path: root/6e/c76671794683a6d5237e6c5d89ff5b88dcc7bd

Delivery-date: Mon, 14 Jul 2025 07:09:14 -0700
Received: from mail-yw1-f184.google.com ([209.85.128.184])
	by mail.fairlystable.org with esmtps  (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.94.2)
	(envelope-from <bitcoindev+bncBC3PT7FYWAMRB7E62TBQMGQEOXE46TQ@googlegroups.com>)
	id 1ubJrk-0007Bs-F9
	for bitcoindev@gnusha.org; Mon, 14 Jul 2025 07:09:14 -0700
Received: by mail-yw1-f184.google.com with SMTP id 00721157ae682-7152520f9f9sf50844777b3.2
        for <bitcoindev@gnusha.org>; Mon, 14 Jul 2025 07:09:12 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlegroups.com; s=20230601; t=1752502146; x=1753106946; darn=gnusha.org;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:x-original-sender:mime-version
         :subject:references:in-reply-to:message-id:to:from:date:sender:from
         :to:cc:subject:date:message-id:reply-to;
        bh=PNUtav0beH1Q7UTv+pZVk0nnXdLS6cbvOIWdM7UH0n4=;
        b=hnltwIm+K7uDtqB5HKo+MIBh182WzW1UfTA46qsSGdZ8HauH19+o6sjpmi6gp7NZ4D
         3C13Dm8N8N8BEKdWcWb6+/cBJbAwvwyiAJMKSlMSC21vHhivx5+Gkm3aNICIxUhfniql
         CjNLWGZyer3y43PNAbYzGlou8WpA8PA9dfi6uEg9qcRs4nuV8X8DXstLS22C4ulTM4VA
         4Ro1+ilJ/6CfvKYF9yOIb87/ycpXyAtYHAx31Ctj9DOYx6or3wjF78yQuEmyELUtxpWf
         eTgYAQs1wXjoMjKUoYXMlvaHjqLxfBv5QleXzpsZ5D1x+2gYccvErBKv6vXI72erhn6k
         eOnw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1752502146; x=1753106946; darn=gnusha.org;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:x-original-sender:mime-version
         :subject:references:in-reply-to:message-id:to:from:date:from:to:cc
         :subject:date:message-id:reply-to;
        bh=PNUtav0beH1Q7UTv+pZVk0nnXdLS6cbvOIWdM7UH0n4=;
        b=BzNpQM3ZKaQXwYNFLZBr21hgd7dyebOv1xI5dm7YKQDGmX+4zVJ/n62qduPom8NgR9
         7NmbPliR9QXq7CfZB2qbsnEv3pGUmWFxDqnjqd68j0VeWl7sTjrboSjzAwYCZYiRX5pK
         oiNY9IhoYvogQ0PaoB1fGfZ6kqXFV2vnDCz+vwYUW0R6A5YgRtbngvqLpeI7xRRnlS7l
         zliBQJCM9I/88CZHumB9wZKnhdKv2zeezXlmH34j3eGs2FtRxEBNld6c0wswFzngs7lj
         XyxNH8aHeautItAYXCIYcdkqtz0x617YeRN34K+J/8VbPzDyi7Q/PFyPBCRf/qiECGDi
         x5aQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1752502146; x=1753106946;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:x-original-sender:mime-version
         :subject:references:in-reply-to:message-id:to:from:date:x-beenthere
         :x-gm-message-state:sender:from:to:cc:subject:date:message-id
         :reply-to;
        bh=PNUtav0beH1Q7UTv+pZVk0nnXdLS6cbvOIWdM7UH0n4=;
        b=TCTAiHJfcOQDTHmu0tstT+J+81I+7P9HgdqpKmgR5ZDer/QWRG2o/kOYiPklXF6GUG
         iMHCJ1xt9KwTetovPTk97uY+BCKrUbDD1m+EFFDqA7L9OvoOQkLy9wWjtuyEhmvpuRUB
         MdvICwdc5C6/exJj7pVdqQN2/IWY6yfn44GCCQObzHPp8U8rjILYbqWjygA8DPV4x9wY
         Aq/st4WRYeeuBOLuqB6GUDZdFxqEyXX/g2KDaYXTzTWDgNeF/j8Izwlsyp5RFPnr1Luy
         JlA7JeU//jEDZxUNVbyV8hM4xmxs6Lq3ey6+m6XWJEAdOtosp3D2XOCR7S/zMEZKVsZd
         0GSA==
Sender: bitcoindev@googlegroups.com
X-Forwarded-Encrypted: i=1; AJvYcCWkF80FOlmACJ+5i9cOxFPBsN7e/nI8sbmVzQF2mzAoRylJiutYkT7UUeutN8YvuroK6Gqc0YMg4Nu1@gnusha.org
X-Gm-Message-State: AOJu0YyFKorxt5sckpJkhMXYmndAQSyy2nK3YZ0cTImyQJ0QV+BM1mib
	cGzxKkhCLdPRtwJDPsIh2rzNuMDqN0ASrXZMA/rOc3lUlrH6YRuDlExx
X-Google-Smtp-Source: AGHT+IFt3sCwFFoZZwASFFr83QFMuZMpadcBXCmJMc2VU7v/Q5+RY7GEBCBPkJniZ5u+Qw26jXsVWw==
X-Received: by 2002:a05:690c:f14:b0:6ef:5097:5daa with SMTP id 00721157ae682-717d5e2c359mr208126597b3.34.1752502145700;
        Mon, 14 Jul 2025 07:09:05 -0700 (PDT)
X-BeenThere: bitcoindev@googlegroups.com; h=AZMbMZcK9KCjoZ6RB/9NV19Qkyw8kDMiih5ZAFpXgg8wASDEFg==
Received: by 2002:a25:e0c9:0:b0:e87:bdd0:75fc with SMTP id 3f1490d57ef6-e8b77958404ls4297231276.2.-pod-prod-03-us;
 Mon, 14 Jul 2025 07:09:00 -0700 (PDT)
X-Received: by 2002:a05:690c:9c08:b0:70e:404:85e5 with SMTP id 00721157ae682-717d5d7e0b7mr227052197b3.11.1752502140243;
        Mon, 14 Jul 2025 07:09:00 -0700 (PDT)
Received: by 2002:a81:c805:0:b0:710:fccf:6901 with SMTP id 00721157ae682-71801526bd3ms7b3;
        Sun, 13 Jul 2025 19:07:42 -0700 (PDT)
X-Received: by 2002:a05:690c:6083:b0:712:cc11:af8 with SMTP id 00721157ae682-717d5ede770mr188521897b3.27.1752458861290;
        Sun, 13 Jul 2025 19:07:41 -0700 (PDT)
Date: Sun, 13 Jul 2025 19:07:40 -0700 (PDT)
From: Antoine Riard <antoine.riard@gmail.com>
To: Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Message-Id: <4d9ce13e-466d-478b-ab4d-00404c80d620n@googlegroups.com>
In-Reply-To: <37ed2e5d-34cd-4391-84b8-5bcc6d42c617n@googlegroups.com>
References: <CADL_X_fpv-aXBxX+eJ_EVTirkAJGyPRUNqOCYdz5um8zu6ma5Q@mail.gmail.com>
 <37ed2e5d-34cd-4391-84b8-5bcc6d42c617n@googlegroups.com>
Subject: [bitcoindev] Re: A Post Quantum Migration Proposal
MIME-Version: 1.0
Content-Type: multipart/mixed; 
	boundary="----=_Part_411050_1470926048.1752458860757"
X-Original-Sender: antoine.riard@gmail.com
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com
List-ID: <bitcoindev.googlegroups.com>
X-Google-Group-Id: 786775582512
List-Post: <https://groups.google.com/group/bitcoindev/post>, <mailto:bitcoindev@googlegroups.com>
List-Help: <https://groups.google.com/support/>, <mailto:bitcoindev+help@googlegroups.com>
List-Archive: <https://groups.google.com/group/bitcoindev
List-Subscribe: <https://groups.google.com/group/bitcoindev/subscribe>, <mailto:bitcoindev+subscribe@googlegroups.com>
List-Unsubscribe: <mailto:googlegroups-manage+786775582512+unsubscribe@googlegroups.com>,
 <https://groups.google.com/group/bitcoindev/subscribe>
X-Spam-Score: -0.5 (/)

------=_Part_411050_1470926048.1752458860757
Content-Type: multipart/alternative; 
	boundary="----=_Part_411051_711094452.1752458860757"

------=_Part_411051_711094452.1752458860757
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Jameson,

Thanks for your thoughts on this complex subject.

First and foremost, I think your following statement: "Never before has=20
Bitcoin faced
an existential threat to its cryptographic primitives" is very myopic,=20
given that
cryptanalysts and number theorists are making progress every year in their=
=20
works, and
each bitcoin cryptographic primitive has been and is constantly analyzed to=
=20
uncover
potential weaknesses.

So in my view the quantum threat is a bit less specific that the image=20
you're painting
of it. Even if go all to upgrade to lattices-based schemes, we have no=20
certainty that
novels flaws won't be found, one can just go to see the modifications of=20
the NIST-approved
schemes in between their rounds of selection that we'll never reach=20
something like
"self-sovereign peace of mind"...Unless we start to forbid people of=20
practicing the
art of mathematics, practice which has been ongoing since Euclide and=20
Pythagore...

I do concede that quantum is a bit different, as after all new physics=20
paradigm
do not happen often (Heisenberg published in the 20s iirc), though that's=
=20
in my
view the flaw of your reasoning as you're assuming some "post-quantum"=20
upgraded
state where bitcoin, as a community and a network, would be definitely safe=
=20
from
advances in applied science. At minima, in my understanding, you're arguing=
=20
this
time is different to justify extra-ordinary technical measures never seen=
=20
before,
namely the freezing of "vulnerable" coins.

I'm worried this is opening a Pandora box, where we would introduce a=20
precedent
that it is legitimate as a community to technicaly confiscate some coins of=
=20
users,=20
without their _consents_, for extra-ordinary reasons. That's opening a=20
worms of
shenanigans in the future...There is no guarantee that this precedent won't
be leveraged in the future by any group of entities to justify future=20
upgrades
eroding one of the "fundamental property" you're yourself deeming as=20
valuable.

