Delivery-date: Wed, 19 Feb 2025 10:47:24 -0800 Received: from mail-ot1-f63.google.com ([209.85.210.63]) by mail.fairlystable.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1tkp6Q-0007Cn-A5 for bitcoindev@gnusha.org; Wed, 19 Feb 2025 10:47:23 -0800 Received: by mail-ot1-f63.google.com with SMTP id 46e09a7af769-7272bdd323dsf27624a34.3 for ; Wed, 19 Feb 2025 10:47:22 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1739990836; cv=pass; d=google.com; s=arc-20240605; b=Q5fPrukBPfK7l65ORxLfrAqqOjsU/4flcLU2I7X99Y/dUoescM/lteGn/4y3P0nlZ1 euYYrLP7/sI0c8WZKi6Oj5JoW1qVIPsEj1lfdo/DFA5nkXT//cutjfuMS0mnj56HAy5E YmnpgLTr/3Ch44CzY4dUWGWdlEU5dEupcX031CCIx90QHcwclexTqr1I5AWQtR1Tfh+b d5XYtss0OgjQvxGYHM55YHP7wyfagmnOo4zRdY5g+rFJQ27MYHywwvxlK5QaE6j/H3Hv XZuL9Sl3nvpZCkTB3PL0RY8tqj7dyHrJ0yjZtuBScUgUFQ4Gri60wsY12epkgs6qnkC9 Yp5Q== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:sender:dkim-signature :dkim-signature; bh=6uY3HQJwRKK/2HV63b3lRVqXbBo7ZHZQMTHvNDqwg4Y=; fh=usjTQ6S4teGc5EQTKdjWxnpfO7JsqggRji4UyjIG2K0=; b=lGR4DKDzTtagptgU0qW7ZIJWt7Yts+9Hl/5KdjxsguSiItT9hJCjkeFY+OlzWguOiL 6UvBTM/l5nQMUi5WjbM7e0oqlyFLZdh2QJQL4JqsvIx0voHEETQAYKdEjv2LYdgeCIFi 4UORyqG/Atbx8YWqHmM3uswMo7jYdUZ7RLJH1D4F5TSmSD0S0nRwyv18pFeJe7Xc+jsy zzKAvOdQHdQWNP8oiHoZz4kbdvmqAvidKQGfA0936O10TVktzpUxZM6eLH6JXJirx14g nSaOcl04G4WoG04tAKSW07tulS5a8OXB/urvLanRllihyBr7z8Tb4mLhjW5zf6+okO+A htjQ==; darn=gnusha.org ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=MA9mTuuL; spf=pass (google.com: domain of agustin.cruz@gmail.com designates 2a00:1450:4864:20::12c as permitted sender) smtp.mailfrom=agustin.cruz@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com; dara=pass header.i=@googlegroups.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1739990836; x=1740595636; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:sender:from:to:cc:subject:date:message-id :reply-to; bh=6uY3HQJwRKK/2HV63b3lRVqXbBo7ZHZQMTHvNDqwg4Y=; b=T+gWZgk0w19tLrx923f41w/0GJna47MZslcQWt6DyW9DrdZq4Q50KryaKJFhNsIXyb Ici8jzzWCjB/ZdcpxohYK7VPAyLm8f5RcYTcm+rrY8xSNmXwNi/TDNo1ZDTAxCyV7zLa L0W6DXu0L8X67y8zvF7izOkY8/ZV/+9SjHNKMS+qhKowIAaG3Ep5aK5XaxmL2R9eaDS1 4wF2m+ibiyZtL0STI+L6mf0guCRrH3KvCi59ehRWrzw/oyh4bldOcqPrvIxGHPBtuj9a 3DvCZHcCAB6kveCXWFXrZuTJsC2VeISlbcuteOlwkYw3W1FkuQu+1bM3MwpElPNeKGxU vlqg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1739990836; x=1740595636; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:from:to:cc:subject:date:message-id:reply-to; bh=6uY3HQJwRKK/2HV63b3lRVqXbBo7ZHZQMTHvNDqwg4Y=; b=i+q3AVahWQTI5MusarMGKCWkHuLSsb7KJo2MbADrZWl8Ga3dwroyQloHlnP/G32P1+ y55WqiOmlmtVWTub77R1yeIVJYEtbf/JgOeHnFjoj/D69QrVwQXX/IoShRAkn+2ge3u8 OSMm4JhGpw5x5gx55Zh8pcZt11yWG7zafG9Pi7HTHbMqe0+qa1UIqYKcSA6Q/IuXYxfg IlpsLv2NEqaYXNMtZneLMW542MnvlHDe95iDf2uac2vhMbyacV56jAimq6QGUVSr4jED 1Tx9Jhls2p5YaBcW1F4Y9Toutru4WEQumvII6gHdmLjS9UZyQtVmGNyB1vreOCVYFNZu p11A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1739990836; x=1740595636; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:x-beenthere:x-gm-message-state:sender:from :to:cc:subject:date:message-id:reply-to; bh=6uY3HQJwRKK/2HV63b3lRVqXbBo7ZHZQMTHvNDqwg4Y=; b=Ob8NGIJyCO+oFE4rcn875BzrRoFG6H0QvuaYOMq4cU2nEVVyISEX1Ey1/7qdvd6wLC A0ZNHvbdluBRvJ+4UCeuPtyJESFpTRpoZkMhSr5h6kzTzBIO5oxNuDSePIAlqkRPV9qZ 7tnjBbQGM8ABDrM0mRSVIQ9Z4imTc1BhJFwdqqbfuGMNLqXV6XWjqSzPzU1abiy8CxaO DTrIBaBfu3Cv5GsdC99x4mdFCxYxQc0L5eyGhYeqAbeP0uhsdcu7DeE4jRu50bg5r25D qR156o+P43EtiFz8AwN41ExvOlluVtMmWS37zfgI7LQLww9+N/6uLI7K/BpGjqxP3Kij 1f0Q== Sender: bitcoindev@googlegroups.com X-Forwarded-Encrypted: i=2; AJvYcCVvJQtysrn4gx8eJ5UZZQMqxg+7IY4Ogp9PxLfLZNgfsjlJbDq02KQGJRAZIZLv4dBR+XBYR1TaUS1h@gnusha.org