path: root/04/1ee65e3530b9179226c81e7874283d37879504

Delivery-date: Mon, 14 Jul 2025 12:05:50 -0700
Received: from mail-yb1-f184.google.com ([209.85.219.184])
	by mail.fairlystable.org with esmtps  (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.94.2)
	(envelope-from <bitcoindev+bncBDFIP6H73EBBBAFK2XBQMGQENBMM4RI@googlegroups.com>)
	id 1ubOUl-0000Je-Jb
	for bitcoindev@gnusha.org; Mon, 14 Jul 2025 12:05:50 -0700
Received: by mail-yb1-f184.google.com with SMTP id 3f1490d57ef6-e8b5b33c019sf1205821276.2
        for <bitcoindev@gnusha.org>; Mon, 14 Jul 2025 12:05:47 -0700 (PDT)
ARC-Seal: i=2; a=rsa-sha256; t=1752519941; cv=pass;
        d=google.com; s=arc-20240605;
        b=AMPO0yIkt9V80yupzWBSZfQRnLfo/gE5xHHcfu4s40i3DW4Szfer3qEXYDU/+ZrklV
         senF17tcAbPT0yJ/rUpPWNZYqDjVEMHQ5jelcAA7yBZ7VZzAEgimx5l50zjbeNSGoXcf
         dXa2i/xvGweCn85C33UjyPUtqy04v9kJC/FCBqv0lLzPR9myOzc7/WhbQo8gpwPdKaxg
         3j0zbc10Rjgh9OUuEiNwkhgyLEnG53EchPgki53vQ1NlagGJedXNdBBvT1xBlWwyp6/z
         CMKfe1Mmm3/AhIVaACq0nEt05EyPZsfyfO47y7yJrgnYI5jvoecdElxdR2AVtuflwNXe
         EGiw==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:cc:to:subject:message-id:date:from
         :in-reply-to:references:mime-version:sender:dkim-signature
         :dkim-signature;
        bh=k/8UOEsnqpWbPxOvuR+vkorbVHern902Y1yMuZIDNZ8=;
        fh=gNH5HxkhCJArczqpd83UcpkBODiz3TcLAm9lRn9g6J4=;
        b=I2wcN8JwQ7I43KUJNkv/uYknw4GngtOer6bPv3V91RyjqG6nYdTC8TsMDwC7JpAxsT
         VZOIOEsKUEafKFBdlwhPHpOcMD27fONHzaUZra8+gIw17NdF5z5U6jcQpZxLgoEydX/T
         yJjdzyXmuRdz6IV/Uv+dGogiacTGQJYaTKJgSS/H2LqR7jXWJrvBIY6OltZa6xSITcY9
         cwfy+/4liPi/0k3l/0llJYerJLxnPoMP+lD59BwI4R52tXGoNOWuoALsZGupIZS0cZ+8
         FCf0b2VPCkKK/P15zO4K/ag+4iCx+WcI/YCJqQkLThqsrUa15/THo20ntB4GzDTBLmJg
         9Gag==;
        darn=gnusha.org
ARC-Authentication-Results: i=2; gmr-mx.google.com;
       dkim=pass header.i=@gmail.com header.s=20230601 header.b=nqJZcprW;
       spf=pass (google.com: domain of jameson.lopp@gmail.com designates 2a00:1450:4864:20::12c as permitted sender) smtp.mailfrom=jameson.lopp@gmail.com;
       dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;
       dara=pass header.i=@googlegroups.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlegroups.com; s=20230601; t=1752519941; x=1753124741; darn=gnusha.org;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:x-original-authentication-results
         :x-original-sender:cc:to:subject:message-id:date:from:in-reply-to
         :references:mime-version:sender:from:to:cc:subject:date:message-id
         :reply-to;
        bh=k/8UOEsnqpWbPxOvuR+vkorbVHern902Y1yMuZIDNZ8=;
        b=UMva6CjZQ1qud1hr9CfZpqGvbDch5t6a1JWAxAaImi4P5/cVOfQKoOydXk1WMJkGxu
         kJs3DZu5POhoX8zdw4dfy5TKvsgbcyz+r4TYQ2snvbouf/myjTZyhIJgrc6Oe9lvx/De
         HwmOMbz4/u7p+AMXejqO9fYiSCTNZX6yBaipztbjeFQRaYcjztdowGsQsXQdzM6YQWHg
         KhFkhnz0voSW4yqnTF5w+7xvDWDNg9K18flgJJnmfEb9qgZPJU6uNmH3f1Nx7n+hLDhN
         tijWCc76gNh0eCvs7NK0tJn6RPu3CZHb/VJ00vpUuHmR0R1v7XKDuC/W7FwU33gYnZKd
         7W9g==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1752519941; x=1753124741; darn=gnusha.org;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:x-original-authentication-results
         :x-original-sender:cc:to:subject:message-id:date:from:in-reply-to
         :references:mime-version:from:to:cc:subject:date:message-id:reply-to;
        bh=k/8UOEsnqpWbPxOvuR+vkorbVHern902Y1yMuZIDNZ8=;
        b=YJgqbwgjXztJ1jJxxEpMh6Myue51AA9UH4QEgD1kNR3LJzCJeZR+VFRNHXc0GW80ZQ
         FYS+0+MixwPo5aC1tluLCqXRGkkIskinv4QyWv5xAjldW5QM3wYCC33RxywT94V/3r1L
         mI3ZfuQo++TKW9ulG27Z2pLgupqdYwK1F5aAmFNWNn4SA5Zh4Avq/CCM8NSqqjFts2L9
         Jz08yVWCZlfiml5bibk1QUimOhacCe+auO1IZAqyAT83vhuT7KuIePmVAa6XkzROW1sb
         Ohe7jRUQjEhAarPqYvHh7IWv2qTi2EkSUmRxhwXp/pI0Tp0ZJWTCA+7rj00Z0TmVDkM+
         TYNQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1752519941; x=1753124741;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:x-original-authentication-results
         :x-original-sender:cc:to:subject:message-id:date:from:in-reply-to
         :references:mime-version:x-beenthere:x-gm-message-state:sender:from
         :to:cc:subject:date:message-id:reply-to;
        bh=k/8UOEsnqpWbPxOvuR+vkorbVHern902Y1yMuZIDNZ8=;
        b=b6tlDYMpSLFNKbLhUW06UmohuUqz1dBFubgR0v+nc7v9cZCljGweHEf8MWg4YmlV1O
         2muHufxDnLELb3w7EHkVGExQtJnA6b6FW4/Baibb2ssCerfsWGMS24HzAT7fO82oYPfG
         9n4e7T3NzOO61z/30y3zeV+0Z7qI1ockx3u2x0trAsNik54Bfbu6/fyn07TuXaC3+U8z
         CF+bkaFLDlAJbsqN8hOFGaHvFIGVps/EG4ekqGBJQMQt/Cw6h/hmnJAmHRcVIGKdgH9v
         itMgQbgYqZxwBaSpB9lLgp2b1vCf5f0fZCwwHAAvKmgPqoycf6JMf+2ECVYmjg8M9ERK
         MYFg==
Sender: bitcoindev@googlegroups.com
X-Forwarded-Encrypted: i=2; AJvYcCUtANKHtymhul53HrAjOvIrBzBcEhu7RWNRnLFm6oTeQ7+0HWVel5jgg3ammtMDCO5/Xw5E8ZVHerlY@gnusha.org
X-Gm-Message-State: AOJu0Yw+K8AeQIWYaizMl20UGGrpagzN1bgLxJgvuSOrGRZTY494jUsM
	yG3W3nBh9grbRSi6H6WV2mGoIoCefp4Z6ls9dAlUumrtrpISKng9eRC6
X-Google-Smtp-Source: AGHT+IFEWLLmPnOuHeynRnyXSt1DxkpyC1nhmIlodujsW8+PJa/2Ken21A0/uVuSQVcZ8TSJJj+ryw==
X-Received: by 2002:a05:6902:e04:b0:e89:9dc0:e0a2 with SMTP id 3f1490d57ef6-e8b8665a4c2mr7125944276.4.1752519941118;
        Mon, 14 Jul 2025 12:05:41 -0700 (PDT)
X-BeenThere: bitcoindev@googlegroups.com; h=AZMbMZcZfcknhloFHx1BOiucl47wkNt44Onn6nH2Ro3yP2XqyQ==
Received: by 2002:a25:e005:0:b0:e7d:8991:61bf with SMTP id 3f1490d57ef6-e8b778fe0e9ls2805287276.1.-pod-prod-01-us;
 Mon, 14 Jul 2025 12:05:36 -0700 (PDT)
X-Received: by 2002:a05:690c:38a:b0:712:36f3:f6d7 with SMTP id 00721157ae682-717db2b0527mr170676547b3.32.1752519936051;
        Mon, 14 Jul 2025 12:05:36 -0700 (PDT)
Received: by 2002:a05:600c:1c1f:b0:456:53b:5b5e with SMTP id 5b1f17b1804b1-4561334fd09ms5e9;
        Mon, 14 Jul 2025 11:52:34 -0700 (PDT)
X-Received: by 2002:a5d:5f09:0:b0:3a3:7593:818b with SMTP id ffacd0b85a97d-3b5f1880913mr11800267f8f.21.1752519151997;
        Mon, 14 Jul 2025 11:52:31 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1752519151; cv=none;
        d=google.com; s=arc-20240605;
        b=McWwEO6ugqAIfrtt8p8gmxk9ETGbl0Ni+pcSpGFqJH98jNzRWLnpUxy8yMP8B9fz2g
         vc7sZLtM1gtuqcuk5t1TyEkVuCOY/CY8B9LMjU69DY9O2KCzoq/fGji+0h8DLs0N2wo3
         xS+WqRUDhuGA/+bV7BhzgDSoEMbOOmNh+fOn3TWOEF31KAM94cuVJmvCwm/LcCrqOETu
         Dx3BXtN9gjYC5ZYtR2dohizZbj+wtWsGxlRGky6WqB/scQF/LQ6Hdug0d1RNGbHoYv/a
         T6PqnmaficfIScqaUAQVTL6Utmt9JN4L2ViDmxqCOaBxZ3bR+rKyyhg6f6Rmh2BJAdvr
         v2fw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
        h=cc:to:subject:message-id:date:from:in-reply-to:references
         :mime-version:dkim-signature;
        bh=reWILonZJJD1UWsz2RRPMq8sI2WMpjZwKxpPHAdrrrA=;
        fh=sapDHqhE46zLmMBeB1lkoe0zq8J9+V3Afx71/j8kvug=;
        b=RV5qX+qoESfJDu0X7nr/jdGgpIaZsbUidVkvPSTVMADmknAmogZDDigiHAnP2Gahcp
         Su58wMJlM8ICEKpPTLM/CWQ0ii9wcBNTNoprH1PDtNEN2R2slrPubaqJBICc3AGJqDAB
         ivQN/iZ9Ux7avk8w+GTlEY7hiYKj4hTmXtXRGRP7F3c7vuBlvEaAE4ZPGsBbjoDdpCEL
         SkthdRfeIluZGCmsMuEZ6KuX75SnEFULZCo+ItVOAHyHirtfNoZql5sb/RMXWgkgYw+q
         TQxNM7bMASIYUUurLVnzvrDe8GT+2TLYly7f9Kgf8F1z+YchcK6WxqCz5s0dbFVwqU07
         Hovg==;
        dara=google.com
ARC-Authentication-Results: i=1; gmr-mx.google.com;
       dkim=pass header.i=@gmail.com header.s=20230601 header.b=nqJZcprW;
       spf=pass (google.com: domain of jameson.lopp@gmail.com designates 2a00:1450:4864:20::12c as permitted sender) smtp.mailfrom=jameson.lopp@gmail.com;
       dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;
       dara=pass header.i=@googlegroups.com
Received: from mail-lf1-x12c.google.com (mail-lf1-x12c.google.com. [2a00:1450:4864:20::12c])
        by gmr-mx.google.com with ESMTPS id 5b1f17b1804b1-455edeb6b25si2105245e9.2.2025.07.14.11.52.31
        for <bitcoindev@googlegroups.com>
        (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
        Mon, 14 Jul 2025 11:52:31 -0700 (PDT)
Received-SPF: pass (google.com: domain of jameson.lopp@gmail.com designates 2a00:1450:4864:20::12c as permitted sender) client-ip=2a00:1450:4864:20::12c;
Received: by mail-lf1-x12c.google.com with SMTP id 2adb3069b0e04-553ba7f11cbso4694039e87.1
        for <bitcoindev@googlegroups.com>; Mon, 14 Jul 2025 11:52:31 -0700 (PDT)
X-Gm-Gg: ASbGncuxbdrm0yT6+MGDgIT5Loaa4p9bXOStlbugVFlUF70vgtfMgx5hNaIT/wv1o5z
	gV81ptPY37fc218nFGttX2TUsg3YBZuR7FENZk/lq15ZD+YHpkoNOz+PWLGbUfreQY1zqoigolr
	6K/JrlSIGU6wFjKYgmLNkGymWZ9rW9XlUFqVFsmQnakLzrP9lTltXk3JH5b0rqOJisOz6i3mGv4
	30Q194=
X-Received: by 2002:a05:6512:110d:b0:554:f74b:789e with SMTP id
 2adb3069b0e04-55a04633397mr4485634e87.43.1752519150697; Mon, 14 Jul 2025
 11:52:30 -0700 (PDT)
MIME-Version: 1.0
References: <CADL_X_fpv-aXBxX+eJ_EVTirkAJGyPRUNqOCYdz5um8zu6ma5Q@mail.gmail.com>
 <37ed2e5d-34cd-4391-84b8-5bcc6d42c617n@googlegroups.com> <4d9ce13e-466d-478b-ab4d-00404c80d620n@googlegroups.com>
In-Reply-To: <4d9ce13e-466d-478b-ab4d-00404c80d620n@googlegroups.com>
From: Jameson Lopp <jameson.lopp@gmail.com>
Date: Mon, 14 Jul 2025 14:52:17 -0400
X-Gm-Features: Ac12FXysF7q1eRvH1psP0knynQcNjsy6RLPkeGUIbVXKJe-HDLJ3zyIokpgOYfA
Message-ID: <CADL_X_f3sDECRUosNaXyez3F_inKjJAWm=ESm3DSLCKD4JV7yA@mail.gmail.com>
Subject: Re: [bitcoindev] Re: A Post Quantum Migration Proposal
To: Antoine Riard <antoine.riard@gmail.com>
Cc: Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Content-Type: multipart/alternative; boundary="0000000000007083180639e82939"
X-Original-Sender: jameson.lopp@gmail.com
X-Original-Authentication-Results: gmr-mx.google.com;       dkim=pass
 header.i=@gmail.com header.s=20230601 header.b=nqJZcprW;       spf=pass
 (google.com: domain of jameson.lopp@gmail.com designates 2a00:1450:4864:20::12c
 as permitted sender) smtp.mailfrom=jameson.lopp@gmail.com;       dmarc=pass
 (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;       dara=pass header.i=@googlegroups.com
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com
List-ID: <bitcoindev.googlegroups.com>
X-Google-Group-Id: 786775582512
List-Post: <https://groups.google.com/group/bitcoindev/post>, <mailto:bitcoindev@googlegroups.com>
List-Help: <https://groups.google.com/support/>, <mailto:bitcoindev+help@googlegroups.com>
List-Archive: <https://groups.google.com/group/bitcoindev
List-Subscribe: <https://groups.google.com/group/bitcoindev/subscribe>, <mailto:bitcoindev+subscribe@googlegroups.com>
List-Unsubscribe: <mailto:googlegroups-manage+786775582512+unsubscribe@googlegroups.com>,
 <https://groups.google.com/group/bitcoindev/subscribe>
X-Spam-Score: -0.5 (/)