This is especially worrying as if I'm understanding you correctly you're=20
justifying
this position as that somehow we should protect the price of the currency=
=20
as an end
in itself (i.e "Beyond its impact on price, ..."). It's unclear the price=
=20
of bitcoin
versus what fiat or hard asset (e.g oil) you have in mind. And in anyway,=
=20
as far
as I know, none of the bitcoin devs is seating on the board of the FED, the=
=20
ECB
or the BoJ...

To put it simply, even if a quantum attacker can tomorrow starts to steal
vulnerable coins, 1 BTC will be always equal to 1 BTC. Full stop. In my=20
humble
opinion, let's not introduce the idea that, we, as a community of=20
stakeholders
and developers we have a positive "fiduciary" duty to act to maintain the=
=20
price
of bitcoin in some "monetary snake" with another class of assets...

That's also the problem with game theory, all the matrices of analysis are
based on some scale of utilitarism. See Von Neuman's Theory of Games, the
section on "The Notion of Utility". My subjective appreciation of the value
of my coins might not be your subjective appreication of the value of your
coins.

Now I do understand the perspective of the institutional holders, the=20
exchanges,
the custodians or any other industry providers, who might be in the full=20
uncertainty
about their business responsibilities in case of a quantum threat affecting=
=20
their
custodied coins. But, first legally speaking there is something call "force=
=20
majeure"
and in view of the quantum threat, which is a risk discussed far beyond the=
=20
bitcoin
industry, they should be able to shield themselves behind that. Secondly,=
=20
if there
is any futute upgrade "opt-in" only path a la BIP360, you can move your=20
funds or
the ones under custody  under a PQC scheme like Dilthium or Falcon and be=
=20
good
without caring about what the others users are doing. Thirdly, if you're an=
=20
actor
in the industry like Coinbase and you're deeply concerned about how=20
extended maelstrom
on the price might affect the viability of your operations, it is unclear=
=20
to me why
you don't call MunichRe or any other company like that tomorrow to craft=20
and be
covered by specific insurance on quantum threats...

To be frank, all those considerations on how "I cannot see how the currency=
=20
can
maintain any value at all in such a setting", is a strong red flag of low=
=20
time
preferences. It's not like we're used to strong volatility in bitcoin with=
=20
the
almost 2 decades of operations of the network. In my view, it's more a hint=
=20
of
very high-exposition by some to a single class of asset, i.e bitcoin,=20
rather than wise
diversification... And a push to sacrify a "fundamental property" i.e=20
"conservatism"
in view of short-term concerns (i.e the stability of the currency price=20
along
a period of few years).

Do not get me wrong, I'm certainly not of the school "let's reward quantum
attackers". Leveraging techical superiority and employing CRQRC to steal
vulnerable coins would be clearly a theft. But ethically, the best we can=
=20
do is
to have an opt-in upgrade path and be pro-active, by education and outreach=
,
to have the maximum of coin owners upgrading to non-vulnerable addresses=20
types.
Then show the level of "fortitude" or "endurance" as a community in face of=
=20
price
fluctuations for a while, while seeing regularly old P2PK coins hacked.=20
Marcus
Aurelius can be bought for few bucks in most of decent libraries...

I'm definitely on the "no old coins confiscation" position you're=20
underlighting:

"I don't see why old coins should be confiscated. The better option is to=
=20
let
those with quantum computers free up old coins. While this might have an
inflationary impact on bitcoin's price, to use a turn of phrase, the=20
inflation
is transitory. Those with low time preference should support returning lost
coins to circulation".

Notwhitstanding that I disagree with your position, one can only appreciate
the breadth and depth with which you're gathering and articulating all the
elements on this complex problem.

Best,
Antoine
OTS hash: c064b43047bf3036faf098b5ac8e74930df63d25629f590a4195222979402826
Le lundi 14 juillet 2025 =C3=A0 00:53:34 UTC+1, Tadge Dryja a =C3=A9crit :