X-Gm-Message-State: AOJu0YyeJZsIXu40uZOjoiwJlRufKViKp2lRxYQwwUhxS3q3cxQ+o5xw LUScX680OKBTpSY2sN04OqF2bZ6cCVfv5rWv09bDHktQBaD8hKB8 X-Google-Smtp-Source: AGHT+IEIf1P4bRW11eJkqxVjr/E75EIQdnCMpDPnZ/OFuNK6rG+SEgmXr7UuyQiPXruttkJwGOcRjQ== X-Received: by 2002:a05:6830:6d8a:b0:71e:f1:3e1 with SMTP id 46e09a7af769-7271202d993mr13287612a34.3.1739990836244; Wed, 19 Feb 2025 10:47:16 -0800 (PST) X-BeenThere: bitcoindev@googlegroups.com; h=Adn5yVGSqVD5WyAjDnknM1JcDBnQnLcAVyahS+Xo2jdNySWkiw== Received: by 2002:a05:6820:6407:b0:5fc:f5a7:d72a with SMTP id 006d021491bc7-5fd0b0c1610ls12520eaf.1.-pod-prod-06-us; Wed, 19 Feb 2025 10:47:13 -0800 (PST) X-Received: by 2002:a05:6808:398e:b0:3f4:c7f:c5a3 with SMTP id 5614622812f47-3f40c7fc6a1mr5145071b6e.29.1739990833779; Wed, 19 Feb 2025 10:47:13 -0800 (PST) Received: by 2002:a05:600c:6c47:b0:439:8c8f:60f0 with SMTP id 5b1f17b1804b1-4398c8f6682ms5e9; Wed, 19 Feb 2025 08:42:18 -0800 (PST) X-Received: by 2002:a05:600c:190b:b0:439:a1ad:6851 with SMTP id 5b1f17b1804b1-439a1ad6abfmr7329915e9.23.1739983335577; Wed, 19 Feb 2025 08:42:15 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1739983335; cv=none; d=google.com; s=arc-20240605; b=ko16sZrTV4r4DXTlipNcJNLov6TILtsiKgWdIWA24rM2QQgIfQ/1dwDcjQoamdjd6r 8OrfGYHyrV14bn17rQjt15ev2XzNrkcjoNSDHeBszbjYydUa8TFdlp/BCF0NSy+W/kF4 vmEnDcwNym/o+f30BgePQI+ws3lHOaBMvWPKZvEXNN+0ayYFo9YR3lmR++QVxIo3zDq5 OqgOzOpaBTnbmeuMRDJDIa43Q3uE2otA3toK3sGJqq2q1neZN5Q7D+YWLmH1oT7qGCGr 6SgZDPJsQwQ4fKx25HUSH7aBvy6NsaRWGI/+JrmabXNtvUOwvL6iTuYK8tmPu9rQ1Abx cymQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=cDD1R2oUYM7Xli4qEp/TzHXJx22AV7yFPrrSAASueKY=; fh=oW5/5oUmRRMvy96u/Fl5uZTynMYP3W/WShfBcMiH4EY=; b=l3fyFCRMabP3U4Dey27zFf6OmpYz6+4yOQsfrAsqu7rMeEgc3lw5LJhEiPzOK1tGtZ CplBs0kpmho8ug2LmOn+8TOWXTw5vG0934v5CqePZgCBvE6h2Eiu9d9Z0kVZx0y3mGB6 RfobEY512AMY+H5qLRrrOq1roGgG2pNRTpJn5e+bzudHQ3AxPmgfvS/3tluV3exVBeXx 2NGlVrnBJvZNBJAlDj5/2mPji14DGkv6x8f6+AnmUkAlXvoV54E9xkJ86U4JynbM2YE6 gzNAs0C6Gn1WVPpNn3NUhvHsFpRhLANHyl2cTxPuTxVbYgt6EN4rlyw3RJK6GlljMOVM x5pQ==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=MA9mTuuL; spf=pass (google.com: domain of agustin.cruz@gmail.com designates 2a00:1450:4864:20::12c as permitted sender) smtp.mailfrom=agustin.cruz@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com; dara=pass header.i=@googlegroups.com Received: from mail-lf1-x12c.google.com (mail-lf1-x12c.google.com. [2a00:1450:4864:20::12c]) by gmr-mx.google.com with ESMTPS id 5b1f17b1804b1-4399f205be8si280345e9.2.2025.02.19.08.42.15 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 19 Feb 2025 08:42:15 -0800 (PST) Received-SPF: pass (google.com: domain of agustin.cruz@gmail.com designates 2a00:1450:4864:20::12c as permitted sender) client-ip=2a00:1450:4864:20::12c; Received: by mail-lf1-x12c.google.com with SMTP id 2adb3069b0e04-543cc81ddebso29963e87.1 for ; Wed, 19 Feb 2025 08:42:15 -0800 (PST) X-Gm-Gg: ASbGncs/XPzIQTIsFWZbQ2eoWej5vtTMcJa8CQDzlf25Rl+lZenKYKW4U/Xp858Je3v w9eJPx1Vt9b9Ixw88R6/ef3uP0LD63/iP3NhwYXgptJex/rQwwOL6tn+0d/pkUXUj95HA0hYXhw == X-Received: by 2002:a19:4344:0:b0:546:2f7a:38b9 with SMTP id 2adb3069b0e04-5462f7a41c8mr1341281e87.3.1739983334848; Wed, 19 Feb 2025 08:42:14 -0800 (PST) MIME-Version: 1.0 References: <08a544fa-a29b-45c2-8303-8c5bde8598e7n@googlegroups.com> In-Reply-To: From: Agustin Cruz Date: Wed, 19 Feb 2025 13:42:02 -0300 X-Gm-Features: AWEUYZn02EJ_dny2cafE3lfm-5wztaKt-rY3yxHxDUo7sp2lGq73cGRgmXAG6Po Message-ID: Subject: Re: [bitcoindev] Proposal for Quantum-Resistant Address Migration Protocol (QRAMP) BIP To: Hunter Beast Cc: Bitcoin Development Mailing List Content-Type: multipart/alternative; boundary="00000000000096c4bf062e817094" X-Original-Sender: agustin.cruz@gmail.