--0000000000007083180639e82939
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Jul 14, 2025 at 10:09=E2=80=AFAM Antoine Riard <antoine.riard@gmail=
.com>
wrote:

> Hi Jameson,
>
> Thanks for your thoughts on this complex subject.
>
> First and foremost, I think your following statement: "Never before has
> Bitcoin faced
> an existential threat to its cryptographic primitives" is very myopic,
> given that
> cryptanalysts and number theorists are making progress every year in thei=
r
> works, and
> each bitcoin cryptographic primitive has been and is constantly analyzed
> to uncover
> potential weaknesses.
>
> So in my view the quantum threat is a bit less specific that the image
> you're painting
> of it. Even if go all to upgrade to lattices-based schemes, we have no
> certainty that
> novels flaws won't be found, one can just go to see the modifications of
> the NIST-approved
> schemes in between their rounds of selection that we'll never reach
> something like
> "self-sovereign peace of mind"...Unless we start to forbid people of
> practicing the
> art of mathematics, practice which has been ongoing since Euclide and
> Pythagore...
>
> I do concede that quantum is a bit different, as after all new physics
> paradigm
> do not happen often (Heisenberg published in the 20s iirc), though that's
> in my
> view the flaw of your reasoning as you're assuming some "post-quantum"
> upgraded
> state where bitcoin, as a community and a network, would be definitely
> safe from
> advances in applied science. At minima, in my understanding, you're
> arguing this
> time is different to justify extra-ordinary technical measures never seen
> before,
> namely the freezing of "vulnerable" coins.
>
>
Correct, this time is different in that we're not talking about vague
unknown weaknesses. Rather, we're talking about a known algorithm that
makes breaking cryptographic primitives orders of magnitude cheaper.

The unknown becomes the rate at which advancements in quantum computing
will be achieved, which is concerning given the funding going into pushing
said advancements forward.


> I'm worried this is opening a Pandora box, where we would introduce a
> precedent
> that it is legitimate as a community to technicaly confiscate some coins
> of users,
> without their _consents_, for extra-ordinary reasons. That's opening a
> worms of
> shenanigans in the future...There is no guarantee that this precedent won=
't
> be leveraged in the future by any group of entities to justify future
> upgrades
> eroding one of the "fundamental property" you're yourself deeming as
> valuable.
>
>
This is a fair fear, though the counterpoint is that it is legitimate for
the community to protect itself against security threats. It just so
happens that both viewpoints can be valid.

This is especially worrying as if I'm understanding you correctly you're
> justifying
> this position as that somehow we should protect the price of the currency
> as an end
> in itself (i.e "Beyond its impact on price, ..."). It's unclear the price
> of bitcoin
> versus what fiat or hard asset (e.g oil) you have in mind. And in anyway,
> as far
> as I know, none of the bitcoin devs is seating on the board of the FED,
> the ECB
> or the BoJ...
>
> To put it simply, even if a quantum attacker can tomorrow starts to steal
> vulnerable coins, 1 BTC will be always equal to 1 BTC. Full stop. In my
> humble
> opinion, let's not introduce the idea that, we, as a community of
> stakeholders
> and developers we have a positive "fiduciary" duty to act to maintain the
> price
> of bitcoin in some "monetary snake" with another class of assets...
>
>
Protocol developers have no fiduciary duty to bitcoin holders. I wouldn't
argue they have any duty whatsoever to users.

Bitcoin is not (yet) a unit of account. The ecosystem does not run on 1 BTC
=3D 1 BTC. The purchasing power of satoshis is very much relevant to the
health and sustainability of the ecosystem at its current level.

I would not claim that "devs must do something" - rather, I believe that
the incentives of other groups I outlined will roughly align them with my
thinking.

That's also the problem with game theory, all the matrices of analysis are
> based on some scale of utilitarism. See Von Neuman's Theory of Games, the
> section on "The Notion of Utility". My subjective appreciation of the val=
ue
> of my coins might not be your subjective appreication of the value of you=
r
> coins.
>
> Now I do understand the perspective of the institutional holders, the
> exchanges,
> the custodians or any other industry providers, who might be in the full
> uncertainty
> about their business responsibilities in case of a quantum threat
> affecting their
> custodied coins. But, first legally speaking there is something call
> "force majeure"
> and in view of the quantum threat, which is a risk discussed far beyond
> the bitcoin
> industry, they should be able to shield themselves behind that. Secondly,
> if there
> is any futute upgrade "opt-in" only path a la BIP360, you can move your
> funds or
> the ones under custody  under a PQC scheme like Dilthium or Falcon and be
> good
> without caring about what the others users are doing. Thirdly, if you're
> an actor
> in the industry like Coinbase and you're deeply concerned about how
> extended maelstrom
> on the price might affect the viability of your operations, it is unclear
> to me why
> you don't call MunichRe or any other company like that tomorrow to craft
> and be
> covered by specific insurance on quantum threats...
>
> Agreed that companies may be legally protected from lawsuits. Not sure
about the insurance angle, though I'd see that as a one time payout
that could very well come at the expense of said business ceasing
operations. I suspect few businesses would be happy with that.

Unfortunately I don't think opt-in security suffices in this situation.
Human nature is to procrastinate and if the incentives are insufficient to
motivate mass migration to quantum secure schemes, Q-Day will be
quite unpleasant.


> To be frank, all those considerations on how "I cannot see how the
> currency can
> maintain any value at all in such a setting", is a strong red flag of low
> time
> preferences. It's not like we're used to strong volatility in bitcoin wit=
h
> the
> almost 2 decades of operations of the network. In my view, it's more a
> hint of
> very high-exposition by some to a single class of asset, i.e bitcoin,
> rather than wise
> diversification... And a push to sacrify a "fundamental property" i.e
> "conservatism"
> in view of short-term concerns (i.e the stability of the currency price
> along
> a period of few years).
>
>
Bitcoin has many inviolable properties and some of them are actually in
conflict with each other. Conservatism and property rights are clearly on
the table in this matter.

But shouldn't one of Bitcoin's fundamental properties be the fact that it
can be upgraded? That it can respond to new challenges and threats?

Beyond just the quantum computing issue, I expect the above to create
continued conflict between ossifiers and developers over the long term.

Do not get me wrong, I'm certainly not of the school "let's reward quantum
> attackers". Leveraging techical superiority and employing CRQRC to steal
> vulnerable coins would be clearly a theft. But ethically, the best we can
> do is
> to have an opt-in upgrade path and be pro-active, by education and
> outreach,
> to have the maximum of coin owners upgrading to non-vulnerable addresses
> types.
> Then show the level of "fortitude" or "endurance" as a community in face
> of price
> fluctuations for a while, while seeing regularly old P2PK coins hacked.
> Marcus
> Aurelius can be bought for few bucks in most of decent libraries...
>
>
Beware the blurry line between stoicism and apathy.

How well will it play out if we can say "well, we could have stopped a
massive threat but chose not to, because we were confident the system would
survive."

The alternative path is "we saw a threat coming and the community
collaborated to neutralize it before massive harm occurred."

Both scenarios show resilience. Which evokes greater confidence?

