Delivery-date: Fri, 14 Jun 2024 07:15:36 -0700
Sender: bitcoindev@googlegroups.com
Date: Fri, 14 Jun 2024 06:51:07 -0700 (PDT)
From: Pierre-Luc Dallaire-Demers <dallairedemers@gmail.com>
To: Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Message-Id: <b3561407-483e-46cd-b5e9-d6d48f8dca93n@googlegroups.com>
In-Reply-To: <62fd28ab-e8b5-4cfc-b5ae-0d5a033af057n@googlegroups.com>
References: <62fd28ab-e8b5-4cfc-b5ae-0d5a033af057n@googlegroups.com>
Subject: [bitcoindev] Re: Proposing a P2QRH BIP towards a quantum resistant
 soft fork
MIME-Version: 1.0
Content-Type: multipart/mixed; 
	boundary="----=_Part_13076_600048989.1718373067734"
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com

------=_Part_13076_600048989.1718373067734
Content-Type: multipart/alternative; 
	boundary="----=_Part_13077_601844276.1718373067734"

------=_Part_13077_601844276.1718373067734
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

SQIsign is blockchain friendly but also very new, I would recommend adding=
=20
a hash-based backup key in case an attack on SQIsign is found in the future=
=20
(recall that SIDH broke over the span of a=20
weekend https://eprint.iacr.org/2022/975.pdf).
Backup keys can be added in the form of a Merkle tree where one branch=20
would contain the SQIsign public key and the other the public key of the=20
recovery hash-based scheme. For most transactions it would only add one bit=
=20
to specify the SQIsign branch.
The hash-based method could be Sphincs+, which is standardized by NIST but=
=20
requires adding extra code, or Lamport, which is not standardized but can=
=20
be verified on-chain with OP-CAT.

On Sunday, June 9, 2024 at 12:07:16=E2=80=AFp.m. UTC-4 Hunter Beast wrote:

> The motivation for this BIP is to provide a concrete proposal for adding=
=20
> quantum resistance to Bitcoin. We will need to pick a signature algorithm=
,=20
> implement it, and have it ready in event of quantum emergency. There will=
=20
> be time to adopt it. Importantly, this first step is a more substantive=
=20
> answer to those with concerns beyond, "quantum computers may pose a threa=
t,=20
> but we likely don't have to worry about that for a long time". Bitcoin=20
> development and activation is slow, so it's important that those with low=
=20
> time preference start discussing this as a serious possibility sooner=20
> rather than later.
>
> This is meant to be the first in a series of BIPs regarding a hypothetica=
l=20
> "QuBit" soft fork. The BIP is intended to propose concrete solutions, eve=
n=20
> if they're early and incomplete, so that Bitcoin developers are aware of=
=20
> the existence of these solutions and their potential.
>
> This is just a rough draft and not the finished BIP. I'd like to validate=
=20
> the approach and hear if I should continue working on it, whether serious=
=20
> changes are needed, or if this truly isn't a worthwhile endeavor right no=
w.
>
> The BIP can be found here:
> https://github.com/cryptoquick/bips/blob/p2qrh/bip-p2qrh.mediawiki
>
> Thank you for your time.
>
>

--=20
You received this message because you are subscribed to the Google Groups "=
Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/=
bitcoindev/b3561407-483e-46cd-b5e9-d6d48f8dca93n%40googlegroups.com.

------=_Part_13077_601844276.1718373067734
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

SQIsign is blockchain friendly but also very new, I would recommend adding =
a hash-based backup key in case an attack on SQIsign is found in the future=
 (recall that SIDH broke over the span of a weekend=C2=A0https://eprint.iac=
r.org/2022/975.pdf).<div>Backup keys can be added in the form of a Merkle t=
ree where one branch would contain the SQIsign public key and the other the=
 public key of the recovery hash-based scheme. For most transactions it wou=
ld only add one bit to specify the SQIsign branch.</div><div>The hash-based=
 method could be Sphincs+, which is standardized by NIST but requires addin=
g extra code, or Lamport, which is not standardized but can be verified on-=
chain with OP-CAT.<br /><br /></div><div class=3D"gmail_quote"><div dir=3D"=
auto" class=3D"gmail_attr">On Sunday, June 9, 2024 at 12:07:16=E2=80=AFp.m.=
 UTC-4 Hunter Beast wrote:<br/></div><blockquote class=3D"gmail_quote" styl=
e=3D"margin: 0 0 0 0.8ex; border-left: 1px solid rgb(204, 204, 204); paddin=
g-left: 1ex;">The motivation for this BIP is to provide a concrete proposal=
 for adding quantum resistance to Bitcoin. We will need to pick a signature=
 algorithm, implement it, and have it ready in event of quantum emergency. =
There will be time to adopt it. Importantly, this first step is a more subs=
tantive answer to those with concerns beyond, &quot;quantum computers may p=
ose a threat, but we likely don&#39;t have to worry about that for a long t=
ime&quot;. Bitcoin development and activation is slow, so it&#39;s importan=
t that those with low time preference start discussing this as a serious po=
ssibility sooner rather than later.<br><br>This is meant to be the first in=
 a series of BIPs regarding a hypothetical &quot;QuBit&quot; soft fork. The=
 BIP is intended to propose concrete solutions, even if they&#39;re early a=
nd incomplete, so that Bitcoin developers are aware of the existence of the=
se solutions and their potential.<br><br>This is just a rough draft and not=
 the finished BIP. I&#39;d like to validate the approach and hear if I shou=
ld continue working on it, whether serious changes are needed, or if this t=
ruly isn&#39;t a worthwhile endeavor right now.<br><div><br></div><div>The =
BIP can be found here:</div><div><a href=3D"https://github.com/cryptoquick/=
bips/blob/p2qrh/bip-p2qrh.mediawiki" target=3D"_blank" rel=3D"nofollow" dat=
a-saferedirecturl=3D"https://www.google.com/url?hl=3Den-CA&amp;q=3Dhttps://=
github.com/cryptoquick/bips/blob/p2qrh/bip-p2qrh.mediawiki&amp;source=3Dgma=
il&amp;ust=3D1718459048701000&amp;usg=3DAOvVaw1VGhfaJXk9yhgoagfhKRz5">https=
://github.com/cryptoquick/bips/blob/p2qrh/bip-p2qrh.mediawiki</a><br></div>=
<div><br></div><div>Thank you for your time.</div><div><br></div></blockquo=
te></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com">bitcoind=
ev+unsubscribe@googlegroups.com</a>.<br />
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/bitcoindev/b3561407-483e-46cd-b5e9-d6d48f8dca93n%40googlegroups.=
com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msg=
id/bitcoindev/b3561407-483e-46cd-b5e9-d6d48f8dca93n%40googlegroups.com</a>.=
<br />

------=_Part_13077_601844276.1718373067734--

------=_Part_13076_600048989.1718373067734--