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=MA9mTuuL; spf=pass (google.com: domain of agustin.cruz@gmail.com designates 2a00:1450:4864:20::12c as permitted sender) smtp.mailfrom=agustin.cruz@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com; dara=pass header.i=@googlegroups.com Precedence: list Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com List-ID: X-Google-Group-Id: 786775582512 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Score: -0.5 (/) --00000000000096c4bf062e817094 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Hunter, I appreciate the work you=E2=80=99re doing on BIP-360 for Anduro. Your poin= t about not =E2=80=9Cconfiscating=E2=80=9D old coins and allowing those with quantu= m capabilities to free them up is certainly a valid one, and I understand the argument that any inflationary impact could be transitory. From my viewpoint, allowing quantum-capable adversaries to reintroduce dormant coins (e.g., Satoshi=E2=80=99s if those keys are lost) could have unintended consequences that go beyond transient inflation. It could fundamentally alter trust in Bitcoin=E2=80=99s fixed supply and disrupt eco= nomic assumptions built around the current distribution of coins. While some might view these dormant coins as =E2=80=9Cfair game,=E2=80=9D their sudden= reappearance could cause lasting market shocks and undermine confidence. The goal of a proactive migration is to close the door on such a scenario before it becomes imminent. I agree that Q-day won=E2=80=99t necessarily be a single, catastrophic mome= nt. It will likely be gradual and subtle, giving the network some time to adapt. That said, one challenge is ensuring we don=E2=80=99t find ourselves in an emergency scramble the moment a capable quantum machine appears. A forced or proactive migration is an admittedly strong measure, but it attempts to address the scenario where a slow, creeping capability becomes a sudden attack vector once it matures. In that sense, =E2=80=9Crushing=E2=80=9D isn= =E2=80=99t ideal, but neither is waiting until the threat is undeniably present. El mi=C3=A9, 19 de feb de 2025, 1:31=E2=80=AFp. m., Hunter Beast escribi=C3=B3: > I don't see why old coins should be confiscated. The better option is to > let those with quantum computers free up old coins. While this might have > an inflationary impact on bitcoin's price, to use a turn of phrase, the > inflation is transitory. Those with low time preference should support > returning lost coins to circulation. > > Also, I don't see the urgency, considering the majority of coins are in > either P2PKH, P2WPKH, P2SH, and P2WSH addresses. If PQC signatures aren't > added, such as with BIP-360, there will be some concern around long > exposure attacks on P2TR coins. For large amounts, it would be smart to > modify wallets to support broadcasting transactions to private mempool > services such as Slipstream, to mitigate short exposure attacks. Those wi= ll > also be rarer early on since a CRQC capable of a long exposure attack is > much simpler than one capable of pulling off a short exposure attack > against a transaction in the mempool. > > Bitcoin's Q-day likely won't be sudden and obvious. It will also take tim= e > to coordinate a soft fork activation. This shouldn't be rushed. > > In the interest of transparency, it's worth mentioning that I'm working o= n > a