> Hi  =20
>
> While I generally agree that "freeze" beats "steal", and that a lot of=20
> lead time is good, I don't think this plan is viable.
> To me the biggest problem is that it ties activation of a PQ output type=
=20
> to *de*activation of EC output types.  That would mean that someone who=
=20
> wants to keep using all the great stuff in libsecp256k1 should try to=20
> prevent BIP360 from being activated.
>
> Sure, there can be risks from CRQCs.  But this proposal would go the othe=
r=20
> direction, disabling important functionality and even destroying coins=20
> preemptively, in anticipation of something that may never happen.
>
> Also, how do you define "quantum-vulnerable UTXO"?  Would any P2PKH, or=
=20
> P2WPKH output count?  Or only P2PKH / P2WPKH outputs where the public key=
=20
> is already known?  I can understand disabling spends from known-pubkey=20
> outputs, but for addresses where the public key has never been revealed,=
=20
> commit/reveal schemes (like the one I posted about & am working on a=20
> follow-up post for) should safely let people spend from those outputs=20
> indefinitely.
>
> With no evidence of a QRQC, I can see how there would be people who'd say=
=20
> "We might never really know if a CRQC exists, so we need to disable EC=20
> spends out of caution" and others who'd say "Don't disable EC spends, sin=
ce=20
> that's destroying coins", and that could be a persistent disagreement.  B=
ut=20
> I hope if we did in fact have a proof that a CRQC has broken secp256k1,=
=20
> there would be significant agreement on freezing known-pubkey EC outputs.
>
> -Tadge
> On Saturday, July 12, 2025 at 8:46:09=E2=80=AFPM UTC-4 Jameson Lopp wrote=
:
>
>> Building upon my earlier essay against allowing quantum recovery of=20
>> bitcoin=20
>> <https://groups.google.com/g/bitcoindev/c/uUK6py0Yjq0/m/6peEaa90AQAJ> I=
=20
>> wish to formalize a proposal after several months of discussions.
>>
>> This proposal does not delve into the multitude of issues regarding post=
=20
>> quantum cryptography and trade-offs of different schemes, but rather is=
=20
>> meant to specifically address the issues of incentivizing adoption and=
=20
>> migration of funds *after* consensus is established that it is prudent=
=20
>> to do so.
>>
>> As such, this proposal requires P2QRH as described in BIP-360 or=20
>> potential future proposals.
>> Abstract
>>
>> This proposal follows the implementation of post-quantum (PQ) output typ=
e=20
>> (P2QRH) and introduces a pre-announced sunset of legacy ECDSA/Schnorr=20
>> signatures. It turns quantum security into a private incentive: fail to=
=20
>> upgrade and you will certainly lose access to your funds, creating a=20
>> certainty where none previously existed.=20
>>
>>    -=20
>>   =20
>>    Phase A: Disallows sending of any funds to quantum-vulnerable=20
>>    addresses, hastening the adoption of P2QRH address types.
>>    -=20
>>   =20
>>    Phase B: Renders ECDSA/Schnorr spends invalid, preventing all=20
>>    spending of funds in quantum-vulnerable UTXOs. This is triggered by a=
=20
>>    well-publicized flag-day roughly five years after activation.
>>    -=20
>>   =20
>>    Phase C (optional): Pending further research and demand, a separate=
=20
>>    BIP proposing a fork to allow recovery of legacy UTXOs through ZK pro=
of of=20
>>    possession of BIP-39 seed phrase. =20
>>   =20
>> Motivation
>>
>> We seek to secure the value of the UTXO set and minimize incentives for=
=20
>> quantum attacks. This proposal is radically different from any in Bitcoi=
n=E2=80=99s=20
>> history just as the threat posed by quantum computing is radically=20
>> different from any other threat in Bitcoin=E2=80=99s history.  Never bef=
ore has=20
>> Bitcoin faced an existential threat to its cryptographic primitives. A=
=20
>> successful quantum attack on Bitcoin would result in significant economi=
c=20
>> disruption and damage across the entire ecosystem. Beyond its impact on=
=20
>> price, the ability of miners to provide network security may be=20
>> significantly impacted. =20
>>
>>    -=20
>>   =20
>>    Accelerating quantum progress.=20
>>    -=20
>>      =20
>>       NIST ratified three production-grade PQ signature schemes in 2024;=
=20
>>       academic road-maps now estimate a cryptographically-relevant quant=
um=20
>>       computer as early as 2027-2030. [McKinsey=20
>>       <https://www.mckinsey.com/~/media/mckinsey/business%20functions/mc=
kinsey%20digital/our%20insights/the%20year%20of%20quantum%20from%20concept%=
20to%20reality%20in%202025/quantum-monitor-2025.pdf?shouldIndex=3Dfalse>
>>       ]
>>       -=20
>>   =20
>>    Quantum algorithms are rapidly improving
>>    -=20
>>      =20
>>       The safety envelope is shrinking by dramatic increases in=20
>>       algorithms even if the pace of hardware improvements is slower. Al=
gorithms=20
>>       are improving up to 20X=20
>>       <https://security.googleblog.com/2025/05/tracking-cost-of-quantum-=
factori.html>,=20
>>       lowering the theoretical hardware requirements for breaking classi=
cal=20
>>       encryption.
>>       -=20
>>   =20
>>    Bitcoin=E2=80=99s exposed public keys.=20
>>    -=20
>>      =20
>>       Roughly 25% of all bitcoin have revealed a public key on-chain;=20
>>       those UTXOs could be stolen with sufficient quantum power. =20
>>       -=20
>>   =20
>>    We may not know the attack is underway.=20
>>    -=20
>>      =20
>>       Quantum attackers could compute the private key for known public=
=20
>>       keys then transfer all funds weeks or months later, in a covert bl=
eed to=20
>>       not alert chain watchers. Q-Day may be only known much later if th=
e attack=20
>>       withholds broadcasting transactions in order to postpone revealing=
 their=20
>>       capabilities.
>>       -=20
>>   =20
>>    Private keys become public.=20
>>    -=20
>>      =20
>>       Assuming that quantum computers are able to maintain their current=
=20
>>       trajectories and overcome existing engineering obstacles, there is=
 a near=20
>>       certain chance that all P2PK (and other outputs with exposed pubke=
ys)=20
>>       private keys will be found and used to steal the funds.
>>       -=20
>>   =20
>>    Impossible to know motivations.=20
>>    -=20
>>      =20
>>       Prior to a quantum attack, it is impossible to know the=20
>>       motivations of the attacker.  An economically motivated attacker w=
ill try=20
>>       to remain undetected for as long as possible, while a malicious at=
tacker=20
>>       will attempt to destroy as much value as possible. =20
>>       -=20
>>   =20
>>    Upgrade inertia.=20
>>    -=20
>>      =20
>>       Coordinating wallets, exchanges, miners and custodians=20
>>       historically takes years.
>>       -=20
>>      =20
>>       The longer we postpone migration, the harder it becomes to=20
>>       coordinate wallets, exchanges, miners, and custodians. A clear, ti=
me-boxed=20
>>       pathway is the only credible defense.
>>       -=20
>>      =20
>>       Coordinating distributed groups is more prone to delay, even if=20
>>       everyone has similar motivations. Historically, Bitcoin has been s=
low to=20
>>       adopt code changes, often taking multiple years to be approved.
>>      =20
>> Benefits at a Glance
>>   =20
>>    -=20
>>   =20
>>    Resilience: Bitcoin protocol remains secure for the foreseeable=20
>>    future without waiting for a last-minute emergency.
>>    -=20
>>   =20
>>    Certainty: Bitcoin users and stakeholders gain certainty that a plan=
=20
>>    is both in place and being implemented to effectively deal with the t=
hreat=20
>>    of quantum theft of bitcoin. =20
>>    -=20
>>   =20
>>    Clarity: A single, publicized timeline aligns the entire ecosystem=20
>>    (wallets, exchanges, hardware vendors).
>>    -=20
>>   =20
>>    Supply Discipline: Abandoned keys that never migrate become=20
>>    unspendable, reducing supply, as Satoshi described=20
>>    <https://bitcointalk.org/index.php?topic=3D198.msg1647#msg1647>. =20
>>   =20
>> Specification
>>
>> Phase
>>
>> What Happens
>>
>> Who Must Act
>>
>> Time Horizon
>>
>> Phase A - Disallow spends to legacy script types
>>
>> Permitted sends are from legacy scripts to P2QRH scripts
>>
>> Everyone holding or accepting BTC.
>>
>> 3 years after BIP-360 implementation
>>
>> Phase B =E2=80=93 Disallow spends from quantum vulnerable outputs
>>
>> At a preset block-height, nodes reject transactions that rely on=20
>> ECDSA/Schnorr keys.=20
>>
>> Everyone holding or accepting BTC.
>>
>> 2 years after Phase A activation.
>>
>> Phase C =E2=80=93 Re-enable spends from quantum vulnerable outputs via Z=
K Proof
>>
>> Users with frozen quantum vulnerable funds and a HD wallet seed phrase=
=20
>> can construct a quantum safe ZK proof to recover funds.
>>
>> Users who failed to migrate funds before Phase B.
>>
>> TBD pending research, demand, and consensus.
>> Rationale
>>   =20
>>    -=20
>>   =20
>>    Even if Bitcoin is not a primary initial target of a=20
>>    cryptographically relevant quantum computer, widespread knowledge tha=
t such=20
>>    a computer exists and is capable of breaking Bitcoin=E2=80=99s crypto=
graphy will=20
>>    damage faith in the network .=20
>>    -=20
>>   =20
>>    An attack on Bitcoin may not be economically motivated - an attacker=
=20
>>    may be politically or maliciously motivated and may attempt to destro=
y=20
>>    value and trust in Bitcoin rather than extract value.  There is no wa=
y to=20
>>    know in advance how, when, or why an attack may occur.  A defensive=
=20
>>    position must be taken well in advance of any attack. =20
>>    -=20
>>   =20
>>    Bitcoin=E2=80=99s current signatures (ECDSA/Schnorr) will be a tantal=
izing=20
>>    target: any UTXO that has ever exposed its public key on-chain (rough=
ly 25=20
>>    % of all bitcoin) could be stolen by a cryptographically relevant qua=
ntum=20
>>    computer.
>>    -=20
>>   =20
>>    Existing Proposals are Insufficient. =20
>>    1.=20
>>      =20
>>       Any proposal that allows for the quantum theft of =E2=80=9Clost=E2=
=80=9D bitcoin=20
>>       is creating a redistribution dilemma. There are 3 types of proposa=
ls:
>>       1.=20
>>         =20
>>          Allow anyone to steal vulnerable coins, benefitting those who=
=20
>>          reach quantum capability earliest.
>>          2.=20
>>         =20
>>          Allow throttled theft of coins, which leads to RBF battles and=
=20
>>          ultimately miners subsidizing their revenue from lost coins.
>>          3.=20
>>         =20
>>          Allow no one to steal vulnerable coins.
>>          -=20
>>   =20
>>    Minimizes attack surface
>>    1.=20
>>      =20
>>       By disallowing new spends to quantum vulnerable script types, we=
=20
>>       minimize the attack surface with each new UTXO. =20
>>       2.=20
>>      =20
>>       Upgrades to Bitcoin have historically taken many years; this will=
=20
>>       hasten and speed up the adoption of new quantum resistant script t=
ypes.=20
>>       3.=20
>>      =20
>>       With a clear deadline, industry stakeholders will more readily=20
>>       upgrade existing infrastructure to ensure continuity of services. =
=20
>>       -=20
>>   =20
>>    Minimizes loss of access to funds=20
>>    1.=20
>>      =20
>>       If there is sufficient demand and research proves possible,=20
>>       submitting a ZK proof of knowledge of a BIP-39 seed phrase corresp=
onding to=20
>>       a public key hash or script hash would provide a trustless means f=
or legacy=20
>>       outputs to be spent in a quantum resistant manner, even after the =
sunset. =20
>>      =20
>>
>> Stakeholder
>>
>> Incentive to Upgrade
>>
>> Miners
>>
>> =E2=80=A2 Larger size PQ signatures along with incentive for users to mi=
grate=20
>> will create more demand for block space and thus higher fees collected b=
y=20
>> miners.
>>
>> =E2=80=A2 Post-Phase B, non-upgraded miners produce invalid blocks.
>>
>> =E2=80=A2 A quantum attack on Bitcoin will significantly devalue both th=
eir=20
>> hardware and Bitcoin as a whole.=20
>>
>> Institutional Holders
>>
>> =E2=80=A2 Fiduciary duty: failing to act to prevent a quantum attack on =
Bitcoin=20
>> would violate the fiduciary duty to shareholders. =20
>>
>> =E2=80=A2 Demonstrating Bitcoin=E2=80=99s ability to effectively mitigat=
e emerging=20
>> threats will prove Bitcoin to be an investment grade asset.
>>
>> Exchanges & Custodians
>>
>> =E2=80=A2 Concentrated risk: a quantum hack could bankrupt them overnigh=
t.
>>
>> =E2=80=A2 Early migration is cheap relative to potential losses, potenti=
al=20
>> lawsuits over improper custody and reputational damage.
>>
>> Everyday Users
>>
>> =E2=80=A2 Self-sovereign peace of mind.
>>
>> =E2=80=A2 Sunset date creates a clear deadline and incentive to improve =
their=20
>> security rather than an open-ended =E2=80=9Csome day=E2=80=9D that invit=
es procrastination.
>>
>> Attackers
>>
>> =E2=80=A2 Economic incentive diminishes as sunset nears, stolen coins ca=
nnot be=20
>> spent after Q-day.
>>
>> Key Insight: As mentioned earlier, the proposal turns quantum security=
=20
>> into a private incentive to upgrade. =20
>>
>> This is not an offensive attack, rather, it is defensive: our thesis is=
=20
>> that the Bitcoin ecosystem wishes to defend itself and its interests=20
>> against those who would prefer to do nothing and allow a malicious actor=
 to=20
>> destroy both value and trust. =20
>>
>>
>> "Lost coins only make everyone else's coins worth slightly more. Think o=
f=20
>>> it as a donation to everyone." - Satoshi Nakamoto
>>
>>
>> If true, the corollary is:
>>
>>
>> "Quantum recovered coins only make everyone else's coins worth less.=20
>>> Think of it as a theft from everyone."
>>
>>
>> The timelines that we are proposing are meant to find the best balance=
=20
>> between giving ample ability for account owners to migrate while=20
>> maintaining the integrity of the overall ecosystem to avoid catastrophic=
=20
>> attacks. =20
>>
>> Backward Compatibility
>>
>> As a series of soft forks, older nodes will continue to operate without=
=20
>> modification. Non-upgraded nodes, however, will consider all post-quantu=
m=20
>> witness programs as anyone-can-spend scripts. They are strongly encourag=
ed=20
>> to upgrade in order to fully validate the new programs.
>>
>> Non-upgraded wallets can receive and send bitcoin from non-upgraded and=
=20
>> upgraded wallets until Phase A. After Phase A, they can no longer receiv=
e=20
>> from any other wallets and can only send to upgraded wallets.  After Pha=
se=20
>> B, both senders and receivers will require upgraded wallets. Phase C wou=
ld=20
>> likely require a loosening of consensus rules (a hard fork) to allow=20
>> vulnerable funds recovery via ZK proofs.
>>
>

--=20
You received this message because you are subscribed to the Google Groups "=
Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/=
4d9ce13e-466d-478b-ab4d-00404c80d620n%40googlegroups.com.