I'm definitely on the "no old coins confiscation" position you're
> underlighting:
>
> "I don't see why old coins should be confiscated. The better option is to
> let
> those with quantum computers free up old coins. While this might have an
> inflationary impact on bitcoin's price, to use a turn of phrase, the
> inflation
> is transitory. Those with low time preference should support returning lo=
st
> coins to circulation".
>
> Notwhitstanding that I disagree with your position, one can only apprecia=
te
> the breadth and depth with which you're gathering and articulating all th=
e
> elements on this complex problem.
>
> Best,
> Antoine
> OTS hash: c064b43047bf3036faf098b5ac8e74930df63d25629f590a419522297940282=
6
> Le lundi 14 juillet 2025 =C3=A0 00:53:34 UTC+1, Tadge Dryja a =C3=A9crit =
:
>
>> Hi
>>
>> While I generally agree that "freeze" beats "steal", and that a lot of
>> lead time is good, I don't think this plan is viable.
>> To me the biggest problem is that it ties activation of a PQ output type
>> to *de*activation of EC output types.  That would mean that someone who
>> wants to keep using all the great stuff in libsecp256k1 should try to
>> prevent BIP360 from being activated.
>>
>> Sure, there can be risks from CRQCs.  But this proposal would go the
>> other direction, disabling important functionality and even destroying
>> coins preemptively, in anticipation of something that may never happen.
>>
>> Also, how do you define "quantum-vulnerable UTXO"?  Would any P2PKH, or
>> P2WPKH output count?  Or only P2PKH / P2WPKH outputs where the public ke=
y
>> is already known?  I can understand disabling spends from known-pubkey
>> outputs, but for addresses where the public key has never been revealed,
>> commit/reveal schemes (like the one I posted about & am working on a
>> follow-up post for) should safely let people spend from those outputs
>> indefinitely.
>>
>> With no evidence of a QRQC, I can see how there would be people who'd sa=
y
>> "We might never really know if a CRQC exists, so we need to disable EC
>> spends out of caution" and others who'd say "Don't disable EC spends, si=
nce
>> that's destroying coins", and that could be a persistent disagreement.  =
But
>> I hope if we did in fact have a proof that a CRQC has broken secp256k1,
>> there would be significant agreement on freezing known-pubkey EC outputs=
.
>>
>> -Tadge
>> On Saturday, July 12, 2025 at 8:46:09=E2=80=AFPM UTC-4 Jameson Lopp wrot=
e:
>>
>>> Building upon my earlier essay against allowing quantum recovery of
>>> bitcoin
>>> <https://groups.google.com/g/bitcoindev/c/uUK6py0Yjq0/m/6peEaa90AQAJ> I
>>> wish to formalize a proposal after several months of discussions.
>>>
>>> This proposal does not delve into the multitude of issues regarding pos=
t
>>> quantum cryptography and trade-offs of different schemes, but rather is
>>> meant to specifically address the issues of incentivizing adoption and
>>> migration of funds *after* consensus is established that it is prudent
>>> to do so.
>>>
>>> As such, this proposal requires P2QRH as described in BIP-360 or
>>> potential future proposals.
>>> Abstract
>>>
>>> This proposal follows the implementation of post-quantum (PQ) output
>>> type (P2QRH) and introduces a pre-announced sunset of legacy ECDSA/Schn=
orr
>>> signatures. It turns quantum security into a private incentive: fail to
>>> upgrade and you will certainly lose access to your funds, creating a
>>> certainty where none previously existed.
>>>
>>>    -
>>>
>>>    Phase A: Disallows sending of any funds to quantum-vulnerable
>>>    addresses, hastening the adoption of P2QRH address types.
>>>    -
>>>
>>>    Phase B: Renders ECDSA/Schnorr spends invalid, preventing all
>>>    spending of funds in quantum-vulnerable UTXOs. This is triggered by =
a
>>>    well-publicized flag-day roughly five years after activation.
>>>    -
>>>
>>>    Phase C (optional): Pending further research and demand, a separate
>>>    BIP proposing a fork to allow recovery of legacy UTXOs through ZK pr=
oof of
>>>    possession of BIP-39 seed phrase.
>>>
>>> Motivation
>>>
>>> We seek to secure the value of the UTXO set and minimize incentives for
>>> quantum attacks. This proposal is radically different from any in Bitco=
in=E2=80=99s
>>> history just as the threat posed by quantum computing is radically
>>> different from any other threat in Bitcoin=E2=80=99s history.  Never be=
fore has
>>> Bitcoin faced an existential threat to its cryptographic primitives. A
>>> successful quantum attack on Bitcoin would result in significant econom=
ic
>>> disruption and damage across the entire ecosystem. Beyond its impact on
>>> price, the ability of miners to provide network security may be
>>> significantly impacted.
>>>
>>>    -
>>>
>>>    Accelerating quantum progress.
>>>    -
>>>
>>>       NIST ratified three production-grade PQ signature schemes in
>>>       2024; academic road-maps now estimate a cryptographically-relevan=
t quantum
>>>       computer as early as 2027-2030. [McKinsey
>>>       <https://www.mckinsey.com/~/media/mckinsey/business%20functions/m=
ckinsey%20digital/our%20insights/the%20year%20of%20quantum%20from%20concept=
%20to%20reality%20in%202025/quantum-monitor-2025.pdf?shouldIndex=3Dfalse>
>>>       ]
>>>       -
>>>
>>>    Quantum algorithms are rapidly improving
>>>    -
>>>
>>>       The safety envelope is shrinking by dramatic increases in
>>>       algorithms even if the pace of hardware improvements is slower. A=
lgorithms
>>>       are improving up to 20X
>>>       <https://security.googleblog.com/2025/05/tracking-cost-of-quantum=
-factori.html>,
>>>       lowering the theoretical hardware requirements for breaking class=
ical
>>>       encryption.
>>>       -
>>>
>>>    Bitcoin=E2=80=99s exposed public keys.
>>>    -
>>>
>>>       Roughly 25% of all bitcoin have revealed a public key on-chain;
>>>       those UTXOs could be stolen with sufficient quantum power.
>>>       -
>>>
>>>    We may not know the attack is underway.
>>>    -
>>>
>>>       Quantum attackers could compute the private key for known public
>>>       keys then transfer all funds weeks or months later, in a covert b=
leed to
>>>       not alert chain watchers. Q-Day may be only known much later if t=
he attack
>>>       withholds broadcasting transactions in order to postpone revealin=
g their
>>>       capabilities.
>>>       -
>>>
>>>    Private keys become public.
>>>    -
>>>
>>>       Assuming that quantum computers are able to maintain their
>>>       current trajectories and overcome existing engineering obstacles,=
 there is
>>>       a near certain chance that all P2PK (and other outputs with expos=
ed
>>>       pubkeys) private keys will be found and used to steal the funds.
>>>       -
>>>
>>>    Impossible to know motivations.
>>>    -
>>>
>>>       Prior to a quantum attack, it is impossible to know the
>>>       motivations of the attacker.  An economically motivated attacker =
will try
>>>       to remain undetected for as long as possible, while a malicious a=
ttacker
>>>       will attempt to destroy as much value as possible.
>>>       -
>>>
>>>    Upgrade inertia.
>>>    -
>>>
>>>       Coordinating wallets, exchanges, miners and custodians
>>>       historically takes years.
>>>       -
>>>
>>>       The longer we postpone migration, the harder it becomes to
>>>       coordinate wallets, exchanges, miners, and custodians. A clear, t=
ime-boxed
>>>       pathway is the only credible defense.
>>>       -
>>>
>>>       Coordinating distributed groups is more prone to delay, even if
>>>       everyone has similar motivations. Historically, Bitcoin has been =
slow to
>>>       adopt code changes, often taking multiple years to be approved.
>>>
>>> Benefits at a Glance
>>>
>>>    -
>>>
>>>    Resilience: Bitcoin protocol remains secure for the foreseeable
>>>    future without waiting for a last-minute emergency.
>>>    -
>>>
>>>    Certainty: Bitcoin users and stakeholders gain certainty that a plan
>>>    is both in place and being implemented to effectively deal with the =
threat
>>>    of quantum theft of bitcoin.
>>>    -
>>>
>>>    Clarity: A single, publicized timeline aligns the entire ecosystem
>>>    (wallets, exchanges, hardware vendors).
>>>    -
>>>
>>>    Supply Discipline: Abandoned keys that never migrate become
>>>    unspendable, reducing supply, as Satoshi described
>>>    <https://bitcointalk.org/index.php?topic=3D198.msg1647#msg1647>.
>>>
>>> Specification
>>>
>>> Phase
>>>
>>> What Happens
>>>
>>> Who Must Act
>>>
>>> Time Horizon
>>>
>>> Phase A - Disallow spends to legacy script types
>>>
>>> Permitted sends are from legacy scripts to P2QRH scripts
>>>
>>> Everyone holding or accepting BTC.
>>>
>>> 3 years after BIP-360 implementation
>>>
>>> Phase B =E2=80=93 Disallow spends from quantum vulnerable outputs
>>>
>>> At a preset block-height, nodes reject transactions that rely on
>>> ECDSA/Schnorr keys.
>>>
>>> Everyone holding or accepting BTC.
>>>
>>> 2 years after Phase A activation.
>>>
>>> Phase C =E2=80=93 Re-enable spends from quantum vulnerable outputs via =
ZK Proof
>>>
>>> Users with frozen quantum vulnerable funds and a HD wallet seed phrase
>>> can construct a quantum safe ZK proof to recover funds.
>>>
>>> Users who failed to migrate funds before Phase B.
>>>
>>> TBD pending research, demand, and consensus.
>>> Rationale
>>>
>>>    -
>>>
>>>    Even if Bitcoin is not a primary initial target of a
>>>    cryptographically relevant quantum computer, widespread knowledge th=
at such
>>>    a computer exists and is capable of breaking Bitcoin=E2=80=99s crypt=
ography will
>>>    damage faith in the network .
>>>    -
>>>
>>>    An attack on Bitcoin may not be economically motivated - an attacker
>>>    may be politically or maliciously motivated and may attempt to destr=
oy
>>>    value and trust in Bitcoin rather than extract value.  There is no w=
ay to
>>>    know in advance how, when, or why an attack may occur.  A defensive
>>>    position must be taken well in advance of any attack.
>>>    -
>>>
>>>    Bitcoin=E2=80=99s current signatures (ECDSA/Schnorr) will be a tanta=
lizing
>>>    target: any UTXO that has ever exposed its public key on-chain (roug=
hly 25
>>>    % of all bitcoin) could be stolen by a cryptographically relevant qu=
antum
>>>    computer.
>>>    -
>>>
>>>    Existing Proposals are Insufficient.
>>>    1.
>>>
>>>       Any proposal that allows for the quantum theft of =E2=80=9Clost=
=E2=80=9D bitcoin
>>>       is creating a redistribution dilemma. There are 3 types of propos=
als:
>>>       1.
>>>
>>>          Allow anyone to steal vulnerable coins, benefitting those who
>>>          reach quantum capability earliest.
>>>          2.
>>>
>>>          Allow throttled theft of coins, which leads to RBF battles and
>>>          ultimately miners subsidizing their revenue from lost coins.
>>>          3.
>>>
>>>          Allow no one to steal vulnerable coins.
>>>          -
>>>
>>>    Minimizes attack surface
>>>    1.
>>>
>>>       By disallowing new spends to quantum vulnerable script types, we
>>>       minimize the attack surface with each new UTXO.
>>>       2.
>>>
>>>       Upgrades to Bitcoin have historically taken many years; this will
>>>       hasten and speed up the adoption of new quantum resistant script =
types.
>>>       3.
>>>
>>>       With a clear deadline, industry stakeholders will more readily
>>>       upgrade existing infrastructure to ensure continuity of services.
>>>       -
>>>
>>>    Minimizes loss of access to funds
>>>    1.
>>>
>>>       If there is sufficient demand and research proves possible,
>>>       submitting a ZK proof of knowledge of a BIP-39 seed phrase corres=
ponding to
>>>       a public key hash or script hash would provide a trustless means =
for legacy
>>>       outputs to be spent in a quantum resistant manner, even after the=
 sunset.
>>>
>>>
>>> Stakeholder
>>>
>>> Incentive to Upgrade
>>>
>>> Miners
>>>
>>> =E2=80=A2 Larger size PQ signatures along with incentive for users to m=
igrate
>>> will create more demand for block space and thus higher fees collected =
by
>>> miners.
>>>
>>> =E2=80=A2 Post-Phase B, non-upgraded miners produce invalid blocks.
>>>
>>> =E2=80=A2 A quantum attack on Bitcoin will significantly devalue both t=
heir
>>> hardware and Bitcoin as a whole.
>>>
>>> Institutional Holders
>>>
>>> =E2=80=A2 Fiduciary duty: failing to act to prevent a quantum attack on=
 Bitcoin
>>> would violate the fiduciary duty to shareholders.
>>>
>>> =E2=80=A2 Demonstrating Bitcoin=E2=80=99s ability to effectively mitiga=
te emerging
>>> threats will prove Bitcoin to be an investment grade asset.
>>>
>>> Exchanges & Custodians
>>>
>>> =E2=80=A2 Concentrated risk: a quantum hack could bankrupt them overnig=
ht.
>>>
>>> =E2=80=A2 Early migration is cheap relative to potential losses, potent=
ial
>>> lawsuits over improper custody and reputational damage.
>>>
>>> Everyday Users
>>>
>>> =E2=80=A2 Self-sovereign peace of mind.
>>>
>>> =E2=80=A2 Sunset date creates a clear deadline and incentive to improve=
 their
>>> security rather than an open-ended =E2=80=9Csome day=E2=80=9D that invi=
tes procrastination.
>>>
>>> Attackers
>>>
>>> =E2=80=A2 Economic incentive diminishes as sunset nears, stolen coins c=
annot be
>>> spent after Q-day.
>>>
>>> Key Insight: As mentioned earlier, the proposal turns quantum security
>>> into a private incentive to upgrade.
>>>
>>> This is not an offensive attack, rather, it is defensive: our thesis is
>>> that the Bitcoin ecosystem wishes to defend itself and its interests
>>> against those who would prefer to do nothing and allow a malicious acto=
r to
>>> destroy both value and trust.
>>>
>>>
>>> "Lost coins only make everyone else's coins worth slightly more. Think
>>>> of it as a donation to everyone." - Satoshi Nakamoto
>>>
>>>
>>> If true, the corollary is:
>>>
>>>
>>> "Quantum recovered coins only make everyone else's coins worth less.
>>>> Think of it as a theft from everyone."
>>>
>>>
>>> The timelines that we are proposing are meant to find the best balance
>>> between giving ample ability for account owners to migrate while
>>> maintaining the integrity of the overall ecosystem to avoid catastrophi=
c
>>> attacks.
>>>
>>> Backward Compatibility
>>>
>>> As a series of soft forks, older nodes will continue to operate without
>>> modification. Non-upgraded nodes, however, will consider all post-quant=
um
>>> witness programs as anyone-can-spend scripts. They are strongly encoura=
ged
>>> to upgrade in order to fully validate the new programs.
>>>
>>> Non-upgraded wallets can receive and send bitcoin from non-upgraded and
>>> upgraded wallets until Phase A. After Phase A, they can no longer recei=
ve
>>> from any other wallets and can only send to upgraded wallets.  After Ph=
ase
>>> B, both senders and receivers will require upgraded wallets. Phase C wo=
uld
>>> likely require a loosening of consensus rules (a hard fork) to allow
>>> vulnerable funds recovery via ZK proofs.
>>>
>> --
> You received this message because you are subscribed to the Google Groups
> "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to bitcoindev+unsubscribe@googlegroups.com.
> To view this discussion visit
> https://groups.google.com/d/msgid/bitcoindev/4d9ce13e-466d-478b-ab4d-0040=
4c80d620n%40googlegroups.com
> <https://groups.google.com/d/msgid/bitcoindev/4d9ce13e-466d-478b-ab4d-004=
04c80d620n%40googlegroups.com?utm_medium=3Demail&utm_source=3Dfooter>
> .
>

--=20
You received this message because you are subscribed to the Google Groups "=
Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/=
CADL_X_f3sDECRUosNaXyez3F_inKjJAWm%3DESm3DSLCKD4JV7yA%40mail.gmail.com.