BIP-360 implementation for Anduro. Both Anduro and Slipstream are MARA > services. > > On Tuesday, February 11, 2025 at 9:01:51=E2=80=AFPM UTC-7 Agustin Cruz wr= ote: > >> Hi Dustin: >> >> I understand that the proposal is an extraordinary ask=E2=80=94it would = indeed >> void a non-trivial part of the coin supply if users do not migrate in ti= me, >> and under normal circumstances, many would argue that unused P2PKH funds >> are safe from a quantum adversary. However, the intent here is to be >> proactive rather than reactive. >> >> The concern isn=E2=80=99t solely about funds in active wallets. Consider= that if >> we don=E2=80=99t implement a proactive migration, any Bitcoin in lost >> wallets=E2=80=94including, hypothetically, Satoshi=E2=80=99s if he is no= t alive=E2=80=94will remain >> vulnerable. In the event of a quantum breakthrough, those coins could be >> hacked and put back into circulation. Such an outcome would not only >> disrupt the balance of supply but could also undermine the trust and >> security that Bitcoin has built over decades. In short, the consequences= of >> a reactive measure in a quantum emergency could be far more catastrophic= . >> >> While I agree that a forced migration during an active quantum attack >> scenario might be more acceptable (since funds would likely be considere= d >> lost anyway), waiting until such an emergency arises leaves us with litt= le >> margin for error. By enforcing a migration now, we create a window for t= he >> entire community to transition safely=E2=80=94assuming we set the deadli= ne >> generously and provide ample notifications, auto-migration tools, and, i= f >> necessary, emergency extensions. >> >> El mar, 11 de feb de 2025, 9:48=E2=80=AFp. m., Dustin Ray >> escribi=C3=B3: >> >>> I think youre going to have a tough time getting consensus on this >>> proposal. It is an extraordinary ask of the community to instill a >>> change that will essentially void out a non-trivial part of the coin >>> supply, especially when funds behind unused P2PKH addresses are at >>> this point considered safe from a quantum adversary. >>> >>> In my opinion, where parts of this proposal make sense is in a quantum >>> emergency in which an adversary is actively extracting private keys >>> from known public keys and a transition must be made quickly and >>> decisively. In that case, we might as well consider funds to be lost >>> anyways. In any other scenario prior to this hypothetical emergency >>> however, I have serious doubts that the community is going to consent >>> to this proposal as it stands. >>> >>> On Tue, Feb 11, 2025 at 4:37=E2=80=AFPM Agustin Cruz >>> wrote: >>> > >>> > Hi Dustin >>> > >>> > To clarify, the intent behind making legacy funds unspendable after a >>> certain block height is indeed a hard security measure=E2=80=94designed= to mitigate >>> the potentially catastrophic risk posed by quantum attacks on ECDSA. Th= e >>> idea is to force a proactive migration of funds to quantum-resistant >>> addresses before quantum computers become capable of compromising the >>> current cryptography. >>> > >>> > The migration window is intended to be sufficiently long (determined >>> by both block height and community input) to provide ample time for use= rs >>> and service providers to transition. >>> > >>> > >>> > El mar, 11 de feb de 2025, 9:15=E2=80=AFp. m., Dustin Ray < >>> dustinvo...