------=_Part_411051_711094452.1752458860757
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Jameson,<br /><br />Thanks for your thoughts on this complex subject.<br=
 /><br />First and foremost, I think your following statement: "Never befor=
e has Bitcoin faced<br />an existential threat to its cryptographic primiti=
ves" is very myopic, given that<br />cryptanalysts and number theorists are=
 making progress every year in their works, and<br />each bitcoin cryptogra=
phic primitive has been and is constantly analyzed to uncover<br />potentia=
l weaknesses.<br /><br />So in my view the quantum threat is a bit less spe=
cific that the image you're painting<br />of it. Even if go all to upgrade =
to lattices-based schemes, we have no certainty that<br />novels flaws won'=
t be found, one can just go to see the modifications of the NIST-approved<b=
r />schemes in between their rounds of selection that we'll never reach som=
ething like<br />"self-sovereign peace of mind"...Unless we start to forbid=
 people of practicing the<br />art of mathematics, practice which has been =
ongoing since Euclide and Pythagore...<br /><br />I do concede that quantum=
 is a bit different, as after all new physics paradigm<br />do not happen o=
ften (Heisenberg published in the 20s iirc), though that's in my<br />view =
the flaw of your reasoning as you're assuming some "post-quantum" upgraded<=
br />state where bitcoin, as a community and a network, would be definitely=
 safe from<br />advances in applied science. At minima, in my understanding=
, you're arguing this<br />time is different to justify extra-ordinary tech=
nical measures never seen before,<br />namely the freezing of "vulnerable" =
coins.<br /><br />I'm worried this is opening a Pandora box, where we would=
 introduce a precedent<br />that it is legitimate as a community to technic=
aly confiscate some coins of users, <br />without their _consents_, for ext=
ra-ordinary reasons. That's opening a worms of<br />shenanigans in the futu=
re...There is no guarantee that this precedent won't<br />be leveraged in t=
he future by any group of entities to justify future upgrades<br />eroding =
one of the "fundamental property" you're yourself deeming as valuable.<br /=
><br />This is especially worrying as if I'm understanding you correctly yo=
u're justifying<br />this position as that somehow we should protect the pr=
ice of the currency as an end<br />in itself (i.e "Beyond its impact on pri=
ce, ..."). It's unclear the price of bitcoin<br />versus what fiat or hard =
asset (e.g oil) you have in mind. And in anyway, as far<br />as I know, non=
e of the bitcoin devs is seating on the board of the FED, the ECB<br />or t=
he BoJ...<br /><br />To put it simply, even if a quantum attacker can tomor=
row starts to steal<br />vulnerable coins, 1 BTC will be always equal to 1 =
BTC. Full stop. In my humble<br />opinion, let's not introduce the idea tha=
t, we, as a community of stakeholders<br />and developers we have a positiv=
e "fiduciary" duty to act to maintain the price<br />of bitcoin in some "mo=
netary snake" with another class of assets...<br /><br />That's also the pr=
oblem with game theory, all the matrices of analysis are<br />based on some=
 scale of utilitarism. See Von Neuman's Theory of Games, the<br />section o=
n "The Notion of Utility". My subjective appreciation of the value<br />of =
my coins might not be your subjective appreication of the value of your<br =
/>coins.<br /><br />Now I do understand the perspective of the institutiona=
l holders, the exchanges,<br />the custodians or any other industry provide=
rs, who might be in the full uncertainty<br />about their business responsi=
bilities in case of a quantum threat affecting their<br />custodied coins. =
But, first legally speaking there is something call "force majeure"<br />an=
d in view of the quantum threat, which is a risk discussed far beyond the b=
itcoin<br />industry, they should be able to shield themselves behind that.=
 Secondly, if there<br />is any futute upgrade "opt-in" only path a la BIP3=
60, you can move your funds or<br />the ones under custody =C2=A0under a PQ=
C scheme like Dilthium or Falcon and be good<br />without caring about what=
 the others users are doing. Thirdly, if you're an actor<br />in the indust=
ry like Coinbase and you're deeply concerned about how extended maelstrom<b=
r />on the price might affect the viability of your operations, it is uncle=
ar to me why<br />you don't call MunichRe or any other company like that to=
morrow to craft and be<br />covered by specific insurance on quantum threat=
s...<br /><br />To be frank, all those considerations on how "I cannot see =
how the currency can<br />maintain any value at all in such a setting", is =
a strong red flag of low time<br />preferences. It's not like we're used to=
 strong volatility in bitcoin with the<br />almost 2 decades of operations =
of the network. In my view, it's more a hint of<br />very high-exposition b=
y some to a single class of asset, i.e bitcoin, rather than wise<br />diver=
sification... And a push to sacrify a "fundamental property" i.e "conservat=
ism"<br />in view of short-term concerns (i.e the stability of the currency=
 price along<br />a period of few years).<br /><br />Do not get me wrong, I=
'm certainly not of the school "let's reward quantum<br />attackers". Lever=
aging techical superiority and employing CRQRC to steal<br />vulnerable coi=
ns would be clearly a theft. But ethically, the best we can do is<br />to h=
ave an opt-in upgrade path and be pro-active, by education and outreach,<br=
 />to have the maximum of coin owners upgrading to non-vulnerable addresses=
 types.<br />Then show the level of "fortitude" or "endurance" as a communi=
ty in face of price<br />fluctuations for a while, while seeing regularly o=
ld P2PK coins hacked. Marcus<br />Aurelius can be bought for few bucks in m=
ost of decent libraries...<br /><br />I'm definitely on the "no old coins c=
onfiscation" position you're underlighting:<br /><br />"I don't see why old=
 coins should be confiscated. The better option is to let<br />those with q=
uantum computers free up old coins. While this might have an<br />inflation=
ary impact on bitcoin's price, to use a turn of phrase, the inflation<br />=
is transitory. Those with low time preference should support returning lost=
<br />coins to circulation".<br /><br />Notwhitstanding that I disagree wit=
h your position, one can only appreciate<br />the breadth and depth with wh=
ich you're gathering and articulating all the<br />elements on this complex=
 problem.<br /><br />Best,<br />Antoine<br />OTS hash: c064b43047bf3036faf0=
98b5ac8e74930df63d25629f590a4195222979402826<br /><div class=3D"gmail_quote=
"><div dir=3D"auto" class=3D"gmail_attr">Le lundi 14 juillet 2025 =C3=A0 00=
:53:34 UTC+1, Tadge Dryja a =C3=A9crit=C2=A0:<br/></div><blockquote class=
=3D"gmail_quote" style=3D"margin: 0 0 0 0.8ex; border-left: 1px solid rgb(2=
04, 204, 204); padding-left: 1ex;">Hi =C2=A0 <br><br>While I generally agre=
e that &quot;freeze&quot; beats &quot;steal&quot;, and that a lot of lead t=
ime is good, I don&#39;t think this plan is viable.<br>To me the biggest pr=
oblem is that it ties activation of a PQ output type to *de*activation of E=
C output types. =C2=A0That would mean that someone who wants to keep using =
all the great stuff in libsecp256k1 should try to prevent BIP360 from being=
 activated.<br><br>Sure, there can be risks from CRQCs. =C2=A0But this prop=
osal would go the other direction, disabling important functionality and ev=
en destroying coins preemptively, in anticipation of something that may nev=
er happen.<br><br>Also, how do you define &quot;quantum-vulnerable UTXO&quo=
t;? =C2=A0Would any P2PKH, or P2WPKH output count? =C2=A0Or only P2PKH / P2=
WPKH outputs where the public key is already known? =C2=A0I can understand =
disabling spends from known-pubkey outputs, but for addresses where the pub=
lic key has never been revealed, commit/reveal schemes (like the one I post=
ed about &amp; am working on a follow-up post for) should safely let people=
 spend from those outputs indefinitely.<br><br>With no evidence of a QRQC, =
I can see how there would be people who&#39;d say &quot;We might never real=
ly know if a CRQC exists, so we need to disable EC spends out of caution&qu=
ot; and others who&#39;d say &quot;Don&#39;t disable EC spends, since that&=
#39;s destroying coins&quot;, and that could be a persistent disagreement. =
=C2=A0But I hope if we did in fact have a proof that a CRQC has broken secp=
256k1, there would be significant agreement on freezing known-pubkey EC out=
puts.<br><div><br></div><div>-Tadge</div><div class=3D"gmail_quote"><div di=
r=3D"auto" class=3D"gmail_attr">On Saturday, July 12, 2025 at 8:46:09=E2=80=
=AFPM UTC-4 Jameson Lopp wrote:<br></div><blockquote class=3D"gmail_quote" =
style=3D"margin:0 0 0 0.8ex;border-left:1px solid rgb(204,204,204);padding-=
left:1ex"><div dir=3D"ltr"><span><p dir=3D"ltr" style=3D"line-height:1.44;b=
ackground-color:rgb(255,255,255);margin-top:12pt;margin-bottom:0pt;padding:=
0pt 0pt 12pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&q=
uot;,monospace;color:rgb(34,34,34);background-color:transparent;font-weight=
:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-al=
ign:baseline;white-space:pre-wrap">Building upon my earlier essay </span><a=
 href=3D"https://groups.google.com/g/bitcoindev/c/uUK6py0Yjq0/m/6peEaa90AQA=
J" style=3D"text-decoration:none" rel=3D"nofollow" target=3D"_blank" data-s=
aferedirecturl=3D"https://www.google.com/url?hl=3Dfr&amp;q=3Dhttps://groups=
.google.com/g/bitcoindev/c/uUK6py0Yjq0/m/6peEaa90AQAJ&amp;source=3Dgmail&am=
p;ust=3D1752545093833000&amp;usg=3DAOvVaw3gA8vabqsyLhPPa-pe9PpP"><span styl=
e=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb=
(17,85,204);background-color:transparent;font-weight:400;font-style:normal;=
font-variant:normal;text-decoration:underline;vertical-align:baseline;white=
-space:pre-wrap">against allowing quantum recovery of bitcoin</span></a><sp=
an style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;co=
lor:rgb(34,34,34);background-color:transparent;font-weight:400;font-style:n=
ormal;font-variant:normal;text-decoration:none;vertical-align:baseline;whit=
e-space:pre-wrap"> I wish to formalize a proposal after several months of d=
iscussions.</span></p><p dir=3D"ltr" style=3D"line-height:1.44;background-c=
olor:rgb(255,255,255);margin-top:0pt;margin-bottom:0pt;padding:0pt 0pt 12pt=
"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospa=
ce;color:rgb(34,34,34);background-color:transparent;font-weight:400;font-st=
yle:normal;font-variant:normal;text-decoration:none;vertical-align:baseline=
;white-space:pre-wrap">This proposal does not delve into the multitude of i=
ssues regarding post quantum cryptography and trade-offs of different schem=
es, but rather is meant to specifically address the issues of incentivizing=
 adoption and migration of funds </span><span style=3D"font-size:11pt;font-=
family:&quot;Courier New&quot;,monospace;color:rgb(34,34,34);background-col=
or:transparent;font-weight:400;font-variant:normal;text-decoration:none;ver=
tical-align:baseline;white-space:pre-wrap"><i>after</i></span><span style=
=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(=
34,34,34);background-color:transparent;font-weight:400;font-style:normal;fo=
nt-variant:normal;text-decoration:none;vertical-align:baseline;white-space:=
pre-wrap"> consensus is established that it is prudent to do so.</span></p>=
<p dir=3D"ltr" style=3D"line-height:1.44;background-color:rgb(255,255,255);=
margin-top:0pt;margin-bottom:12pt"><span style=3D"font-size:11pt;font-famil=
y:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:trans=
parent;font-weight:400;font-style:normal;font-variant:normal;text-decoratio=
n:none;vertical-align:baseline;white-space:pre-wrap">As such, this proposal=
 requires P2QRH as described in BIP-360 or potential future proposals.</spa=
n></p><h2 dir=3D"ltr" style=3D"line-height:1.38;margin-top:18pt;margin-bott=
om:4pt"><span style=3D"font-size:17pt;font-family:&quot;Courier New&quot;,m=
onospace;color:rgb(0,0,0);background-color:transparent;font-variant-numeric=
:normal;font-variant-east-asian:normal;font-variant-alternates:normal;verti=
cal-align:baseline">Abstract</span></h2><p dir=3D"ltr" style=3D"line-height=
:1.38;margin-top:12pt;margin-bottom:12pt"><span style=3D"font-size:11pt;fon=
t-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-colo=
r:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;fo=
