order to speed up the review process and hopefully get this merged.

Also, one question, would it simplify or complicate the review process if we added test vectors to this pull request? Should we wait to merge test vectors (when they're finished, which should be soon) until this PR is approved and merged? They will be available in both Rust and Python, in case that helps.

Copy link
Contributor

@murchandamus murchandamus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the big update, it is much easier to follow and the design seems to be drastically improved. There are a number of instances in which I find naming of concepts a bit odd, especially where it needlessly deviates for concepts replicated from BIP 341.

Comment on lines +94 to +114
{| class="wikitable"
|+ Output types vulnerable to long-exposure attacks on unspent addresses
|-
! Type !! Vulnerable !! Prefix !! Example
|-
| P2PK || Yes || Varies || 2103203b768951584fe9af6d9d9e6ff26a5f76e453212f19ba163774182ab8057f3eac
|-
| P2PKH || No¹ || 1 || 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa
|-
| P2MS || Yes || Varies || 52410496ec45f878b62c46c4be8e336dff7cc58df9b502178cc240e...
|-
| P2SH || No¹ || 3 || 3FkhZo7sGNue153xhgqPBcUaBsYvJW6tTx
|-
| P2WPKH || No¹ || bc1q || bc1qsnh5ktku9ztqeqfr89yrqjd05eh58nah884mku
|-
| P2WSH || No¹ || bc1q || bc1qvhu3557twysq2ldn6dut6rmaj3qk04p60h9l79wk4lzgy0ca8mfsnffz65
|-
| P2TR || Yes || bc1p || bc1p92aslsnseq786wxfk3ekra90ds9ku47qttupfjsqmmj4z82xdq4q3rr58u
|-
| P2QRH || No || bc1r || bc1r8rt68aze8tek87cnz4ndnvfzk6tk93jv39n4lmpu5a4yw453rcpszsft3z
|}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: There are no address standards for P2PK and P2MS, so perhaps the fourth column should be titled "Address or output script example" or similar

A Long Exposure Quantum Attack is an attack in which the public key has been exposed on the blockchain for an extended
period of time, giving an attacker ample opportunity to break the cryptography. This affects:

* P2PK outputs (Satoshi's coins, CPU miners, starts with 04)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2PK output scripts start with a push opcode, not "04". IIRC, uncompressed public keys start with 0x04, but compressed public keys start with 0x02 or 0x03 as the one in your example in the table.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is meant to be a visual indication, and that's how they show up in the mempool explorer:
https://mempool.space/tx/0e3e2357e806b6cdb1f70b54c3a3a17b6714ee1f0e68bebb44a74b1efd512098
iirc compressed public key output types use pushbytes33.

Copy link
Contributor

@murchandamus murchandamus Jul 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I’m not sure why you are telling me that, when I already pointed out that uncompressed public keys start with 0x04. The points I’m raising are:

  • A P2PK output scripts do not start with 0x04 its starts with a push.
  • P2PK output scripts can either hold compressed or uncompressed, therefore the content of the push can start with 04, but only if its an uncompressed key. It’s not the case for a compressed key.
  • Your own example in line 99 is 2103203b768951584fe9af6d9d9e6ff26a5f76e453212f19ba163774182ab8057f3eac, which is a compressed key that starts with 0x03 and you are providing the whole script including the push opcode.

My recommendation would be to either drop "starts with 04", or to explain what exactly starts with 04, because P2PK outputs do not.

Comment on lines +149 to +150
Coinbase outputs to P2PK keys go as far as block 200,000, so there are, at the time of writing, 1,723,848 coins that
are vulnerable from the first epoch in P2PK outputs alone. The majority of these have a block reward of 50 coins each,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2PK outputs were created as recently as 2021, and the total amount of bitcoins held in P2PK outputs was 1,719,270.33902196 three days ago, so it does not seem accurate that all of these coins are held in outputs from the first epoch.

Image

Comment on lines +151 to +160
and there are roughly 34,000 distinct P2PK scripts that are vulnerable. These coins can be considered
"Satoshi's Shield." Any addresses with a balance of less than the original block subsidy of 50 coins can be considered
cryptoeconomically incentive incompatible to capture until all of these are mined, and these addresses serve to provide
time to transition Bitcoin to implement post-quantum security.

It's for the above reason that, for those who wish to be prepared for quantum emergency, it is recommended that no more
than 50 bitcoin are kept under a single, distinct, unused Native SegWit (P2WPKH, "bc1q") address at a time. This is
assuming that the attacker is financially motivated instead of, for example, a nation state looking to break confidence
in Bitcoin. Independently, this assumes that other vulnerable targets such as central banks have upgraded their
cryptography by this time.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As mentioned before, the "Satoshi’s Shield" is argument is not convincing to me.
Satoshi’s coins are closely monitored and spending them would raise awareness immediately. Grabbing coins from some reused addresses likely would go unnoticed (or disputed) much longer. Once an attacker is able to take coins from any address, they may decide to find a number of private keys first before swiping a smaller UTXOs for a few blocks and then e.g., taking the Binance Cold Wallet and start with Satoshi’s coins after. Arguably I haven’t spent a lot of time thinking about it, but I just don’t see how it is useful for this BIP to attempt to predict the order in which an attacker would attack UTXOs and then to venture even further into the weeds by making recommendations to users about how to structure their UTXOs.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not trying to predict the order, it's making the observation that people with UTXOs fewer than 50 bitcoin are safer for longer. It's good, practical advice.

called P2QRH (Pay to Quantum Resistant Hash). This output type is designed to support post-quantum signature algorithms
but those algorithms will be specified in future BIPs.