@gmail.com> escribi=C3=B3: >>> >> >>> >> Right off the bat I notice you are proposing that legacy funds becom= e >>> unspendable after a certain block height which immediately raises serio= us >>> problems. A migration to quantum hard addresses in this manner would ca= use >>> serious financial damage to anyone holding legacy funds, if I understan= d >>> your proposal correctly. >>> >> >>> >> On Tue, Feb 11, 2025 at 4:10=E2=80=AFPM Agustin Cruz >>> wrote: >>> >>> >>> >>> Dear Bitcoin Developers, >>> >>> >>> >>> I am writing to share my proposal for a new Bitcoin Improvement >>> Proposal (BIP) titled Quantum-Resistant Address Migration Protocol (QRA= MP). >>> The goal of this proposal is to safeguard Bitcoin against potential fut= ure >>> quantum attacks by enforcing a mandatory migration period for funds hel= d in >>> legacy Bitcoin addresses (secured by ECDSA) to quantum-resistant addres= ses. >>> >>> >>> >>> The proposal outlines: >>> >>> >>> >>> Reducing Vulnerabilities: Transitioning funds to quantum-resistant >>> schemes preemptively to eliminate the risk posed by quantum attacks on >>> exposed public keys. >>> >>> Enforcing Timelines: A hard migration deadline that forces timely >>> action, rather than relying on a gradual, voluntary migration that migh= t >>> leave many users at risk. >>> >>> Balancing Risks: Weighing the non-trivial risk of funds being >>> permanently locked against the potential catastrophic impact of a quant= um >>> attack on Bitcoin=E2=80=99s security. >>> >>> >>> >>> Additionally, the proposal addresses common criticisms such as the >>> risk of permanent fund loss, uncertain quantum timelines, and the poten= tial >>> for chain splits. It also details backwards compatibility measures, >>> comprehensive security considerations, an extensive suite of test cases= , >>> and a reference implementation plan that includes script interpreter >>> changes, wallet software updates, and network monitoring tools. >>> >>> >>> >>> For your convenience, I have published the full proposal on my >>> GitHub repository. You can review it at the following link: >>> >>> >>> >>> Quantum-Resistant Address Migration Protocol (QRAMP) Proposal on >>> GitHub >>> >>> >>> >>> I welcome your feedback and suggestions and look forward to engagin= g >>> in a constructive discussion on how best to enhance the security and >>> resilience of the Bitcoin network in the quantum computing era. >>> >>> >>> >>> Thank you for your time and consideration. >>> >>> >>> >>> Best regards, >>> >>> >>> >>> Agustin Cruz >>> >>> >>> >>> -- >>> >>> You received this message because you are subscribed to the Google >>> Groups "Bitcoin Development Mailing List" group. >>> >>> To unsubscribe from this group and stop receiving emails from it, >>> send an email to bitcoindev+...@googlegroups.com. >>> >>> To view this discussion visit >>> https://groups.google.com/d/msgid/bitcoindev/08a544fa-a29b-45c2-8303-8c= 5bde8598e7n%40googlegroups.com >>> . >>> >> -- > You received this message because you are subscribed to the Google Groups > "Bitcoin Development Mailing List" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to bitcoindev+unsubscribe@googlegroups.com. > To view this discussion visit > https://groups.google.com/d/msgid/bitcoindev/f9e233e0-9d87-4e71-9a9f-3310= ea242194n%40googlegroups.com > > . > --=20 You received this message because you are subscribed to the Google Groups "= Bitcoin Development Mailing List" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoindev+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/= CAJDmzYz%3D52MGGLE0ZWm5tmfLUAZEo2tYQutHb4sMvjKbayOAHg%40mail.gmail.com. --00000000000096c4bf062e817094 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Hi Hunter,