--0000000000007083180639e82939
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g=
mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, Jul 14,=
 2025 at 10:09=E2=80=AFAM Antoine Riard &lt;<a href=3D"mailto:antoine.riard=
@gmail.com">antoine.riard@gmail.com</a>&gt; wrote:<br></div><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid =
rgb(204,204,204);padding-left:1ex">Hi Jameson,<br><br>Thanks for your thoug=
hts on this complex subject.<br><br>First and foremost, I think your follow=
ing statement: &quot;Never before has Bitcoin faced<br>an existential threa=
t to its cryptographic primitives&quot; is very myopic, given that<br>crypt=
analysts and number theorists are making progress every year in their works=
, and<br>each bitcoin cryptographic primitive has been and is constantly an=
alyzed to uncover<br>potential weaknesses.<br><br>So in my view the quantum=
 threat is a bit less specific that the image you&#39;re painting<br>of it.=
 Even if go all to upgrade to lattices-based schemes, we have no certainty =
that<br>novels flaws won&#39;t be found, one can just go to see the modific=
ations of the NIST-approved<br>schemes in between their rounds of selection=
 that we&#39;ll never reach something like<br>&quot;self-sovereign peace of=
 mind&quot;...Unless we start to forbid people of practicing the<br>art of =
mathematics, practice which has been ongoing since Euclide and Pythagore...=
<br><br>I do concede that quantum is a bit different, as after all new phys=
ics paradigm<br>do not happen often (Heisenberg published in the 20s iirc),=
 though that&#39;s in my<br>view the flaw of your reasoning as you&#39;re a=
ssuming some &quot;post-quantum&quot; upgraded<br>state where bitcoin, as a=
 community and a network, would be definitely safe from<br>advances in appl=
ied science. At minima, in my understanding, you&#39;re arguing this<br>tim=
e is different to justify extra-ordinary technical measures never seen befo=
re,<br>namely the freezing of &quot;vulnerable&quot; coins.<br><br></blockq=
uote><div><br></div><div>Correct, this time is different in that we&#39;re =
not talking about vague unknown weaknesses. Rather, we&#39;re talking about=
 a known algorithm that makes breaking cryptographic primitives orders of m=
agnitude cheaper.</div><div><br></div><div>The unknown becomes the rate at =
which advancements in quantum computing will be achieved, which is concerni=
ng given the funding going into pushing said advancements forward.</div><di=
v>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px=
 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I&#39;m wor=
ried this is opening a Pandora box, where we would introduce a precedent<br=
>that it is legitimate as a community to technicaly confiscate some coins o=
f users, <br>without their _consents_, for extra-ordinary reasons. That&#39=
;s opening a worms of<br>shenanigans in the future...There is no guarantee =
that this precedent won&#39;t<br>be leveraged in the future by any group of=
 entities to justify future upgrades<br>eroding one of the &quot;fundamenta=
l property&quot; you&#39;re yourself deeming as valuable.<br><br></blockquo=
te><div><br></div><div>This is a fair fear, though the counterpoint is that=
 it is legitimate for the community to protect itself against security thre=
ats. It just so happens that both viewpoints can be valid.</div><div><br></=
div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor=
der-left:1px solid rgb(204,204,204);padding-left:1ex">This is especially wo=
rrying as if I&#39;m understanding you correctly you&#39;re justifying<br>t=
his position as that somehow we should protect the price of the currency as=
 an end<br>in itself (i.e &quot;Beyond its impact on price, ...&quot;). It&=
#39;s unclear the price of bitcoin<br>versus what fiat or hard asset (e.g o=
il) you have in mind. And in anyway, as far<br>as I know, none of the bitco=
in devs is seating on the board of the FED, the ECB<br>or the BoJ...<br><br=
>To put it simply, even if a quantum attacker can tomorrow starts to steal<=
br>vulnerable coins, 1 BTC will be always equal to 1 BTC. Full stop. In my =
humble<br>opinion, let&#39;s not introduce the idea that, we, as a communit=
y of stakeholders<br>and developers we have a positive &quot;fiduciary&quot=
; duty to act to maintain the price<br>of bitcoin in some &quot;monetary sn=
ake&quot; with another class of assets...<br><br></blockquote><div><br></di=
v><div>Protocol developers have no fiduciary duty to bitcoin holders. I wou=
ldn&#39;t argue they have any duty whatsoever=C2=A0to users.</div><div><br>=
</div><div>Bitcoin is not (yet) a unit of account. The ecosystem does not r=
un on 1 BTC =3D 1 BTC. The purchasing power of satoshis is very much releva=
nt to the health and sustainability of the ecosystem at its current level.<=
/div><div><br></div><div>I would not claim that &quot;devs must do somethin=
g&quot; - rather, I believe that the incentives of other groups I outlined =
will roughly align them with my thinking.</div><div><br></div><blockquote c=
lass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px soli=
d rgb(204,204,204);padding-left:1ex">That&#39;s also the problem with game =
theory, all the matrices of analysis are<br>based on some scale of utilitar=
ism. See Von Neuman&#39;s Theory of Games, the<br>section on &quot;The Noti=
on of Utility&quot;. My subjective appreciation of the value<br>of my coins=
 might not be your subjective appreication of the value of your<br>coins.<b=
r><br>Now I do understand the perspective of the institutional holders, the=
 exchanges,<br>the custodians or any other industry providers, who might be=
 in the full uncertainty<br>about their business responsibilities in case o=
f a quantum threat affecting their<br>custodied coins. But, first legally s=
peaking there is something call &quot;force majeure&quot;<br>and in view of=
 the quantum threat, which is a risk discussed far beyond the bitcoin<br>in=
dustry, they should be able to shield themselves behind that. Secondly, if =
there<br>is any futute upgrade &quot;opt-in&quot; only path a la BIP360, yo=
u can move your funds or<br>the ones under custody =C2=A0under a PQC scheme=
 like Dilthium or Falcon and be good<br>without caring about what the other=
s users are doing. Thirdly, if you&#39;re an actor<br>in the industry like =
Coinbase and you&#39;re deeply concerned about how extended maelstrom<br>on=
 the price might affect the viability of your operations, it is unclear to =
me why<br>you don&#39;t call MunichRe or any other company like that tomorr=
ow to craft and be<br>covered by specific insurance on quantum threats...<b=
r><br></blockquote><div>Agreed that companies may be legally protected from=
 lawsuits. Not sure about the insurance angle, though I&#39;d see that as a=
 one time payout that=C2=A0could very=C2=A0well come at the expense of said=
 business ceasing operations. I suspect few businesses would be happy with =
that.</div><div><br></div><div>Unfortunately I don&#39;t think opt-in secur=
ity suffices in this situation. Human nature is to procrastinate and if the=
 incentives are insufficient to motivate mass migration to quantum secure s=
chemes, Q-Day will be quite=C2=A0unpleasant.</div><div>=C2=A0</div><blockqu=
ote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px=
 solid rgb(204,204,204);padding-left:1ex">To be frank, all those considerat=
ions on how &quot;I cannot see how the currency can<br>maintain any value a=
t all in such a setting&quot;, is a strong red flag of low time<br>preferen=
ces. It&#39;s not like we&#39;re used to strong volatility in bitcoin with =
the<br>almost 2 decades of operations of the network. In my view, it&#39;s =
more a hint of<br>very high-exposition by some to a single class of asset, =
i.e bitcoin, rather than wise<br>diversification... And a push to sacrify a=
 &quot;fundamental property&quot; i.e &quot;conservatism&quot;<br>in view o=
f short-term concerns (i.e the stability of the currency price along<br>a p=
eriod of few years).<br><br></blockquote><div><br></div><div>Bitcoin has ma=
ny inviolable properties and some of them are actually in conflict with eac=
h other. Conservatism and property rights are clearly on the table in this =
matter.</div><div><br></div><div>But shouldn&#39;t one of Bitcoin&#39;s fun=
damental properties be the fact that it can be upgraded? That it can respon=
d to new challenges and threats?</div><div><br></div><div>Beyond just the q=
uantum computing issue, I expect the above to create continued conflict bet=
ween ossifiers and developers over the long term.</div><div><br></div><bloc=
kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:=
1px solid rgb(204,204,204);padding-left:1ex">Do not get me wrong, I&#39;m c=
ertainly not of the school &quot;let&#39;s reward quantum<br>attackers&quot=
;. Leveraging techical superiority and employing CRQRC to steal<br>vulnerab=
le coins would be clearly a theft. But ethically, the best we can do is<br>=
to have an opt-in upgrade path and be pro-active, by education and outreach=
,<br>to have the maximum of coin owners upgrading to non-vulnerable address=
es types.<br>Then show the level of &quot;fortitude&quot; or &quot;enduranc=
e&quot; as a community in face of price<br>fluctuations for a while, while =
seeing regularly old P2PK coins hacked. Marcus<br>Aurelius can be bought fo=
r few bucks in most of decent libraries...<br><br></blockquote><div><br></d=
iv><div>Beware the blurry line between stoicism and apathy.</div><div><br><=
/div><div>How well will it play out if we can say &quot;well, we could have=
 stopped a massive threat but chose not to, because we were confident the s=
ystem would survive.&quot;</div><div><br></div><div>The alternative path is=
 &quot;we saw a threat coming and the community collaborated to neutralize =
it before massive harm occurred.&quot;</div><div><br></div><div>Both scenar=
ios show resilience. Which evokes greater confidence?</div><div><br></div><=
blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l=
eft:1px solid rgb(204,204,204);padding-left:1ex">I&#39;m definitely on the =
&quot;no old coins confiscation&quot; position you&#39;re underlighting:<br=
><br>&quot;I don&#39;t see why old coins should be confiscated. The better =
option is to let<br>those with quantum computers free up old coins. While t=
his might have an<br>inflationary impact on bitcoin&#39;s price, to use a t=
urn of phrase, the inflation<br>is transitory. Those with low time preferen=
ce should support returning lost<br>coins to circulation&quot;.<br><br>Notw=
hitstanding that I disagree with your position, one can only appreciate<br>=
the breadth and depth with which you&#39;re gathering and articulating all =
the<br>elements on this complex problem.<br><br>Best,<br>Antoine<br>OTS has=
h: c064b43047bf3036faf098b5ac8e74930df63d25629f590a4195222979402826<br><div=
 class=3D"gmail_quote"><div dir=3D"auto" class=3D"gmail_attr">Le lundi 14 j=
uillet 2025 =C3=A0 00:53:34 UTC+1, Tadge Dryja a =C3=A9crit=C2=A0:<br></div=
><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border=
-left:1px solid rgb(204,204,204);padding-left:1ex">Hi =C2=A0 <br><br>While =
I generally agree that &quot;freeze&quot; beats &quot;steal&quot;, and that=
 a lot of lead time is good, I don&#39;t think this plan is viable.<br>To m=
e the biggest problem is that it ties activation of a PQ output type to *de=
*activation of EC output types.=C2=A0 That would mean that someone who want=
s to keep using all the great stuff in libsecp256k1 should try to prevent B=
IP360 from being activated.<br><br>Sure, there can be risks from CRQCs.=C2=
=A0 But this proposal would go the other direction, disabling important fun=
ctionality and even destroying coins preemptively, in anticipation of somet=
hing that may never happen.<br><br>Also, how do you define &quot;quantum-vu=
lnerable UTXO&quot;?=C2=A0 Would any P2PKH, or P2WPKH output count?=C2=A0 O=
r only P2PKH / P2WPKH outputs where the public key is already known?=C2=A0 =
I can understand disabling spends from known-pubkey outputs, but for addres=
ses where the public key has never been revealed, commit/reveal schemes (li=
ke the one I posted about &amp; am working on a follow-up post for) should =
safely let people spend from those outputs indefinitely.<br><br>With no evi=
dence of a QRQC, I can see how there would be people who&#39;d say &quot;We=
 might never really know if a CRQC exists, so we need to disable EC spends =
out of caution&quot; and others who&#39;d say &quot;Don&#39;t disable EC sp=
ends, since that&#39;s destroying coins&quot;, and that could be a persiste=
nt disagreement.=C2=A0 But I hope if we did in fact have a proof that a CRQ=
C has broken secp256k1, there would be significant agreement on freezing kn=
own-pubkey EC outputs.<br><div><br></div><div>-Tadge</div><div class=3D"gma=
il_quote"><div dir=3D"auto" class=3D"gmail_attr">On Saturday, July 12, 2025=
 at 8:46:09=E2=80=AFPM UTC-4 Jameson Lopp wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><div dir=3D"ltr"><span><p dir=3D"ltr" styl=
e=3D"line-height:1.44;background-color:rgb(255,255,255);margin-top:12pt;mar=
gin-bottom:0pt;padding:0pt 0pt 12pt"><span style=3D"font-size:11pt;font-fam=
ily:&quot;Courier New&quot;,monospace;color:rgb(34,34,34);background-color:=
transparent;font-weight:400;font-style:normal;font-variant:normal;text-deco=
ration:none;vertical-align:baseline;white-space:pre-wrap">Building upon my =
earlier essay </span><a href=3D"https://groups.google.com/g/bitcoindev/c/uU=
K6py0Yjq0/m/6peEaa90AQAJ" style=3D"text-decoration:none" rel=3D"nofollow" t=
arget=3D"_blank"><span style=3D"font-size:11pt;font-family:&quot;Courier Ne=
w&quot;,monospace;color:rgb(17,85,204);background-color:transparent;font-we=
ight:400;font-style:normal;font-variant:normal;text-decoration:underline;ve=
rtical-align:baseline;white-space:pre-wrap">against allowing quantum recove=
ry of bitcoin</span></a><span style=3D"font-size:11pt;font-family:&quot;Cou=
rier New&quot;,monospace;color:rgb(34,34,34);background-color:transparent;f=
ont-weight:400;font-style:normal;font-variant:normal;text-decoration:none;v=
ertical-align:baseline;white-space:pre-wrap"> I wish to formalize a proposa=
l after several months of discussions.</span></p><p dir=3D"ltr" style=3D"li=
ne-height:1.44;background-color:rgb(255,255,255);margin-top:0pt;margin-bott=
om:0pt;padding:0pt 0pt 12pt"><span style=3D"font-size:11pt;font-family:&quo=
t;Courier New&quot;,monospace;color:rgb(34,34,34);background-color:transpar=
ent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:n=
one;vertical-align:baseline;white-space:pre-wrap">This proposal does not de=
lve into the multitude of issues regarding post quantum cryptography and tr=