It is proposed to use SegWit version 3. This results in addresses that start with bc1r, which could be a useful way to
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A convenient mnemonic is a poor reason to skip version 2.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ethan has backed me up in this, you can find some of his reasoning here:
cryptoquick#23 (comment)

Another reason to skip version 2, or bc1z, is it would be ideal for use with BitZip if that ever works out.

Copy link
Contributor

@EthanHeilman EthanHeilman Jul 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know it is a bit strange. There is a comment way back on the BIP where I also objected to it, but the idea has grown on me. That said, it is proving one of the most controversial aspects of P2QRH and I wouldn't fight for inclusion if it continues to be controversial. I want to write up a mailinglist post about it as I think treating SegWit versions as flags might be something we should consider for all new output types.

Comment on lines +562 to +563
P2QRH outputs provide the same tapscript functionality as P2TR outputs, but without the quantum-vulnerable key-spend
path. This enables users, exchanges and other hodlers to easily move their coins from taproot outputs to P2QRH outputs
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
P2QRH outputs provide the same tapscript functionality as P2TR outputs, but without the quantum-vulnerable key-spend
path. This enables users, exchanges and other hodlers to easily move their coins from taproot outputs to P2QRH outputs
P2QRH outputs provide the same tapscript functionality as P2TR outputs, but without the quantum-vulnerable key path.
This enables users, exchanges and other hodlers to easily move their coins from taproot outputs to P2QRH outputs

Comment on lines +660 to +661
scripts into its design. P2QRH inherits this capability from taproot because P2QRH is simply taproot with the key-spend
path removed. As a result, P2QRH does have the taproot internal key or tweak key, instead P2QRH commits directly to the
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
scripts into its design. P2QRH inherits this capability from taproot because P2QRH is simply taproot with the key-spend
path removed. As a result, P2QRH does have the taproot internal key or tweak key, instead P2QRH commits directly to the
scripts into its design. P2QRH inherits this capability from taproot because P2QRH is simply taproot with the key path
removed. As a result, P2QRH does not have the taproot internal key or tweak key, instead P2QRH commits directly to the


Below we attempt to summarize some of the ideas discussed on the Bitcoin Bitcoin-Dev that relate to P2QRH.

The idea of a taproot but with the key-spend path removed has been discussed a number of times in the Bitcoin community.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The idea of a taproot but with the key-spend path removed has been discussed a number of times in the Bitcoin community.
The idea of a taproot but with key path spending removed has been discussed a number of times in the Bitcoin community.


The idea of a taproot but with the key-spend path removed has been discussed a number of times in the Bitcoin community.
[https://gnusha.org/pi/bitcoindev/CAD5xwhgzR8e5r1e4H-5EH2mSsE1V39dd06+TgYniFnXFSBqLxw@mail.gmail.com/ OP_CAT Makes Bitcoin Quantum Secure]
notes that if we disable the key-spend in taproot and activated CAT [https://github.com/bitcoin/bips/blob/master/bip-0347.mediawik BIP-347],
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here and everywhere: "key path (spending)" instead of "key-spend" or "key-spend path".

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for point that out. I should have checked I was maintaining a consistent terminology.

I was trying to use key-spend path to refer to the capability and key-spend to refer to the action.

BIP-0342 uses

  • taproot spend to mean key-spend
  • script path spend to mean script-spend

I could use the language in BIP-0342, but it seems confusing to say we disable the taproot spend in pay-to-taproot. Rereading BIP-0342, I know realize that it is using path as shorthand for merkle path.

No one seems to use this "taproot spend" language anymore.

We could use:

  1. script path spend and key path spend. "taproot but with the key path spend removed..."
  2. script-spend and key-spend. "taproot but with the key-spend capability removed..."
  3. script spend and key spend (no hyphen).

Do you have any preference?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was unaware that BIP 342 was not consistent with BIP 341 in that regard, but I would consider "key path spend" and "script path spend" to be the established terms.

attestation was later discarded when Ethan Heilman joined as co-author, whom I'm incredibly grateful to for
transforming this BIP into something far more congruent with existing Bitcoin design. Thank you as
well to those who took the time to review and contribute, including Jeff Bride, Adam Borcany, Antoine Riard, Pierre-Luc
Dallaire-Demers, Mark Erhardt, Joey Yandle, Jon Atack, Armin Sabouri, Jameson Lopp, Murchandamus, and Vojtěch Strnad.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Murchandamus and Mark Erhardt are the same person

@bitcoin bitcoin deleted a comment from Noxcheborz Jul 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.