I appreciate = the work you=E2=80=99re doing on BIP-360 for Anduro. Your point about not = =E2=80=9Cconfiscating=E2=80=9D old coins and allowing those with quantum ca= pabilities to free them up is certainly a valid one, and I understand the a= rgument that any inflationary impact could be transitory.

From my viewpoint, allowing quantum-capable adversaries to r= eintroduce dormant coins (e.g., Satoshi=E2=80=99s if those keys are lost) c= ould have unintended consequences that go beyond transient inflation. It co= uld fundamentally alter trust in Bitcoin=E2=80=99s fixed supply and disrupt= economic assumptions built around the current distribution of coins. While= some might view these dormant coins as =E2=80=9Cfair game,=E2=80=9D their = sudden reappearance could cause lasting market shocks and undermine confide= nce. The goal of a proactive migration is to close the door on such a scena= rio before it becomes imminent.

I agree that Q-day won=E2= =80=99t necessarily be a single, catastrophic moment. It will likely be gra= dual and subtle, giving the network some time to adapt. That said, one chal= lenge is ensuring we don=E2=80=99t find ourselves in an emergency scramble = the moment a capable quantum machine appears. A forced or proactive migrati= on is an admittedly strong measure, but it attempts to address the scenario= where a slow, creeping capability becomes a sudden attack vector once it m= atures. In that sense, =E2=80=9Crushing=E2=80=9D isn=E2=80=99t ideal, but n= either is waiting until the threat is undeniably present.