ade-offs of different schemes, but rather is meant to specifically address =
the issues of incentivizing adoption and migration of funds </span><span st=
yle=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:r=
gb(34,34,34);background-color:transparent;font-weight:400;font-variant:norm=
al;text-decoration:none;vertical-align:baseline;white-space:pre-wrap"><i>af=
ter</i></span><span style=3D"font-size:11pt;font-family:&quot;Courier New&q=
uot;,monospace;color:rgb(34,34,34);background-color:transparent;font-weight=
:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-al=
ign:baseline;white-space:pre-wrap"> consensus is established that it is pru=
dent to do so.</span></p><p dir=3D"ltr" style=3D"line-height:1.44;backgroun=
d-color:rgb(255,255,255);margin-top:0pt;margin-bottom:12pt"><span style=3D"=
font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,=
0);background-color:transparent;font-weight:400;font-style:normal;font-vari=
ant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wra=
p">As such, this proposal requires P2QRH as described in BIP-360 or potenti=
al future proposals.</span></p><h2 dir=3D"ltr" style=3D"line-height:1.38;ma=
rgin-top:18pt;margin-bottom:4pt"><span style=3D"font-size:17pt;font-family:=
&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpa=
rent;font-variant-numeric:normal;font-variant-east-asian:normal;font-varian=
t-alternates:normal;vertical-align:baseline">Abstract</span></h2><p dir=3D"=
ltr" style=3D"line-height:1.38;margin-top:12pt;margin-bottom:12pt"><span st=
yle=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:r=
gb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-var=
iant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseli=
ne">This proposal follows the implementation of post-quantum (PQ) output ty=
pe (P2QRH) and introduces a pre-announced sunset of legacy ECDSA/Schnorr si=
gnatures. It turns quantum security into a </span><span style=3D"font-size:=
11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgro=
und-color:transparent;font-style:italic;font-variant-numeric:normal;font-va=
riant-east-asian:normal;font-variant-alternates:normal;vertical-align:basel=
ine">private incentive</span><span style=3D"font-size:11pt;font-family:&quo=
t;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent=
;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-al=
ternates:normal;vertical-align:baseline">: fail to upgrade and you will cer=
tainly lose access to your funds, creating a certainty where none previousl=
y existed.=C2=A0</span></p><ul style=3D"margin-top:0px;margin-bottom:0px"><=
li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-family:&qu=
ot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transparen=
t;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-a=
lternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir=3D"lt=
r" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt" role=3D"pres=
entation"><span style=3D"font-size:11pt;background-color:transparent;font-w=
eight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-v=
ariant-alternates:normal;vertical-align:baseline">Phase A:</span><span styl=
e=3D"font-size:11pt;background-color:transparent;font-variant-numeric:norma=
l;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-al=
ign:baseline"> Disallows sending of any funds to quantum-vulnerable address=
es, hastening the adoption of P2QRH address types.</span></p></li><li dir=
=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-family:&quot;Cou=
rier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font=
-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alterna=
tes:normal;vertical-align:baseline;white-space:pre-wrap"><p dir=3D"ltr" sty=
le=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt" role=3D"presentati=
on"><span style=3D"font-size:11pt;background-color:transparent;font-weight:=
700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant=
-alternates:normal;vertical-align:baseline">Phase B:</span><span style=3D"f=
ont-size:11pt;background-color:transparent;font-variant-numeric:normal;font=
-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:ba=
seline"> Renders ECDSA/Schnorr spends invalid, preventing all spending of f=
unds in quantum-vulnerable UTXOs. This is triggered by a well-publicized fl=
ag-day roughly five years after activation.</span></p></li><li dir=3D"ltr" =
style=3D"list-style-type:disc;font-size:11pt;font-family:&quot;Courier New&=
quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-variant-=
numeric:normal;font-variant-east-asian:normal;font-variant-alternates:norma=
l;vertical-align:baseline;white-space:pre-wrap"><p dir=3D"ltr" style=3D"lin=
e-height:1.38;margin-top:0pt;margin-bottom:6pt" role=3D"presentation"><span=
 style=3D"font-size:11pt;background-color:transparent;font-weight:700;font-=
variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternat=
es:normal;vertical-align:baseline">Phase C (optional):</span><span style=3D=
"font-size:11pt;background-color:transparent;font-variant-numeric:normal;fo=
nt-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:=
baseline"> Pending further research and demand, a separate BIP proposing a =
fork to allow recovery of legacy UTXOs through ZK proof of possession of BI=
P-39 seed phrase.=C2=A0=C2=A0</span></p></li></ul><h2 dir=3D"ltr" style=3D"=
line-height:1.38;text-align:justify;margin-top:14pt;margin-bottom:6pt"><spa=
n style=3D"font-size:16pt;font-family:&quot;Courier New&quot;,monospace;col=
or:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font=
-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:ba=
seline">Motivation</span></h2><p dir=3D"ltr" style=3D"line-height:1.38;text=
-align:justify;margin-top:12pt;margin-bottom:12pt"><span style=3D"font-size=
:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgr=
ound-color:transparent;font-variant-numeric:normal;font-variant-east-asian:=
normal;font-variant-alternates:normal;vertical-align:baseline">We seek to s=
ecure the value of the UTXO set</span><span style=3D"font-size:11pt;font-fa=
mily:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:tr=
ansparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asi=
an:normal;font-variant-alternates:normal;vertical-align:baseline"> </span><=
span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;=
color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;f=
ont-variant-east-asian:normal;font-variant-alternates:normal;vertical-align=
:baseline">and minimize incentives for quantum attacks. This proposal is ra=
dically different from any in Bitcoin=E2=80=99s history just as the threat =
posed by quantum computing is radically different from any other threat in =
Bitcoin=E2=80=99s history.=C2=A0 Never before has Bitcoin faced an existent=
ial threat to its cryptographic primitives. A successful quantum attack on =
Bitcoin would result in significant economic disruption and damage across t=
he entire ecosystem. Beyond its impact on price, the ability of miners to p=
rovide network security may be significantly impacted.=C2=A0=C2=A0</span></=
p><ul style=3D"margin-top:0px;margin-bottom:0px"><li dir=3D"ltr" style=3D"l=
ist-style-type:disc;font-size:11pt;font-family:&quot;Courier New&quot;,mono=
space;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:no=
rmal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical=
-align:baseline;white-space:pre-wrap"><p dir=3D"ltr" style=3D"line-height:1=
.38;margin-top:12pt;margin-bottom:0pt" role=3D"presentation"><span style=3D=
"font-size:11pt;background-color:transparent;font-weight:700;font-variant-n=
umeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal=
;vertical-align:baseline">Accelerating quantum progress.</span><span style=
=3D"font-size:11pt;background-color:transparent;font-variant-numeric:normal=
;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-ali=
gn:baseline">=C2=A0</span></p></li><ul style=3D"margin-top:0px;margin-botto=
m:0px"><li dir=3D"ltr" style=3D"list-style-type:circle;font-size:11pt;font-=
family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:=
transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font=
-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p=
 dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt" ro=
le=3D"presentation"><span style=3D"font-size:11pt;background-color:transpar=
ent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant=
-alternates:normal;vertical-align:baseline">NIST ratified three production-=
grade PQ signature schemes in 2024; academic road-maps now estimate a crypt=
ographically-relevant quantum computer as early as 2027-2030. [</span><a hr=
ef=3D"https://www.mckinsey.com/~/media/mckinsey/business%20functions/mckins=
ey%20digital/our%20insights/the%20year%20of%20quantum%20from%20concept%20to=
%20reality%20in%202025/quantum-monitor-2025.pdf?shouldIndex=3Dfalse" style=
=3D"text-decoration-line:none" rel=3D"nofollow" target=3D"_blank"><span sty=
le=3D"font-size:11pt;background-color:transparent;font-variant-numeric:norm=
al;font-variant-east-asian:normal;font-variant-alternates:normal;text-decor=
ation-line:underline;vertical-align:baseline">McKinsey</span></a><span styl=
e=3D"font-size:11pt;background-color:transparent;font-variant-numeric:norma=
l;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-al=
ign:baseline">]</span></p></li></ul><li dir=3D"ltr" style=3D"list-style-typ=
e:disc;font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:r=
gb(0,0,0);background-color:transparent;font-weight:700;font-variant-numeric=
:normal;font-variant-east-asian:normal;font-variant-alternates:normal;verti=
cal-align:baseline;white-space:pre-wrap"><p dir=3D"ltr" style=3D"line-heigh=
t:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt" role=3D"present=
ation"><span style=3D"font-size:11pt;background-color:transparent;font-vari=
ant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:n=
ormal;vertical-align:baseline">Quantum algorithms are rapidly improving</sp=
an></p></li><ul style=3D"margin-top:0px;margin-bottom:0px"><li dir=3D"ltr" =
style=3D"list-style-type:circle;font-size:11pt;font-family:&quot;Courier Ne=
w&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-varian=
t-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:nor=
mal;vertical-align:baseline;white-space:pre-wrap"><p dir=3D"ltr" style=3D"l=
ine-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt" role=
=3D"presentation"><span style=3D"font-size:11pt;background-color:transparen=
t;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-a=
lternates:normal;vertical-align:baseline">The safety envelope is shrinking =
by dramatic increases in algorithms even if the pace of hardware improvemen=
ts is slower. Algorithms are <a href=3D"https://security.googleblog.com/202=
5/05/tracking-cost-of-quantum-factori.html" rel=3D"nofollow" target=3D"_bla=
nk">improving up to 20X</a>, lowering the theoretical hardware requirements=
 for breaking classical encryption.</span></p></li></ul><li dir=3D"ltr" sty=
le=3D"list-style-type:disc;font-size:11pt;font-family:&quot;Courier New&quo=
t;,monospace;color:rgb(0,0,0);background-color:transparent;font-variant-num=
eric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;v=
ertical-align:baseline;white-space:pre-wrap"><p dir=3D"ltr" style=3D"line-h=
eight:1.38;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><span st=
yle=3D"font-size:11pt;background-color:transparent;font-weight:700;font-var=
iant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:=
normal;vertical-align:baseline">Bitcoin=E2=80=99s exposed public keys.</spa=
n><span style=3D"font-size:11pt;background-color:transparent;font-variant-n=
umeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal=
;vertical-align:baseline">=C2=A0</span></p></li><ul style=3D"margin-top:0px=
;margin-bottom:0px"><li dir=3D"ltr" style=3D"list-style-type:circle;font-si=
ze:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);back=
ground-color:transparent;font-variant-numeric:normal;font-variant-east-asia=
n:normal;font-variant-alternates:normal;vertical-align:baseline;white-space=
:pre-wrap"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-b=
ottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;background-c=
olor:transparent;font-variant-numeric:normal;font-variant-east-asian:normal=
;font-variant-alternates:normal;vertical-align:baseline">Roughly 25% of all=
 bitcoin have revealed a public key on-chain; those UTXOs could be stolen w=
ith sufficient quantum power.=C2=A0=C2=A0</span></p></li></ul><li dir=3D"lt=
r" style=3D"list-style-type:disc;font-size:11pt;font-family:&quot;Courier N=
ew&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-varia=
nt-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:no=
rmal;vertical-align:baseline;white-space:pre-wrap"><p dir=3D"ltr" style=3D"=
line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt" role=
=3D"presentation"><span style=3D"font-size:11pt;background-color:transparen=
t;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:norma=
l;font-variant-alternates:normal;vertical-align:baseline">We may not know t=
he attack is underway.=C2=A0</span></p></li><ul style=3D"margin-top:0px;mar=
gin-bottom:0px"><li dir=3D"ltr" style=3D"list-style-type:circle;font-size:1=
1pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgrou=
nd-color:transparent;font-variant-numeric:normal;font-variant-east-asian:no=
rmal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre=
-wrap"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-t=
op:0pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11=
pt;background-color:transparent;font-variant-numeric:normal;font-variant-ea=
st-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Qua=
ntum attackers could compute the private key for known public keys then tra=
nsfer all funds weeks or months later, in a covert bleed to not alert chain=
 watchers. Q-Day may be only known much later if the attack withholds broad=
casting transactions in order to postpone revealing their capabilities.</sp=
an></p></li></ul><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11=
pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgroun=
d-color:transparent;font-weight:700;font-variant-numeric:normal;font-varian=
t-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;=
white-space:pre-wrap"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0=
pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;b=
ackground-color:transparent;font-variant-numeric:normal;font-variant-east-a=
sian:normal;font-variant-alternates:normal;vertical-align:baseline">Private=
 keys become public.=C2=A0</span></p></li><ul style=3D"margin-top:0px;margi=
n-bottom:0px"><li dir=3D"ltr" style=3D"list-style-type:circle;font-size:11p=
t;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background=
-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant=