nt-variant-alternates:normal;vertical-align:baseline">This proposal follows=
 the implementation of post-quantum (PQ) output type (P2QRH) and introduces=
 a pre-announced sunset of legacy ECDSA/Schnorr signatures. It turns quantu=
m security into a </span><span style=3D"font-size:11pt;font-family:&quot;Co=
urier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;fon=
t-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;f=
ont-variant-alternates:normal;vertical-align:baseline">private incentive</s=
pan><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monos=
pace;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:nor=
mal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-=
align:baseline">: fail to upgrade and you will certainly lose access to you=
r funds, creating a certainty where none previously existed.=C2=A0</span></=
p><ul style=3D"margin-top:0px;margin-bottom:0px"><li dir=3D"ltr" style=3D"l=
ist-style-type:disc;font-size:11pt;font-family:&quot;Courier New&quot;,mono=
space;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:no=
rmal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical=
-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;m=
argin-top:0pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-=
size:11pt;background-color:transparent;font-weight:700;font-variant-numeric=
:normal;font-variant-east-asian:normal;font-variant-alternates:normal;verti=
cal-align:baseline">Phase A:</span><span style=3D"font-size:11pt;background=
-color:transparent;font-variant-numeric:normal;font-variant-east-asian:norm=
al;font-variant-alternates:normal;vertical-align:baseline"> Disallows sendi=
ng of any funds to quantum-vulnerable addresses, hastening the adoption of =
P2QRH address types.</span></p></li><li dir=3D"ltr" style=3D"list-style-typ=
e:disc;font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:r=
gb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-var=
iant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseli=
ne;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt=
;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;bac=
kground-color:transparent;font-weight:700;font-variant-numeric:normal;font-=
variant-east-asian:normal;font-variant-alternates:normal;vertical-align:bas=
eline">Phase B:</span><span style=3D"font-size:11pt;background-color:transp=
arent;font-variant-numeric:normal;font-variant-east-asian:normal;font-varia=
nt-alternates:normal;vertical-align:baseline"> Renders ECDSA/Schnorr spends=
 invalid, preventing all spending of funds in quantum-vulnerable UTXOs. Thi=
s is triggered by a well-publicized flag-day roughly five years after activ=
ation.</span></p></li><li dir=3D"ltr" style=3D"list-style-type:disc;font-si=
ze:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);back=
ground-color:transparent;font-variant-numeric:normal;font-variant-east-asia=
n:normal;font-variant-alternates:normal;vertical-align:baseline;white-space=
:pre"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom=
:6pt" role=3D"presentation"><span style=3D"font-size:11pt;background-color:=
transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-a=
sian:normal;font-variant-alternates:normal;vertical-align:baseline">Phase C=
 (optional):</span><span style=3D"font-size:11pt;background-color:transpare=
nt;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-=
alternates:normal;vertical-align:baseline"> Pending further research and de=
mand, a separate BIP proposing a fork to allow recovery of legacy UTXOs thr=
ough ZK proof of possession of BIP-39 seed phrase.=C2=A0=C2=A0</span></p></=
li></ul><h2 dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin=
-top:14pt;margin-bottom:6pt"><span style=3D"font-size:16pt;font-family:&quo=
t;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent=
;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-al=
ternates:normal;vertical-align:baseline">Motivation</span></h2><p dir=3D"lt=
r" style=3D"line-height:1.38;text-align:justify;margin-top:12pt;margin-bott=
om:12pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,=
monospace;color:rgb(0,0,0);background-color:transparent;font-variant-numeri=
c:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vert=
ical-align:baseline">We seek to secure the value of the UTXO set</span><spa=
n style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;col=
or:rgb(0,0,0);background-color:transparent;font-weight:700;font-variant-num=
eric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;v=
ertical-align:baseline"> </span><span style=3D"font-size:11pt;font-family:&=
quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpar=
ent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant=
-alternates:normal;vertical-align:baseline">and minimize incentives for qua=
ntum attacks. This proposal is radically different from any in Bitcoin=E2=
=80=99s history just as the threat posed by quantum computing is radically =
different from any other threat in Bitcoin=E2=80=99s history.=C2=A0 Never b=
efore has Bitcoin faced an existential threat to its cryptographic primitiv=
es. A successful quantum attack on Bitcoin would result in significant econ=
omic disruption and damage across the entire ecosystem. Beyond its impact o=
n price, the ability of miners to provide network security may be significa=
ntly impacted.=C2=A0=C2=A0</span></p><ul style=3D"margin-top:0px;margin-bot=
tom:0px"><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-=
family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:=
transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font=
-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir=
=3D"ltr" style=3D"line-height:1.38;margin-top:12pt;margin-bottom:0pt" role=
=3D"presentation"><span style=3D"font-size:11pt;background-color:transparen=
t;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:norma=
l;font-variant-alternates:normal;vertical-align:baseline">Accelerating quan=
tum progress.</span><span style=3D"font-size:11pt;background-color:transpar=
ent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant=
-alternates:normal;vertical-align:baseline">=C2=A0</span></p></li><ul style=
=3D"margin-top:0px;margin-bottom:0px"><li dir=3D"ltr" style=3D"list-style-t=
ype:circle;font-size:11pt;font-family:&quot;Courier New&quot;,monospace;col=
or:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font=
-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:ba=
seline;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top=
:0pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt=
;background-color:transparent;font-variant-numeric:normal;font-variant-east=
-asian:normal;font-variant-alternates:normal;vertical-align:baseline">NIST =
ratified three production-grade PQ signature schemes in 2024; academic road=
-maps now estimate a cryptographically-relevant quantum computer as early a=
s 2027-2030. [</span><a href=3D"https://www.mckinsey.com/~/media/mckinsey/b=
usiness%20functions/mckinsey%20digital/our%20insights/the%20year%20of%20qua=
ntum%20from%20concept%20to%20reality%20in%202025/quantum-monitor-2025.pdf?s=
houldIndex=3Dfalse" style=3D"text-decoration-line:none" rel=3D"nofollow" ta=
rget=3D"_blank" data-saferedirecturl=3D"https://www.google.com/url?hl=3Dfr&=
amp;q=3Dhttps://www.mckinsey.com/~/media/mckinsey/business%2520functions/mc=
kinsey%2520digital/our%2520insights/the%2520year%2520of%2520quantum%2520fro=
m%2520concept%2520to%2520reality%2520in%25202025/quantum-monitor-2025.pdf?s=
houldIndex%3Dfalse&amp;source=3Dgmail&amp;ust=3D1752545093833000&amp;usg=3D=
AOvVaw0OgYBGZ2GIsi97kLd8eg0Q"><span style=3D"font-size:11pt;background-colo=
r:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;fo=
nt-variant-alternates:normal;text-decoration-line:underline;vertical-align:=
baseline">McKinsey</span></a><span style=3D"font-size:11pt;background-color=
:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;fon=
t-variant-alternates:normal;vertical-align:baseline">]</span></p></li></ul>=
<li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-family:&q=
uot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpare=
nt;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:norm=
al;font-variant-alternates:normal;vertical-align:baseline;white-space:pre">=
<p dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0pt;=
margin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;back=
ground-color:transparent;font-variant-numeric:normal;font-variant-east-asia=
n:normal;font-variant-alternates:normal;vertical-align:baseline">Quantum al=
gorithms are rapidly improving</span></p></li><ul style=3D"margin-top:0px;m=
argin-bottom:0px"><li dir=3D"ltr" style=3D"list-style-type:circle;font-size=
:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgr=
ound-color:transparent;font-variant-numeric:normal;font-variant-east-asian:=
normal;font-variant-alternates:normal;vertical-align:baseline;white-space:p=
re"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:=
0pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;=
background-color:transparent;font-variant-numeric:normal;font-variant-east-=
asian:normal;font-variant-alternates:normal;vertical-align:baseline">The sa=
fety envelope is shrinking by dramatic increases in algorithms even if the =
pace of hardware improvements is slower. Algorithms are <a href=3D"https://=
security.googleblog.com/2025/05/tracking-cost-of-quantum-factori.html" rel=
=3D"nofollow" target=3D"_blank" data-saferedirecturl=3D"https://www.google.=
com/url?hl=3Dfr&amp;q=3Dhttps://security.googleblog.com/2025/05/tracking-co=
st-of-quantum-factori.html&amp;source=3Dgmail&amp;ust=3D1752545093834000&am=
p;usg=3DAOvVaw1JifdrzH-Z8t_nvl1-mDpM">improving up to 20X</a>, lowering the=
 theoretical hardware requirements for breaking classical encryption.</span=
></p></li></ul><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt=
;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-=
color:transparent;font-variant-numeric:normal;font-variant-east-asian:norma=
l;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><=
p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt" r=
ole=3D"presentation"><span style=3D"font-size:11pt;background-color:transpa=
rent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:no=
rmal;font-variant-alternates:normal;vertical-align:baseline">Bitcoin=E2=80=
=99s exposed public keys.</span><span style=3D"font-size:11pt;background-co=
lor:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;=
font-variant-alternates:normal;vertical-align:baseline">=C2=A0</span></p></=
li><ul style=3D"margin-top:0px;margin-bottom:0px"><li dir=3D"ltr" style=3D"=
list-style-type:circle;font-size:11pt;font-family:&quot;Courier New&quot;,m=
onospace;color:rgb(0,0,0);background-color:transparent;font-variant-numeric=
:normal;font-variant-east-asian:normal;font-variant-alternates:normal;verti=
cal-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.3=
8;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"fo=
nt-size:11pt;background-color:transparent;font-variant-numeric:normal;font-=
variant-east-asian:normal;font-variant-alternates:normal;vertical-align:bas=
eline">Roughly 25% of all bitcoin have revealed a public key on-chain; thos=
e UTXOs could be stolen with sufficient quantum power.=C2=A0=C2=A0</span></=
p></li></ul><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;fo=
nt-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-col=
or:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;f=
ont-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p d=
ir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0pt;marg=
in-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;backgrou=
nd-color:transparent;font-weight:700;font-variant-numeric:normal;font-varia=
nt-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline=
">We may not know the attack is underway.=C2=A0</span></p></li><ul style=3D=
"margin-top:0px;margin-bottom:0px"><li dir=3D"ltr" style=3D"list-style-type=
:circle;font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:=
rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-va=
riant-east-asian:normal;font-variant-alternates:normal;vertical-align:basel=
ine;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:ju=
stify;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><span style=
=3D"font-size:11pt;background-color:transparent;font-variant-numeric:normal=
;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-ali=
gn:baseline">Quantum attackers could compute the private key for known publ=
ic keys then transfer all funds weeks or months later, in a covert bleed to=
 not alert chain watchers. Q-Day may be only known much later if the attack=
 withholds broadcasting transactions in order to postpone revealing their c=