El mi=C3=A9, 19 de feb de 2025, 1:31=E2=80=AFp.=C2=A0m., Hunter Bea= st <hunter@surmount.systems> escribi=C3=B3:
I don't see why old coins should be confiscated. The bet= ter option is to let those with quantum computers free up old coins. While = this might have an inflationary impact on bitcoin's price, to use a tur= n of phrase, the inflation is transitory. Those with low time preference sh= ould support returning lost coins to circulation.

Also, = I don't see the urgency, considering the majority of coins are in eithe= r P2PKH, P2WPKH, P2SH, and P2WSH addresses. If PQC signatures aren't ad= ded, such as with BIP-360, there will be some concern around long exposure = attacks on P2TR coins. For large amounts, it would be smart to modify walle= ts to support broadcasting transactions to private mempool services such as= Slipstream, to mitigate short exposure attacks. Those will also be rarer e= arly on since a CRQC capable of a long exposure attack is much simpler than= one capable of pulling off a short exposure attack against a transaction i= n the mempool.

Bitcoin's Q-day likely won'= t be sudden and obvious. It will also take time to coordinate a soft fork a= ctivation. This shouldn't be rushed.

In the in= terest of transparency, it's worth mentioning that I'm working on a= BIP-360 implementation for Anduro. Both Anduro and Slipstream are MARA ser= vices.

On Tuesday, February 11, 2025 at 9:01:51=E2=80=AFPM UTC-7= Agustin Cruz wrote:
<= div dir=3D"auto">

Hi Dustin:

I understand that the proposal is an extraordinary ask=E2=80= =94it would indeed void a non-trivial part of the coin supply if users do n= ot migrate in time, and under normal circumstances, many would argue that u= nused P2PKH funds are safe from a quantum adversary. However, the intent he= re is to be proactive rather than reactive.

The concern isn=E2=80=99t solely about funds in active walle= ts. Consider that if we don=E2=80=99t implement a proactive migration, any = Bitcoin in lost wallets=E2=80=94including, hypothetically, Satoshi=E2=80=99= s if he is not alive=E2=80=94will remain vulnerable. In the event of a quan= tum breakthrough, those coins could be hacked and put back into circulation= . Such an outcome would not only disrupt the balance of supply but could al= so undermine the trust and security that Bitcoin has built over decades. In= short, the consequences of a reactive measure in a quantum emergency could= be far more catastrophic.

While I agree that a forced migration during an active quant= um attack scenario might be more acceptable (since funds would likely be co= nsidered lost anyway), waiting until such an emergency arises leaves us wit= h little margin for error. By enforcing a migration now, we create a window= for the entire community to transition safely=E2=80=94assuming we set the = deadline generously and provide ample notifications, auto-migration tools, = and, if necessary, emergency extensions.