-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;w=
hite-space:pre-wrap"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0p=
t;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;ba=
ckground-color:transparent;font-weight:400;font-variant-numeric:normal;font=
-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:ba=
seline">Assuming that quantum computers are able to maintain their current =
trajectories and overcome existing engineering obstacles, there is a near c=
ertain chance that all P2PK (and other outputs with exposed pubkeys) privat=
e keys will be found and used to steal the funds.</span></p></li></ul><li d=
ir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-family:&quot;C=
ourier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;fo=
nt-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;fo=
nt-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap">=
<p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt" =
role=3D"presentation"><span style=3D"font-size:11pt;background-color:transp=
arent;font-variant-numeric:normal;font-variant-east-asian:normal;font-varia=
nt-alternates:normal;vertical-align:baseline">Impossible to know motivation=
s.=C2=A0</span></p></li><ul style=3D"margin-top:0px;margin-bottom:0px"><li =
dir=3D"ltr" style=3D"list-style-type:circle;font-size:11pt;font-family:&quo=
t;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent=
;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal=
;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wra=
p"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0p=
t" role=3D"presentation"><span style=3D"font-size:11pt;background-color:tra=
nsparent;font-weight:400;font-variant-numeric:normal;font-variant-east-asia=
n:normal;font-variant-alternates:normal;vertical-align:baseline">Prior to a=
 quantum attack, it is impossible to know the motivations of the attacker.=
=C2=A0 An economically motivated attacker will try to remain undetected for=
 as long as possible, while a malicious attacker will attempt to destroy as=
 much value as possible.=C2=A0=C2=A0</span></p></li></ul><li dir=3D"ltr" st=
yle=3D"list-style-type:disc;font-size:11pt;font-family:&quot;Courier New&qu=
ot;,monospace;color:rgb(0,0,0);background-color:transparent;font-variant-nu=
meric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;=
vertical-align:baseline;white-space:pre-wrap"><p dir=3D"ltr" style=3D"line-=
height:1.38;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><span s=
tyle=3D"font-size:11pt;background-color:transparent;font-weight:700;font-va=
riant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates=
:normal;vertical-align:baseline">Upgrade inertia.</span><span style=3D"font=
-size:11pt;background-color:transparent;font-variant-numeric:normal;font-va=
riant-east-asian:normal;font-variant-alternates:normal;vertical-align:basel=
ine">=C2=A0</span></p></li><ul style=3D"margin-top:0px;margin-bottom:0px"><=
li dir=3D"ltr" style=3D"list-style-type:circle;font-size:11pt;font-family:&=
quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpar=
ent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant=
-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir=3D"=
ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt" role=3D"pr=
esentation"><span style=3D"font-size:11pt;background-color:transparent;font=
-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alterna=
tes:normal;vertical-align:baseline">Coordinating wallets, exchanges, miners=
 and custodians historically takes years.</span></p></li><li dir=3D"ltr" st=
yle=3D"list-style-type:circle;font-size:11pt;font-family:&quot;Courier New&=
quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-variant-=
numeric:normal;font-variant-east-asian:normal;font-variant-alternates:norma=
l;vertical-align:baseline;white-space:pre-wrap"><p dir=3D"ltr" style=3D"lin=
e-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt" role=3D"=
presentation"><span style=3D"font-size:11pt;background-color:transparent;fo=
nt-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alter=
nates:normal;vertical-align:baseline">The longer we postpone migration, the=
 harder it becomes to coordinate wallets, exchanges, miners, and custodians=
. A clear, time-boxed pathway is the only credible defense.</span></p></li>=
<li dir=3D"ltr" style=3D"list-style-type:circle;font-size:11pt;font-family:=
&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpa=
rent;font-variant-numeric:normal;font-variant-east-asian:normal;font-varian=
t-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir=3D=
"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0pt;margin-bo=
ttom:12pt" role=3D"presentation"><span style=3D"font-size:11pt;background-c=
olor:transparent;font-variant-numeric:normal;font-variant-east-asian:normal=
;font-variant-alternates:normal;vertical-align:baseline">Coordinating distr=
ibuted groups is more prone to delay, even if everyone has similar motivati=
ons. Historically, Bitcoin has been slow to adopt code changes, often takin=
g multiple years to be approved.</span></p></li></ul></ul><h2 dir=3D"ltr" s=
tyle=3D"line-height:1.38;text-align:justify;margin-top:14pt;margin-bottom:6=
pt"><span style=3D"font-size:16pt;font-family:&quot;Courier New&quot;,monos=
pace;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:nor=
mal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-=
align:baseline">Benefits at a Glance</span></h2><ul style=3D"margin-top:0px=
;margin-bottom:0px"><li dir=3D"ltr" style=3D"list-style-type:disc;font-size=
:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transp=
arent;font-variant-numeric:normal;font-variant-east-asian:normal;font-varia=
nt-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir=
=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:12pt;margi=
n-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;font-fami=
ly:&quot;Courier New&quot;,monospace;background-color:transparent;font-weig=
ht:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-vari=
ant-alternates:normal;vertical-align:baseline">Resilience:</span><span styl=
e=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;backgroun=
d-color:transparent;font-variant-numeric:normal;font-variant-east-asian:nor=
mal;font-variant-alternates:normal;vertical-align:baseline"> Bitcoin protoc=
ol remains secure for the foreseeable future without waiting for a last-min=
ute emergency.</span></p></li><li dir=3D"ltr" style=3D"list-style-type:disc=
;font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-co=
lor:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;=
font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap=
"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0p=
t;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;fo=
nt-family:&quot;Courier New&quot;,monospace;background-color:transparent;fo=
nt-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;fo=
nt-variant-alternates:normal;vertical-align:baseline">Certainty</span><span=
 style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;back=
ground-color:transparent;font-variant-numeric:normal;font-variant-east-asia=
n:normal;font-variant-alternates:normal;vertical-align:baseline">: Bitcoin =
users and stakeholders gain certainty that a plan is both in place and bein=
g implemented to effectively deal with the threat of quantum theft of bitco=
in.=C2=A0=C2=A0</span></p></li><li dir=3D"ltr" style=3D"list-style-type:dis=
c;font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-c=
olor:transparent;font-variant-numeric:normal;font-variant-east-asian:normal=
;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wra=
p"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0=
pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;f=
ont-family:&quot;Courier New&quot;,monospace;background-color:transparent;f=
ont-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;f=
ont-variant-alternates:normal;vertical-align:baseline">Clarity:</span><span=
 style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;back=
ground-color:transparent;font-variant-numeric:normal;font-variant-east-asia=
n:normal;font-variant-alternates:normal;vertical-align:baseline"> A single,=
 publicized timeline aligns the entire ecosystem (wallets, exchanges, hardw=
are vendors).</span></p></li><li dir=3D"ltr" style=3D"list-style-type:disc;=
font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-col=
or:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;f=
ont-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"=
><p dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0pt=
;margin-bottom:12pt" role=3D"presentation"><span style=3D"font-size:11pt;fo=
nt-family:&quot;Courier New&quot;,monospace;background-color:transparent;fo=
nt-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;fo=
nt-variant-alternates:normal;vertical-align:baseline">Supply Discipline:</s=
pan><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monos=
pace;background-color:transparent;font-variant-numeric:normal;font-variant-=
east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> =
Abandoned keys that never migrate become unspendable, reducing supply, <a h=
ref=3D"https://bitcointalk.org/index.php?topic=3D198.msg1647#msg1647" rel=
=3D"nofollow" target=3D"_blank">as Satoshi described</a></span><span style=
=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;background=
-color:transparent;font-variant-numeric:normal;font-variant-east-asian:norm=
al;font-variant-alternates:normal;vertical-align:baseline">.=C2=A0=C2=A0</s=
pan></p></li></ul><h2 dir=3D"ltr" style=3D"line-height:1.38;text-align:just=
ify;margin-top:12pt;margin-bottom:12pt"><span style=3D"font-size:16pt;font-=
family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:=
transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font=
-variant-alternates:normal;vertical-align:baseline">Specification</span></h=
2><h2 dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:1=
2pt;margin-bottom:12pt"><span style=3D"font-weight:normal"><div dir=3D"ltr"=
 style=3D"margin-left:0pt" align=3D"left"><table style=3D"border:none;borde=
r-collapse:collapse"><colgroup><col width=3D"181"><col width=3D"224"><col w=
idth=3D"137"><col width=3D"130"></colgroup><tbody><tr style=3D"height:0pt">=
<td style=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);ve=
rtical-align:top;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-=
height:1.38;text-align:center;margin-top:0pt;margin-bottom:0pt"><span style=
=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(=
0,0,0);background-color:transparent;font-weight:700;font-variant-numeric:no=
rmal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical=
-align:baseline">Phase</span></p></td><td style=3D"border-width:1pt;border-=
style:solid;border-color:rgb(0,0,0);vertical-align:top;padding:5pt;overflow=
:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:center;margin-=
top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family:&quot;=
Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;f=
ont-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;f=
ont-variant-alternates:normal;vertical-align:baseline">What Happens</span><=
/p></td><td style=3D"border-width:1pt;border-style:solid;border-color:rgb(0=
,0,0);vertical-align:top;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=
=3D"line-height:1.38;text-align:center;margin-top:0pt;margin-bottom:0pt"><s=
pan style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;c=
olor:rgb(0,0,0);background-color:transparent;font-weight:700;font-variant-n=
umeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal=
;vertical-align:baseline">Who Must Act</span></p></td><td style=3D"border-w=
idth:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:top;padd=
ing:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;text-alig=
n:center;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;fo=
nt-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-col=
or:transparent;font-weight:700;font-variant-numeric:normal;font-variant-eas=
t-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Time=
 Horizon</span></p></td></tr><tr style=3D"height:0pt"><td style=3D"border-w=
idth:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:top;padd=
ing:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;margin-to=
p:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family:&quot;Co=
urier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;fon=
t-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;fon=
t-variant-alternates:normal;vertical-align:baseline">Phase A - </span><span=
 style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;colo=
r:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-=
variant-east-asian:normal;font-variant-alternates:normal;vertical-align:bas=
eline">Disallow spends to legacy script types</span></p></td><td style=3D"b=
order-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:m=
iddle;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38=
;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-famil=
y:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:trans=
parent;font-variant-numeric:normal;font-variant-east-asian:normal;font-vari=
ant-alternates:normal;vertical-align:baseline">Permitted sends are from leg=
acy scripts to P2QRH scripts</span></p></td><td style=3D"border-width:1pt;b=
order-style:solid;border-color:rgb(0,0,0);vertical-align:middle;padding:5pt=
;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;m=
argin-bottom:0pt"><span style=3D"font-size:10pt;font-family:&quot;Courier N=
ew&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-style=
:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-var=
iant-alternates:normal;vertical-align:baseline">Everyone</span><span style=
=3D"font-size:10pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(=
0,0,0);background-color:transparent;font-variant-numeric:normal;font-varian=
t-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"=
> holding or accepting BTC.</span></p></td><td style=3D"border-width:1pt;bo=
rder-style:solid;border-color:rgb(0,0,0);vertical-align:middle;padding:5pt;=
overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;ma=
rgin-bottom:0pt"><span style=3D"font-size:10pt;font-family:&quot;Courier Ne=
w&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-varian=
t-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:nor=
mal;vertical-align:baseline">3 years after BIP-360 implementation</span></p=
></td></tr><tr style=3D"height:0pt"><td style=3D"border-width:1pt;border-st=
yle:solid;border-color:rgb(0,0,0);vertical-align:top;padding:5pt;overflow:h=
idden"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-botto=
m:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,mo=
nospace;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-=
variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternat=