apabilities.</span></p></li></ul><li dir=3D"ltr" style=3D"list-style-type:d=
isc;font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(=
0,0,0);background-color:transparent;font-weight:700;font-variant-numeric:no=
rmal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical=
-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;m=
argin-top:0pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-=
size:11pt;background-color:transparent;font-variant-numeric:normal;font-var=
iant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseli=
ne">Private keys become public.=C2=A0</span></p></li><ul style=3D"margin-to=
p:0px;margin-bottom:0px"><li dir=3D"ltr" style=3D"list-style-type:circle;fo=
nt-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0)=
;background-color:transparent;font-weight:700;font-variant-numeric:normal;f=
ont-variant-east-asian:normal;font-variant-alternates:normal;vertical-align=
:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;margin-=
top:0pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:1=
1pt;background-color:transparent;font-weight:400;font-variant-numeric:norma=
l;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-al=
ign:baseline">Assuming that quantum computers are able to maintain their cu=
rrent trajectories and overcome existing engineering obstacles, there is a =
near certain chance that all P2PK (and other outputs with exposed pubkeys) =
private keys will be found and used to steal the funds.</span></p></li></ul=
><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-family:&=
quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpar=
ent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:nor=
mal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"=
><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"=
 role=3D"presentation"><span style=3D"font-size:11pt;background-color:trans=
parent;font-variant-numeric:normal;font-variant-east-asian:normal;font-vari=
ant-alternates:normal;vertical-align:baseline">Impossible to know motivatio=
ns.=C2=A0</span></p></li><ul style=3D"margin-top:0px;margin-bottom:0px"><li=
 dir=3D"ltr" style=3D"list-style-type:circle;font-size:11pt;font-family:&qu=
ot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transparen=
t;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:norma=
l;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><=
p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt" r=
ole=3D"presentation"><span style=3D"font-size:11pt;background-color:transpa=
rent;font-weight:400;font-variant-numeric:normal;font-variant-east-asian:no=
rmal;font-variant-alternates:normal;vertical-align:baseline">Prior to a qua=
ntum attack, it is impossible to know the motivations of the attacker.=C2=
=A0 An economically motivated attacker will try to remain undetected for as=
 long as possible, while a malicious attacker will attempt to destroy as mu=
ch value as possible.=C2=A0=C2=A0</span></p></li></ul><li dir=3D"ltr" style=
=3D"list-style-type:disc;font-size:11pt;font-family:&quot;Courier New&quot;=
,monospace;color:rgb(0,0,0);background-color:transparent;font-variant-numer=
ic:normal;font-variant-east-asian:normal;font-variant-alternates:normal;ver=
tical-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1=
.38;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"=
font-size:11pt;background-color:transparent;font-weight:700;font-variant-nu=
meric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;=
vertical-align:baseline">Upgrade inertia.</span><span style=3D"font-size:11=
pt;background-color:transparent;font-variant-numeric:normal;font-variant-ea=
st-asian:normal;font-variant-alternates:normal;vertical-align:baseline">=C2=
=A0</span></p></li><ul style=3D"margin-top:0px;margin-bottom:0px"><li dir=
=3D"ltr" style=3D"list-style-type:circle;font-size:11pt;font-family:&quot;C=
ourier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;fo=
nt-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alter=
nates:normal;vertical-align:baseline;white-space:pre"><p dir=3D"ltr" style=
=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt" role=3D"presentation=
"><span style=3D"font-size:11pt;background-color:transparent;font-variant-n=
umeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal=
;vertical-align:baseline">Coordinating wallets, exchanges, miners and custo=
dians historically takes years.</span></p></li><li dir=3D"ltr" style=3D"lis=
t-style-type:circle;font-size:11pt;font-family:&quot;Courier New&quot;,mono=
space;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:no=
rmal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical=
-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;t=
ext-align:justify;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><=
span style=3D"font-size:11pt;background-color:transparent;font-variant-nume=
ric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;ve=
rtical-align:baseline">The longer we postpone migration, the harder it beco=
mes to coordinate wallets, exchanges, miners, and custodians. A clear, time=
-boxed pathway is the only credible defense.</span></p></li><li dir=3D"ltr"=
 style=3D"list-style-type:circle;font-size:11pt;font-family:&quot;Courier N=
ew&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-varia=
nt-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:no=
rmal;vertical-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-=
height:1.38;text-align:justify;margin-top:0pt;margin-bottom:12pt" role=3D"p=
resentation"><span style=3D"font-size:11pt;background-color:transparent;fon=
t-variant-numeric:normal;font-variant-east-asian:normal;font-variant-altern=
ates:normal;vertical-align:baseline">Coordinating distributed groups is mor=
e prone to delay, even if everyone has similar motivations. Historically, B=
itcoin has been slow to adopt code changes, often taking multiple years to =
be approved.</span></p></li></ul></ul><h2 dir=3D"ltr" style=3D"line-height:=
1.38;text-align:justify;margin-top:14pt;margin-bottom:6pt"><span style=3D"f=
ont-size:16pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0=
);background-color:transparent;font-variant-numeric:normal;font-variant-eas=
t-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Bene=
fits at a Glance</span></h2><ul style=3D"margin-top:0px;margin-bottom:0px">=
<li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-family:Ar=
ial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-n=
umeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal=
;vertical-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-heig=
ht:1.38;text-align:justify;margin-top:12pt;margin-bottom:0pt" role=3D"prese=
ntation"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,=
monospace;background-color:transparent;font-weight:700;font-variant-numeric=
:normal;font-variant-east-asian:normal;font-variant-alternates:normal;verti=
cal-align:baseline">Resilience:</span><span style=3D"font-size:11pt;font-fa=
mily:&quot;Courier New&quot;,monospace;background-color:transparent;font-va=
riant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates=
:normal;vertical-align:baseline"> Bitcoin protocol remains secure for the f=
oreseeable future without waiting for a last-minute emergency.</span></p></=
li><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-family=
:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-varian=
t-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:nor=
mal;vertical-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-h=
eight:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt" role=3D"pre=
sentation"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot=
;,monospace;background-color:transparent;font-weight:700;font-variant-numer=
ic:normal;font-variant-east-asian:normal;font-variant-alternates:normal;ver=
tical-align:baseline">Certainty</span><span style=3D"font-size:11pt;font-fa=
mily:&quot;Courier New&quot;,monospace;background-color:transparent;font-va=
riant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates=
:normal;vertical-align:baseline">: Bitcoin users and stakeholders gain cert=
ainty that a plan is both in place and being implemented to effectively dea=
l with the threat of quantum theft of bitcoin.=C2=A0=C2=A0</span></p></li><=
li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-family:Ari=
al,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-nu=
meric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;=
vertical-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-heigh=
t:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt" role=3D"present=
ation"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,mo=
nospace;background-color:transparent;font-weight:700;font-variant-numeric:n=
ormal;font-variant-east-asian:normal;font-variant-alternates:normal;vertica=
l-align:baseline">Clarity:</span><span style=3D"font-size:11pt;font-family:=
&quot;Courier New&quot;,monospace;background-color:transparent;font-variant=
-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:norm=
al;vertical-align:baseline"> A single, publicized timeline aligns the entir=
e ecosystem (wallets, exchanges, hardware vendors).</span></p></li><li dir=
=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-family:Arial,san=
s-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:=
normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertic=
al-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38=
;text-align:justify;margin-top:0pt;margin-bottom:12pt" role=3D"presentation=
"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospa=
ce;background-color:transparent;font-weight:700;font-variant-numeric:normal=
;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-ali=
gn:baseline">Supply Discipline:</span><span style=3D"font-size:11pt;font-fa=
mily:&quot;Courier New&quot;,monospace;background-color:transparent;font-va=
riant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates=
:normal;vertical-align:baseline"> Abandoned keys that never migrate become =
unspendable, reducing supply, <a href=3D"https://bitcointalk.org/index.php?=
topic=3D198.msg1647#msg1647" rel=3D"nofollow" target=3D"_blank" data-safere=
directurl=3D"https://www.google.com/url?hl=3Dfr&amp;q=3Dhttps://bitcointalk=
.org/index.php?topic%3D198.msg1647%23msg1647&amp;source=3Dgmail&amp;ust=3D1=
752545093834000&amp;usg=3DAOvVaw0-ul0MvvxQHDXnt69QrxaD">as Satoshi describe=
d</a></span><span style=3D"font-size:11pt;font-family:&quot;Courier New&quo=
t;,monospace;background-color:transparent;font-variant-numeric:normal;font-=
variant-east-asian:normal;font-variant-alternates:normal;vertical-align:bas=
eline">.=C2=A0=C2=A0</span></p></li></ul><h2 dir=3D"ltr" style=3D"line-heig=
ht:1.38;text-align:justify;margin-top:12pt;margin-bottom:12pt"><span style=
=3D"font-size:16pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(=
0,0,0);background-color:transparent;font-variant-numeric:normal;font-varian=
t-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"=
>Specification</span></h2><h2 dir=3D"ltr" style=3D"line-height:1.38;text-al=
ign:justify;margin-top:12pt;margin-bottom:12pt"><span style=3D"font-weight:=
normal"><div dir=3D"ltr" style=3D"margin-left:0pt" align=3D"left"><table st=
yle=3D"border:none;border-collapse:collapse"><colgroup><col width=3D"181"><=
col width=3D"224"><col width=3D"137"><col width=3D"130"></colgroup><tbody><=
tr style=3D"height:0pt"><td style=3D"border-width:1pt;border-style:solid;bo=
rder-color:rgb(0,0,0);vertical-align:top;padding:5pt;overflow:hidden"><p di=
r=3D"ltr" style=3D"line-height:1.38;text-align:center;margin-top:0pt;margin=
-bottom:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&qu=
ot;,monospace;color:rgb(0,0,0);background-color:transparent;font-weight:700=
;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-al=
ternates:normal;vertical-align:baseline">Phase</span></p></td><td style=3D"=
border-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:=
top;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;t=
ext-align:center;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size=
:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgr=
ound-color:transparent;font-weight:700;font-variant-numeric:normal;font-var=
iant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseli=
ne">What Happens</span></p></td><td style=3D"border-width:1pt;border-style:=
solid;border-color:rgb(0,0,0);vertical-align:top;padding:5pt;overflow:hidde=
n"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:center;margin-top:0p=
t;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courie=
r New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-we=
ight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-va=