El mar, 11 de feb de 2025, 9:48= =E2=80=AFp.=C2=A0m., Dustin Ray <dustinvo= ...@gmail.com> escribi=C3=B3:
agusti...@gmail.com> wrote:
>
> Hi Dustin
>
> To clarify, the intent behind making legacy funds unspendable after a = certain block height is indeed a hard security measure=E2=80=94designed to = mitigate the potentially catastrophic risk posed by quantum attacks on ECDS= A. The idea is to force a proactive migration of funds to quantum-resistant= addresses before quantum computers become capable of compromising the curr= ent cryptography.
>
> The migration window is intended to be sufficiently long (determined b= y both block height and community input) to provide ample time for users an= d service providers to transition.
>
>
> El mar, 11 de feb de 2025, 9:15=E2=80=AFp. m., Dustin Ray <dustinvo...@gmail.com> escribi= =C3=B3:
>>
>> Right off the bat I notice you are proposing that legacy funds bec= ome unspendable after a certain block height which immediately raises serio= us problems. A migration to quantum hard addresses in this manner would cau= se serious financial damage to anyone holding legacy funds, if I understand= your proposal correctly.
>>
>> On Tue, Feb 11, 2025 at 4:10=E2=80=AFPM Agustin Cruz <agusti...@gmail.com> wrote:
>>>
>>> Dear Bitcoin Developers,
>>>
>>> I am writing to share my proposal for a new Bitcoin Improvemen= t Proposal (BIP) titled Quantum-Resistant Address Migration Protocol (QRAMP= ). The goal of this proposal is to safeguard Bitcoin against potential futu= re quantum attacks by enforcing a mandatory migration period for funds held= in legacy Bitcoin addresses (secured by ECDSA) to quantum-resistant addres= ses.
>>>
>>> The proposal outlines:
>>>
>>> Reducing Vulnerabilities: Transitioning funds to quantum-resis= tant schemes preemptively to eliminate the risk posed by quantum attacks on= exposed public keys.
>>> Enforcing Timelines: A hard migration deadline that forces tim= ely action, rather than relying on a gradual, voluntary migration that migh= t leave many users at risk.
>>> Balancing Risks: Weighing the non-trivial risk of funds being = permanently locked against the potential catastrophic impact of a quantum a= ttack on Bitcoin=E2=80=99s security.
>>>
>>> Additionally, the proposal addresses common criticisms such as= the risk of permanent fund loss, uncertain quantum timelines, and the pote= ntial for chain splits. It also details backwards compatibility measures, c= omprehensive security considerations, an extensive suite of test cases, and= a reference implementation plan that includes script interpreter changes, = wallet software updates, and network monitoring tools.
>>>
>>> For your convenience, I have published the full proposal on my= GitHub repository. You can review it at the following link:
>>>
>>> Quantum-Resistant Address Migration Protocol (QRAMP) Proposal = on GitHub
>>>
>>> I welcome your feedback and suggestions and look forward to en= gaging in a constructive discussion on how best to enhance the security and= resilience of the Bitcoin network in the quantum computing era.
>>>
>>> Thank you for your time and consideration.
>>>
>>> Best regards,
>>>
>>> Agustin Cruz
>>>
>>> --
>>> You received this message because you are subscribed to the Go= ogle Groups "Bitcoin Development Mailing List" group.
>>> To unsubscribe from this group and stop receiving emails from = it, send an email to bitcoindev+.= ..@googlegroups.com.
>>> To view this discussion visit = https://groups.google.com/d/msgid/bitcoindev/08a544fa-a29b-45c2-8303-8c5bde= 8598e7n%40googlegroups.com.

--
You received this message because you are subscribed to the Google Groups &= quot;Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoindev+unsubscribe@googlegroups.com.=
To view this discussion visit h= ttps://groups.google.com/d/msgid/bitcoindev/f9e233e0-9d87-4e71-9a9f-3310ea2= 42194n%40googlegroups.com.

--
You received this message because you are subscribed to the Google Groups &= quot;Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoind= ev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/= msgid/bitcoindev/CAJDmzYz%3D52MGGLE0ZWm5tmfLUAZEo2tYQutHb4sMvjKbayOAHg%40ma= il.gmail.com.
--00000000000096c4bf062e817094--