es:normal;vertical-align:baseline">Phase B =E2=80=93 </span><span style=3D"=
font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,=
0);background-color:transparent;font-variant-numeric:normal;font-variant-ea=
st-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Dis=
allow spends from quantum vulnerable outputs</span></p></td><td style=3D"bo=
rder-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:mi=
ddle;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;=
margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-family=
:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transp=
arent;font-variant-numeric:normal;font-variant-east-asian:normal;font-varia=
nt-alternates:normal;vertical-align:baseline">At a preset block-height, nod=
es reject transactions that rely on ECDSA/Schnorr keys.=C2=A0</span></p></t=
d><td style=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);=
vertical-align:middle;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"=
line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size=
:10pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgr=
ound-color:transparent;font-style:italic;font-variant-numeric:normal;font-v=
ariant-east-asian:normal;font-variant-alternates:normal;vertical-align:base=
line">Everyone</span><span style=3D"font-size:10pt;font-family:&quot;Courie=
r New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-va=
riant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates=
:normal;vertical-align:baseline"> holding or accepting BTC.</span></p></td>=
<td style=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);ve=
rtical-align:middle;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"li=
ne-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:1=
0pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgrou=
nd-color:transparent;font-variant-numeric:normal;font-variant-east-asian:no=
rmal;font-variant-alternates:normal;vertical-align:baseline">2 years after =
Phase A activation.</span></p></td></tr><tr style=3D"height:0pt"><td style=
=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-al=
ign:top;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.=
38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-fam=
ily:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:tra=
nsparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asia=
n:normal;font-variant-alternates:normal;vertical-align:baseline">Phase C =
=E2=80=93 </span><span style=3D"font-size:11pt;font-family:&quot;Courier Ne=
w&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-varian=
t-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:nor=
mal;vertical-align:baseline">Re-enable spends from quantum vulnerable outpu=
ts via ZK Proof</span></p></td><td style=3D"border-width:1pt;border-style:s=
olid;border-color:rgb(0,0,0);vertical-align:middle;padding:5pt;overflow:hid=
den"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:=
0pt"><span style=3D"font-size:10pt;font-family:&quot;Courier New&quot;,mono=
space;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:no=
rmal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical=
-align:baseline">Users with frozen quantum vulnerable funds and a HD wallet=
 seed phrase can construct a quantum safe ZK proof to recover funds.</span>=
</p></td><td style=3D"border-width:1pt;border-style:solid;border-color:rgb(=
0,0,0);vertical-align:middle;padding:5pt;overflow:hidden"><p dir=3D"ltr" st=
yle=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"fo=
nt-size:10pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0)=
;background-color:transparent;font-variant-numeric:normal;font-variant-east=
-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Users=
 who failed to migrate funds before Phase B.</span></p></td><td style=3D"bo=
rder-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:mi=
ddle;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;=
margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-family=
:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transp=
arent;font-variant-numeric:normal;font-variant-east-asian:normal;font-varia=
nt-alternates:normal;vertical-align:baseline">TBD pending research, demand,=
 and consensus.</span></p></td></tr></tbody></table></div></span></h2><h2 d=
ir=3D"ltr" style=3D"line-height:1.38;margin-top:14pt;margin-bottom:6pt"><sp=
an style=3D"font-size:16pt;font-family:&quot;Courier New&quot;,monospace;co=
lor:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:norm=
al;font-variant:normal;text-decoration:none;vertical-align:baseline;white-s=
pace:pre-wrap">Rationale</span></h2><ul style=3D"margin-top:0px;margin-bott=
om:0px"><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-f=
amily:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:t=
ransparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-=
variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p =
dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:12pt;ma=
rgin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;backgr=
ound-color:transparent;font-variant-numeric:normal;font-variant-east-asian:=
normal;font-variant-alternates:normal;vertical-align:baseline">Even if Bitc=
oin is not a primary initial target of a cryptographically relevant quantum=
 computer, widespread knowledge that such a computer exists and is capable =
of breaking Bitcoin=E2=80=99s cryptography will damage faith in the network=
 .=C2=A0</span></p></li><li dir=3D"ltr" style=3D"list-style-type:disc;font-=
size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);ba=
ckground-color:transparent;font-variant-numeric:normal;font-variant-east-as=
ian:normal;font-variant-alternates:normal;vertical-align:baseline;white-spa=
ce:pre-wrap"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;ma=
rgin-top:0pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-s=
ize:11pt;background-color:transparent;font-variant-numeric:normal;font-vari=
ant-east-asian:normal;font-variant-alternates:normal;vertical-align:baselin=
e">An attack on Bitcoin may not be economically motivated - an attacker may=
 be politically or maliciously motivated and may attempt to destroy value a=
nd trust in Bitcoin rather than extract value.=C2=A0 There is no way to kno=
w in advance how, when, or why an attack may occur.=C2=A0 A defensive posit=
ion must be taken well in advance of any attack.=C2=A0=C2=A0</span></p></li=
><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-family:&=
quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpar=
ent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant=
-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir=3D"=
ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0pt;margin-bot=
tom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;background-col=
or:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;f=
ont-variant-alternates:normal;vertical-align:baseline">Bitcoin=E2=80=99s cu=
rrent signatures (ECDSA/Schnorr) will be a tantalizing target: any UTXO tha=
t has ever exposed its public key on-chain (roughly 25 % of all bitcoin) co=
uld be stolen by a cryptographically relevant quantum computer.</span></p><=
/li><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-famil=
y:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-varia=
nt-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:no=
rmal;vertical-align:baseline;white-space:pre-wrap"><p dir=3D"ltr" style=3D"=
line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt" role=
=3D"presentation"><span style=3D"font-size:11pt;font-family:&quot;Courier N=
ew&quot;,monospace;background-color:transparent;font-weight:700;font-varian=
t-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:nor=
mal;vertical-align:baseline">Existing Proposals are Insufficient.</span><sp=
an style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;ba=
ckground-color:transparent;font-variant-numeric:normal;font-variant-east-as=
ian:normal;font-variant-alternates:normal;vertical-align:baseline">=C2=A0=
=C2=A0</span></p></li><ol style=3D"margin-top:0px;margin-bottom:0px"><li di=
r=3D"ltr" style=3D"list-style-type:lower-alpha;font-size:11pt;font-family:&=
quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpar=
ent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant=
-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir=3D"=
ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0pt;margin-bot=
tom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;background-col=
or:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;f=
ont-variant-alternates:normal;vertical-align:baseline">Any proposal that al=
lows for the quantum theft of =E2=80=9Clost=E2=80=9D bitcoin is creating a =
redistribution dilemma. There are 3 types of proposals:</span></p></li><ol =
style=3D"margin-top:0px;margin-bottom:0px"><li dir=3D"ltr" style=3D"list-st=
yle-type:lower-roman;font-size:11pt;font-family:&quot;Courier New&quot;,mon=
ospace;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:n=
ormal;font-variant-east-asian:normal;font-variant-alternates:normal;vertica=
l-align:baseline;white-space:pre-wrap"><p dir=3D"ltr" style=3D"line-height:=
1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt" role=3D"presentat=
ion"><span style=3D"font-size:11pt;background-color:transparent;font-varian=
t-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:nor=
mal;vertical-align:baseline">Allow anyone to steal vulnerable coins, benefi=
tting those who reach quantum capability earliest.</span></p></li><li dir=
=3D"ltr" style=3D"list-style-type:lower-roman;font-size:11pt;font-family:&q=
uot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpare=
nt;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-=
alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir=3D"l=
tr" style=3D"line-height:1.38;text-align:justify;margin-top:0pt;margin-bott=
om:0pt" role=3D"presentation"><span style=3D"font-size:11pt;background-colo=
r:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;fo=
nt-variant-alternates:normal;vertical-align:baseline">Allow throttled theft=
 of coins, which leads to RBF battles and ultimately miners subsidizing the=
ir revenue from lost coins.</span></p></li><li dir=3D"ltr" style=3D"list-st=
yle-type:lower-roman;font-size:11pt;font-family:&quot;Courier New&quot;,mon=
ospace;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:n=
ormal;font-variant-east-asian:normal;font-variant-alternates:normal;vertica=
l-align:baseline;white-space:pre-wrap"><p dir=3D"ltr" style=3D"line-height:=
1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt" role=3D"presentat=
ion"><span style=3D"font-size:11pt;background-color:transparent;font-varian=
t-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:nor=
mal;vertical-align:baseline">Allow no one to steal vulnerable coins.</span>=
</p></li></ol></ol><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:=
11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgro=
und-color:transparent;font-weight:700;font-variant-numeric:normal;font-vari=
ant-east-asian:normal;font-variant-alternates:normal;vertical-align:baselin=
e;white-space:pre-wrap"><p dir=3D"ltr" style=3D"line-height:1.38;text-align=
:justify;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><span styl=
e=3D"font-size:11pt;background-color:transparent;font-variant-numeric:norma=
l;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-al=
ign:baseline">Minimizes attack surface</span></p></li><ol style=3D"margin-t=
op:0px;margin-bottom:0px"><li dir=3D"ltr" style=3D"list-style-type:lower-al=
pha;font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(=
0,0,0);background-color:transparent;font-variant-numeric:normal;font-varian=
t-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;=
white-space:pre-wrap"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:j=
ustify;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><span style=
=3D"font-size:11pt;background-color:transparent;font-variant-numeric:normal=
;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-ali=
gn:baseline">By disallowing new spends to quantum vulnerable script types, =
we minimize the attack surface with each new UTXO.=C2=A0=C2=A0</span></p></=
li><li dir=3D"ltr" style=3D"list-style-type:lower-alpha;font-size:11pt;font=
-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color=
:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;fon=
t-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><=
p dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0pt;m=
argin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;backg=
round-color:transparent;font-variant-numeric:normal;font-variant-east-asian=
:normal;font-variant-alternates:normal;vertical-align:baseline">Upgrades to=
 Bitcoin have historically taken many years; this will hasten and speed up =
the adoption of new quantum resistant script types.=C2=A0</span></p></li><l=
i dir=3D"ltr" style=3D"list-style-type:lower-alpha;font-size:11pt;font-fami=
ly:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:tran=
sparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-var=
iant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir=
=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0pt;margin=
-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;background=
-color:transparent;font-variant-numeric:normal;font-variant-east-asian:norm=
al;font-variant-alternates:normal;vertical-align:baseline">With a clear dea=
dline, industry stakeholders will more readily upgrade existing infrastruct=
ure to ensure continuity of services.=C2=A0=C2=A0</span></p></li></ol><li d=
ir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-family:&quot;C=
ourier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;fo=
nt-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;fo=
nt-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap">=
<p dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0pt;=
margin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;back=
ground-color:transparent;font-variant-numeric:normal;font-variant-east-asia=
n:normal;font-variant-alternates:normal;vertical-align:baseline">Minimizes =
loss of access to funds=C2=A0</span></p></li><ol style=3D"margin-top:0px;ma=
rgin-bottom:0px"><li dir=3D"ltr" style=3D"list-style-type:lower-alpha;font-=
size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);ba=
ckground-color:transparent;font-variant-numeric:normal;font-variant-east-as=
ian:normal;font-variant-alternates:normal;vertical-align:baseline;white-spa=
ce:pre-wrap"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;ma=
rgin-top:0pt;margin-bottom:12pt" role=3D"presentation"><span style=3D"font-=
size:11pt;background-color:transparent;font-variant-numeric:normal;font-var=
iant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseli=
ne">If there is sufficient demand and research proves possible, submitting =