riant-alternates:normal;vertical-align:baseline">Who Must Act</span></p></t=
d><td style=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);=
vertical-align:top;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"lin=
e-height:1.38;text-align:center;margin-top:0pt;margin-bottom:0pt"><span sty=
le=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rg=
b(0,0,0);background-color:transparent;font-weight:700;font-variant-numeric:=
normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertic=
al-align:baseline">Time Horizon</span></p></td></tr><tr style=3D"height:0pt=
"><td style=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);=
vertical-align:top;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"lin=
e-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11=
pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgroun=
d-color:transparent;font-weight:700;font-variant-numeric:normal;font-varian=
t-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"=
>Phase A - </span><span style=3D"font-size:11pt;font-family:&quot;Courier N=
ew&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-varia=
nt-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:no=
rmal;vertical-align:baseline">Disallow spends to legacy script types</span>=
</p></td><td style=3D"border-width:1pt;border-style:solid;border-color:rgb(=
0,0,0);vertical-align:middle;padding:5pt;overflow:hidden"><p dir=3D"ltr" st=
yle=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"fo=
nt-size:10pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0)=
;background-color:transparent;font-variant-numeric:normal;font-variant-east=
-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Permi=
tted sends are from legacy scripts to P2QRH scripts</span></p></td><td styl=
e=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-a=
lign:middle;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-heigh=
t:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font=
-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color=
:transparent;font-style:italic;font-variant-numeric:normal;font-variant-eas=
t-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Ever=
yone</span><span style=3D"font-size:10pt;font-family:&quot;Courier New&quot=
;,monospace;color:rgb(0,0,0);background-color:transparent;font-variant-nume=
ric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;ve=
rtical-align:baseline"> holding or accepting BTC.</span></p></td><td style=
=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-al=
ign:middle;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height=
:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-=
family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:=
transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font=
-variant-alternates:normal;vertical-align:baseline">3 years after BIP-360 i=
mplementation</span></p></td></tr><tr style=3D"height:0pt"><td style=3D"bor=
der-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:top=
;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;marg=
in-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family:&qu=
ot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transparen=
t;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:norma=
l;font-variant-alternates:normal;vertical-align:baseline">Phase B =E2=80=93=
 </span><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,m=
onospace;color:rgb(0,0,0);background-color:transparent;font-variant-numeric=
:normal;font-variant-east-asian:normal;font-variant-alternates:normal;verti=
cal-align:baseline">Disallow spends from quantum vulnerable outputs</span><=
/p></td><td style=3D"border-width:1pt;border-style:solid;border-color:rgb(0=
,0,0);vertical-align:middle;padding:5pt;overflow:hidden"><p dir=3D"ltr" sty=
le=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"fon=
t-size:10pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);=
background-color:transparent;font-variant-numeric:normal;font-variant-east-=
asian:normal;font-variant-alternates:normal;vertical-align:baseline">At a p=
reset block-height, nodes reject transactions that rely on ECDSA/Schnorr ke=
ys.=C2=A0</span></p></td><td style=3D"border-width:1pt;border-style:solid;b=
order-color:rgb(0,0,0);vertical-align:middle;padding:5pt;overflow:hidden"><=
p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><=
span style=3D"font-size:10pt;font-family:&quot;Courier New&quot;,monospace;=
color:rgb(0,0,0);background-color:transparent;font-style:italic;font-varian=
t-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:nor=
mal;vertical-align:baseline">Everyone</span><span style=3D"font-size:10pt;f=
ont-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-co=
lor:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;=
font-variant-alternates:normal;vertical-align:baseline"> holding or accepti=
ng BTC.</span></p></td><td style=3D"border-width:1pt;border-style:solid;bor=
der-color:rgb(0,0,0);vertical-align:middle;padding:5pt;overflow:hidden"><p =
dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><sp=
an style=3D"font-size:10pt;font-family:&quot;Courier New&quot;,monospace;co=
lor:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;fon=
t-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:b=
aseline">2 years after Phase A activation.</span></p></td></tr><tr style=3D=
"height:0pt"><td style=3D"border-width:1pt;border-style:solid;border-color:=
rgb(0,0,0);vertical-align:top;padding:5pt;overflow:hidden"><p dir=3D"ltr" s=
tyle=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"f=
ont-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0=
);background-color:transparent;font-weight:700;font-variant-numeric:normal;=
font-variant-east-asian:normal;font-variant-alternates:normal;vertical-alig=
n:baseline">Phase C =E2=80=93 </span><span style=3D"font-size:11pt;font-fam=
ily:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:tra=
nsparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-va=
riant-alternates:normal;vertical-align:baseline">Re-enable spends from quan=
tum vulnerable outputs via ZK Proof</span></p></td><td style=3D"border-widt=
h:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:middle;padd=
ing:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;margin-to=
p:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-family:&quot;Co=
urier New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;fon=
t-variant-numeric:normal;font-variant-east-asian:normal;font-variant-altern=
ates:normal;vertical-align:baseline">Users with frozen quantum vulnerable f=
unds and a HD wallet seed phrase can construct a quantum safe ZK proof to r=
ecover funds.</span></p></td><td style=3D"border-width:1pt;border-style:sol=
id;border-color:rgb(0,0,0);vertical-align:middle;padding:5pt;overflow:hidde=
n"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0p=
t"><span style=3D"font-size:10pt;font-family:&quot;Courier New&quot;,monosp=
ace;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:norm=
al;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-a=
lign:baseline">Users who failed to migrate funds before Phase B.</span></p>=
</td><td style=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,=
0);vertical-align:middle;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=
=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-=
size:10pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);ba=
ckground-color:transparent;font-variant-numeric:normal;font-variant-east-as=
ian:normal;font-variant-alternates:normal;vertical-align:baseline">TBD pend=
ing research, demand, and consensus.</span></p></td></tr></tbody></table></=
div></span></h2><h2 dir=3D"ltr" style=3D"line-height:1.38;margin-top:14pt;m=
argin-bottom:6pt"><span style=3D"font-size:16pt;font-family:&quot;Courier N=
ew&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-weigh=
t:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-a=
lign:baseline;white-space:pre-wrap">Rationale</span></h2><ul style=3D"margi=
n-top:0px;margin-bottom:0px"><li dir=3D"ltr" style=3D"list-style-type:disc;=
font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,=
0);background-color:transparent;font-variant-numeric:normal;font-variant-ea=
st-asian:normal;font-variant-alternates:normal;vertical-align:baseline;whit=
e-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;ma=
rgin-top:12pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-=
size:11pt;background-color:transparent;font-variant-numeric:normal;font-var=
iant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseli=
ne">Even if Bitcoin is not a primary initial target of a cryptographically =
relevant quantum computer, widespread knowledge that such a computer exists=
 and is capable of breaking Bitcoin=E2=80=99s cryptography will damage fait=
h in the network .=C2=A0</span></p></li><li dir=3D"ltr" style=3D"list-style=
-type:disc;font-size:11pt;font-family:&quot;Courier New&quot;,monospace;col=
or:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font=
-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:ba=
seline;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;text-align=
:justify;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><span styl=
e=3D"font-size:11pt;background-color:transparent;font-variant-numeric:norma=
l;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-al=
ign:baseline">An attack on Bitcoin may not be economically motivated - an a=
ttacker may be politically or maliciously motivated and may attempt to dest=
roy value and trust in Bitcoin rather than extract value.=C2=A0 There is no=
 way to know in advance how, when, or why an attack may occur.=C2=A0 A defe=
nsive position must be taken well in advance of any attack.=C2=A0=C2=A0</sp=
an></p></li><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;fo=
nt-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-col=
or:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;f=
ont-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p d=
ir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0pt;marg=
in-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;backgrou=
nd-color:transparent;font-variant-numeric:normal;font-variant-east-asian:no=
rmal;font-variant-alternates:normal;vertical-align:baseline">Bitcoin=E2=80=
=99s current signatures (ECDSA/Schnorr) will be a tantalizing target: any U=
TXO that has ever exposed its public key on-chain (roughly 25 % of all bitc=
oin) could be stolen by a cryptographically relevant quantum computer.</spa=
n></p></li><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;fon=
t-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;fon=
t-variant-numeric:normal;font-variant-east-asian:normal;font-variant-altern=
ates:normal;vertical-align:baseline;white-space:pre"><p dir=3D"ltr" style=
=3D"line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt" r=
ole=3D"presentation"><span style=3D"font-size:11pt;font-family:&quot;Courie=
r New&quot;,monospace;background-color:transparent;font-weight:700;font-var=
iant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:=
normal;vertical-align:baseline">Existing Proposals are Insufficient.</span>=
<span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace=
;background-color:transparent;font-variant-numeric:normal;font-variant-east=
-asian:normal;font-variant-alternates:normal;vertical-align:baseline">=C2=
=A0=C2=A0</span></p></li><ol style=3D"margin-top:0px;margin-bottom:0px"><li=
 dir=3D"ltr" style=3D"list-style-type:lower-alpha;font-size:11pt;font-famil=
y:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:trans=
parent;font-variant-numeric:normal;font-variant-east-asian:normal;font-vari=
ant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir=3D"lt=
r" style=3D"line-height:1.38;text-align:justify;margin-top:0pt;margin-botto=
m:0pt" role=3D"presentation"><span style=3D"font-size:11pt;background-color=
:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;fon=
t-variant-alternates:normal;vertical-align:baseline">Any proposal that allo=
ws for the quantum theft of =E2=80=9Clost=E2=80=9D bitcoin is creating a re=
distribution dilemma. There are 3 types of proposals:</span></p></li><ol st=
yle=3D"margin-top:0px;margin-bottom:0px"><li dir=3D"ltr" style=3D"list-styl=
e-type:lower-roman;font-size:11pt;font-family:&quot;Courier New&quot;,monos=
pace;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:nor=
mal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-=
align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;te=
xt-align:justify;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><s=
pan style=3D"font-size:11pt;background-color:transparent;font-variant-numer=
ic:normal;font-variant-east-asian:normal;font-variant-alternates:normal;ver=