a ZK proof of knowledge of a BIP-39 seed phrase corresponding to  a public =
key hash or script hash would provide a trustless means for legacy outputs =
to be spent in a quantum resistant manner, even after the sunset.=C2=A0=C2=
=A0</span></p></li></ol></ul><br><div dir=3D"ltr" style=3D"margin-left:0pt"=
 align=3D"left"><table style=3D"border:none;border-collapse:collapse"><colg=
roup><col width=3D"143"><col width=3D"539"></colgroup><tbody><tr style=3D"h=
eight:27.4463pt"><td style=3D"border-width:1pt;border-style:solid;border-co=
lor:rgb(0,0,0);vertical-align:top;padding:5pt;overflow:hidden"><p dir=3D"lt=
r" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=
=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(=
0,0,0);background-color:transparent;font-weight:700;font-variant-numeric:no=
rmal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical=
-align:baseline">Stakeholder</span></p></td><td style=3D"border-width:1pt;b=
order-style:solid;border-color:rgb(0,0,0);vertical-align:top;padding:5pt;ov=
erflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;marg=
in-bottom:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&=
quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-weight:7=
00;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-=
alternates:normal;vertical-align:baseline">Incentive to Upgrade</span></p><=
/td></tr><tr style=3D"height:53.5388pt"><td style=3D"border-width:1pt;borde=
r-style:solid;border-color:rgb(0,0,0);vertical-align:middle;padding:5pt;ove=
rflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margi=
n-bottom:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&q=
uot;,monospace;color:rgb(0,0,0);background-color:transparent;font-weight:70=
0;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-a=
lternates:normal;vertical-align:baseline">Miners</span></p></td><td style=
=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-al=
ign:top;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.=
38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-fam=
ily:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:tra=
nsparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-va=
riant-alternates:normal;vertical-align:baseline">=E2=80=A2 Larger size PQ s=
ignatures along with incentive for users to migrate will create more demand=
 for block space and thus higher fees collected by miners.</span></p><p dir=
=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span =
style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color=
:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-v=
ariant-east-asian:normal;font-variant-alternates:normal;vertical-align:base=
line">=E2=80=A2 Post-Phase B, non-upgraded miners produce invalid blocks.</=
span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bot=
tom:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,=
monospace;color:rgb(0,0,0);background-color:transparent;font-variant-numeri=
c:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vert=
ical-align:baseline">=E2=80=A2 A quantum attack on Bitcoin will significant=
ly devalue both their hardware and Bitcoin as a whole.=C2=A0</span></p></td=
></tr><tr style=3D"height:52pt"><td style=3D"border-width:1pt;border-style:=
solid;border-color:rgb(0,0,0);vertical-align:middle;padding:5pt;overflow:hi=
dden"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom=
:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,mon=
ospace;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-v=
ariant-numeric:normal;font-variant-east-asian:normal;font-variant-alternate=
s:normal;vertical-align:baseline">Institutional Holders</span></p></td><td =
style=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertic=
al-align:top;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-heig=
ht:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;fon=
t-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-colo=
r:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;fo=
nt-variant-alternates:normal;vertical-align:baseline">=E2=80=A2 Fiduciary d=
uty: failing to act to prevent a quantum attack on Bitcoin would violate th=
e fiduciary duty to shareholders.=C2=A0=C2=A0</span></p><p dir=3D"ltr" styl=
e=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font=
-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);b=
ackground-color:transparent;font-variant-numeric:normal;font-variant-east-a=
sian:normal;font-variant-alternates:normal;vertical-align:baseline">=E2=80=
=A2 Demonstrating Bitcoin=E2=80=99s ability to effectively mitigate emergin=
g threats will prove Bitcoin to be an investment grade asset.</span></p></t=
d></tr><tr style=3D"height:52pt"><td style=3D"border-width:1pt;border-style=
:solid;border-color:rgb(0,0,0);vertical-align:middle;padding:5pt;overflow:h=
idden"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-botto=
m:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,mo=
nospace;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-=
variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternat=
es:normal;vertical-align:baseline">Exchanges &amp; Custodians</span></p></t=
d><td style=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);=
vertical-align:top;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"lin=
e-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11=
pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgroun=
d-color:transparent;font-variant-numeric:normal;font-variant-east-asian:nor=
mal;font-variant-alternates:normal;vertical-align:baseline">=E2=80=A2 Conce=
ntrated risk: a quantum hack could bankrupt them overnight.</span></p><p di=
r=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span=
 style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;colo=
r:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-=
variant-east-asian:normal;font-variant-alternates:normal;vertical-align:bas=
eline">=E2=80=A2 Early migration is cheap relative to potential losses, pot=
ential lawsuits over improper custody and reputational damage.</span></p></=
td></tr><tr style=3D"height:52pt"><td style=3D"border-width:1pt;border-styl=
e:solid;border-color:rgb(0,0,0);vertical-align:middle;padding:5pt;overflow:=
hidden"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bott=
om:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,m=
onospace;color:rgb(0,0,0);background-color:transparent;font-weight:700;font=
-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alterna=
tes:normal;vertical-align:baseline">Everyday Users</span></p></td><td style=
=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-al=
ign:top;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.=
38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-fam=
ily:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:tra=
nsparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-va=
riant-alternates:normal;vertical-align:baseline">=E2=80=A2 Self-sovereign p=
eace of mind.</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top=
:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family:&quot;Cou=
rier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font=
-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alterna=
tes:normal;vertical-align:baseline">=E2=80=A2 Sunset date creates a clear d=
eadline and incentive to improve their security rather than an open-ended =
=E2=80=9Csome day=E2=80=9D that invites procrastination.</span></p></td></t=
r><tr style=3D"height:43.7925pt"><td style=3D"border-width:1pt;border-style=
:solid;border-color:rgb(0,0,0);vertical-align:middle;padding:5pt;overflow:h=
idden"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-botto=
m:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,mo=
nospace;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-=
variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternat=
es:normal;vertical-align:baseline">Attackers</span></p></td><td style=3D"bo=
rder-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:to=
p;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;mar=
gin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family:&q=
uot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpare=
nt;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-=
alternates:normal;vertical-align:baseline">=E2=80=A2 Economic incentive dim=
inishes as sunset nears, stolen coins cannot be spent after Q-day.</span></=
p></td></tr></tbody></table></div><p dir=3D"ltr" style=3D"line-height:1.38;=
text-align:justify;margin-top:12pt;margin-bottom:12pt"><span style=3D"font-=
size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);ba=
ckground-color:transparent;font-weight:700;font-variant-numeric:normal;font=
-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:ba=
seline">Key Insight:</span><span style=3D"font-size:11pt;font-family:&quot;=
Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;f=
ont-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alte=
rnates:normal;vertical-align:baseline"> As mentioned earlier, the proposal =
turns quantum security into a </span><span style=3D"font-size:11pt;font-fam=
ily:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:tra=
nsparent;font-style:italic;font-variant-numeric:normal;font-variant-east-as=
ian:normal;font-variant-alternates:normal;vertical-align:baseline">private =
incentive to upgrade</span><span style=3D"font-size:11pt;font-family:&quot;=
Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;f=
ont-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alte=
rnates:normal;vertical-align:baseline">.=C2=A0=C2=A0</span></p><p dir=3D"lt=
r" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=
=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(=
0,0,0);background-color:transparent;font-variant-numeric:normal;font-varian=
t-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"=
>This is not an offensive attack, rather, it is defensive: our thesis is th=
at the Bitcoin ecosystem wishes to defend itself and its interests against =
those who would prefer to do nothing and allow a malicious actor to destroy=
 both value and trust.=C2=A0=C2=A0</span></p><p dir=3D"ltr" style=3D"line-h=
eight:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"background-colo=
r:transparent;color:rgb(0,0,0);font-family:&quot;Courier New&quot;,monospac=
e;font-size:11pt;text-align:center"><br></span></p><blockquote style=3D"mar=
gin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1=
ex" class=3D"gmail_quote"><span style=3D"background-color:transparent;color=
:rgb(0,0,0);font-family:&quot;Courier New&quot;,monospace;font-size:11pt;te=
xt-align:center">&quot;Lost coins only make everyone else&#39;s coins worth=
 slightly more. Think of it as a donation to everyone.&quot; - Satoshi Naka=
moto</span></blockquote><br><p dir=3D"ltr" style=3D"line-height:1.38;margin=
-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family:&quot=
;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;=
font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alt=
ernates:normal;vertical-align:baseline">If true, the corollary is:</span></=
p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt=
"><span style=3D"background-color:transparent;color:rgb(0,0,0);font-family:=
&quot;Courier New&quot;,monospace;font-size:11pt;text-align:center"><br></s=
pan></p><blockquote style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex" class=3D"gmail_quote"><span style=3D"ba=
ckground-color:transparent;color:rgb(0,0,0);font-family:&quot;Courier New&q=
uot;,monospace;font-size:11pt;text-align:center">&quot;Quantum recovered co=
ins only make everyone else&#39;s coins worth less. Think of it as a theft =
from everyone.&quot;</span></blockquote><br><p dir=3D"ltr" style=3D"line-he=
ight:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;f=
ont-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-co=
lor:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;=
font-variant-alternates:normal;vertical-align:baseline">The timelines that =
we are proposing are meant to find the best balance between giving ample ab=
ility for account owners to migrate while maintaining the integrity of the =
overall ecosystem to avoid catastrophic attacks.=C2=A0=C2=A0</span></p><br>=
<h2 dir=3D"ltr" style=3D"line-height:1.38;margin-top:18pt;margin-bottom:4pt=
"><span style=3D"font-size:17pt;font-family:&quot;Courier New&quot;,monospa=
ce;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:norma=
l;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-al=
ign:baseline">Backward Compatibility</span></h2><p dir=3D"ltr" style=3D"lin=
e-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11=
pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgroun=
d-color:transparent;font-variant-numeric:normal;font-variant-east-asian:nor=
mal;font-variant-alternates:normal;vertical-align:baseline">As a series of =
soft forks, older nodes will continue to operate without modification. Non-=
upgraded nodes, however, will consider all post-quantum witness programs as=
 anyone-can-spend scripts. They are strongly encouraged to upgrade in order=
 to fully validate the new programs.</span></p><br><p dir=3D"ltr" style=3D"=
line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size=
:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgr=
ound-color:transparent;font-variant-numeric:normal;font-variant-east-asian:=
normal;font-variant-alternates:normal;vertical-align:baseline">Non-upgraded=
 wallets can receive and send bitcoin from non-upgraded and upgraded wallet=
s until Phase A. After Phase A, they can no longer receive from any other w=
allets and can only send to upgraded wallets.=C2=A0 After Phase B, both sen=
ders and receivers will require upgraded wallets.=C2=A0Phase C would likely=
 require a loosening of consensus rules (a hard fork) to allow vulnerable f=
unds recovery via ZK proofs.</span></p></span></div>
</blockquote></div></blockquote></div>

<p></p>

-- <br>
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br>
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com" target=
=3D"_blank">bitcoindev+unsubscribe@googlegroups.com</a>.<br>
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
bitcoindev/4d9ce13e-466d-478b-ab4d-00404c80d620n%40googlegroups.com?utm_med=
ium=3Demail&amp;utm_source=3Dfooter" target=3D"_blank">https://groups.googl=
e.com/d/msgid/bitcoindev/4d9ce13e-466d-478b-ab4d-00404c80d620n%40googlegrou=
ps.com</a>.<br>
</blockquote></div></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com">bitcoind=
ev+unsubscribe@googlegroups.com</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
bitcoindev/CADL_X_f3sDECRUosNaXyez3F_inKjJAWm%3DESm3DSLCKD4JV7yA%40mail.gma=
il.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/=
msgid/bitcoindev/CADL_X_f3sDECRUosNaXyez3F_inKjJAWm%3DESm3DSLCKD4JV7yA%40ma=
il.gmail.com</a>.<br />

--0000000000007083180639e82939--