tical-align:baseline">Allow anyone to steal vulnerable coins, benefitting t=
hose who reach quantum capability earliest.</span></p></li><li dir=3D"ltr" =
style=3D"list-style-type:lower-roman;font-size:11pt;font-family:&quot;Couri=
er New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-v=
ariant-numeric:normal;font-variant-east-asian:normal;font-variant-alternate=
s:normal;vertical-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"l=
ine-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt" role=
=3D"presentation"><span style=3D"font-size:11pt;background-color:transparen=
t;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-a=
lternates:normal;vertical-align:baseline">Allow throttled theft of coins, w=
hich leads to RBF battles and ultimately miners subsidizing their revenue f=
rom lost coins.</span></p></li><li dir=3D"ltr" style=3D"list-style-type:low=
er-roman;font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color=
:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-v=
ariant-east-asian:normal;font-variant-alternates:normal;vertical-align:base=
line;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:j=
ustify;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><span style=
=3D"font-size:11pt;background-color:transparent;font-variant-numeric:normal=
;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-ali=
gn:baseline">Allow no one to steal vulnerable coins.</span></p></li></ol></=
ol><li dir=3D"ltr" style=3D"list-style-type:disc;font-size:11pt;font-family=
:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transp=
arent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:n=
ormal;font-variant-alternates:normal;vertical-align:baseline;white-space:pr=
e"><p dir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0=
pt;margin-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;b=
ackground-color:transparent;font-variant-numeric:normal;font-variant-east-a=
sian:normal;font-variant-alternates:normal;vertical-align:baseline">Minimiz=
es attack surface</span></p></li><ol style=3D"margin-top:0px;margin-bottom:=
0px"><li dir=3D"ltr" style=3D"list-style-type:lower-alpha;font-size:11pt;fo=
nt-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-col=
or:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;f=
ont-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p d=
ir=3D"ltr" style=3D"line-height:1.38;text-align:justify;margin-top:0pt;marg=
in-bottom:0pt" role=3D"presentation"><span style=3D"font-size:11pt;backgrou=
nd-color:transparent;font-variant-numeric:normal;font-variant-east-asian:no=
rmal;font-variant-alternates:normal;vertical-align:baseline">By disallowing=
 new spends to quantum vulnerable script types, we minimize the attack surf=
ace with each new UTXO.=C2=A0=C2=A0</span></p></li><li dir=3D"ltr" style=3D=
"list-style-type:lower-alpha;font-size:11pt;font-family:&quot;Courier New&q=
uot;,monospace;color:rgb(0,0,0);background-color:transparent;font-variant-n=
umeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal=
;vertical-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-heig=
ht:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt" role=3D"presen=
tation"><span style=3D"font-size:11pt;background-color:transparent;font-var=
iant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:=
normal;vertical-align:baseline">Upgrades to Bitcoin have historically taken=
 many years; this will hasten and speed up the adoption of new quantum resi=
stant script types.=C2=A0</span></p></li><li dir=3D"ltr" style=3D"list-styl=
e-type:lower-alpha;font-size:11pt;font-family:&quot;Courier New&quot;,monos=
pace;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:nor=
mal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-=
align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;te=
xt-align:justify;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><s=
pan style=3D"font-size:11pt;background-color:transparent;font-variant-numer=
ic:normal;font-variant-east-asian:normal;font-variant-alternates:normal;ver=
tical-align:baseline">With a clear deadline, industry stakeholders will mor=
e readily upgrade existing infrastructure to ensure continuity of services.=
=C2=A0=C2=A0</span></p></li></ol><li dir=3D"ltr" style=3D"list-style-type:d=
isc;font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(=
0,0,0);background-color:transparent;font-weight:700;font-variant-numeric:no=
rmal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical=
-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-height:1.38;t=
ext-align:justify;margin-top:0pt;margin-bottom:0pt" role=3D"presentation"><=
span style=3D"font-size:11pt;background-color:transparent;font-variant-nume=
ric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;ve=
rtical-align:baseline">Minimizes loss of access to funds=C2=A0</span></p></=
li><ol style=3D"margin-top:0px;margin-bottom:0px"><li dir=3D"ltr" style=3D"=
list-style-type:lower-alpha;font-size:11pt;font-family:&quot;Courier New&qu=
ot;,monospace;color:rgb(0,0,0);background-color:transparent;font-variant-nu=
meric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;=
vertical-align:baseline;white-space:pre"><p dir=3D"ltr" style=3D"line-heigh=
t:1.38;text-align:justify;margin-top:0pt;margin-bottom:12pt" role=3D"presen=
tation"><span style=3D"font-size:11pt;background-color:transparent;font-var=
iant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:=
normal;vertical-align:baseline">If there is sufficient demand and research =
proves possible, submitting a ZK proof of knowledge of a BIP-39 seed phrase=
 corresponding to  a public key hash or script hash would provide a trustle=
ss means for legacy outputs to be spent in a quantum resistant manner, even=
 after the sunset.=C2=A0=C2=A0</span></p></li></ol></ul><br><div dir=3D"ltr=
" style=3D"margin-left:0pt" align=3D"left"><table style=3D"border:none;bord=
er-collapse:collapse"><colgroup><col width=3D"143"><col width=3D"539"></col=
group><tbody><tr style=3D"height:27.4463pt"><td style=3D"border-width:1pt;b=
order-style:solid;border-color:rgb(0,0,0);vertical-align:top;padding:5pt;ov=
erflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;marg=
in-bottom:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&=
quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-weight:7=
00;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-=
alternates:normal;vertical-align:baseline">Stakeholder</span></p></td><td s=
tyle=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertica=
l-align:top;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-heigh=
t:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font=
-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color=
:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-=
asian:normal;font-variant-alternates:normal;vertical-align:baseline">Incent=
ive to Upgrade</span></p></td></tr><tr style=3D"height:53.5388pt"><td style=
=3D"border-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-al=
ign:middle;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height=
:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-=
family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:=
transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-a=
sian:normal;font-variant-alternates:normal;vertical-align:baseline">Miners<=
/span></p></td><td style=3D"border-width:1pt;border-style:solid;border-colo=
r:rgb(0,0,0);vertical-align:top;padding:5pt;overflow:hidden"><p dir=3D"ltr"=
 style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D=
"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0=
,0);background-color:transparent;font-variant-numeric:normal;font-variant-e=
ast-asian:normal;font-variant-alternates:normal;vertical-align:baseline">=
=E2=80=A2 Larger size PQ signatures along with incentive for users to migra=
te will create more demand for block space and thus higher fees collected b=
y miners.</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt=
;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier=
 New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-var=
iant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:=
normal;vertical-align:baseline">=E2=80=A2 Post-Phase B, non-upgraded miners=
 produce invalid blocks.</span></p><p dir=3D"ltr" style=3D"line-height:1.38=
;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-famil=
y:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:trans=
parent;font-variant-numeric:normal;font-variant-east-asian:normal;font-vari=
ant-alternates:normal;vertical-align:baseline">=E2=80=A2 A quantum attack o=
n Bitcoin will significantly devalue both their hardware and Bitcoin as a w=
hole.=C2=A0</span></p></td></tr><tr style=3D"height:52pt"><td style=3D"bord=
er-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:midd=
le;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;ma=
rgin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family:&=
quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpar=
ent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:nor=
mal;font-variant-alternates:normal;vertical-align:baseline">Institutional H=
olders</span></p></td><td style=3D"border-width:1pt;border-style:solid;bord=
er-color:rgb(0,0,0);vertical-align:top;padding:5pt;overflow:hidden"><p dir=
=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span =
style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color=
:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-v=
ariant-east-asian:normal;font-variant-alternates:normal;vertical-align:base=
line">=E2=80=A2 Fiduciary duty: failing to act to prevent a quantum attack =
on Bitcoin would violate the fiduciary duty to shareholders.=C2=A0=C2=A0</s=
pan></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bott=
om:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,m=
onospace;color:rgb(0,0,0);background-color:transparent;font-variant-numeric=
:normal;font-variant-east-asian:normal;font-variant-alternates:normal;verti=
cal-align:baseline">=E2=80=A2 Demonstrating Bitcoin=E2=80=99s ability to ef=
fectively mitigate emerging threats will prove Bitcoin to be an investment =
grade asset.</span></p></td></tr><tr style=3D"height:52pt"><td style=3D"bor=
der-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:mid=
dle;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;m=
argin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family:=
&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpa=
rent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:no=
rmal;font-variant-alternates:normal;vertical-align:baseline">Exchanges &amp=
; Custodians</span></p></td><td style=3D"border-width:1pt;border-style:soli=
d;border-color:rgb(0,0,0);vertical-align:top;padding:5pt;overflow:hidden"><=
p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><=
span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;=
color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;f=
ont-variant-east-asian:normal;font-variant-alternates:normal;vertical-align=
:baseline">=E2=80=A2 Concentrated risk: a quantum hack could bankrupt them =
overnight.</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0p=
t;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courie=
r New&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-va=
riant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates=
:normal;vertical-align:baseline">=E2=80=A2 Early migration is cheap relativ=
e to potential losses, potential lawsuits over improper custody and reputat=
ional damage.</span></p></td></tr><tr style=3D"height:52pt"><td style=3D"bo=
rder-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:mi=
ddle;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;=
margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family=
:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transp=
arent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:n=
ormal;font-variant-alternates:normal;vertical-align:baseline">Everyday User=
s</span></p></td><td style=3D"border-width:1pt;border-style:solid;border-co=
lor:rgb(0,0,0);vertical-align:top;padding:5pt;overflow:hidden"><p dir=3D"lt=
r" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=
=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(=
0,0,0);background-color:transparent;font-variant-numeric:normal;font-varian=
t-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"=
>=E2=80=A2 Self-sovereign peace of mind.</span></p><p dir=3D"ltr" style=3D"=
line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size=
:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);backgr=
ound-color:transparent;font-variant-numeric:normal;font-variant-east-asian:=
normal;font-variant-alternates:normal;vertical-align:baseline">=E2=80=A2 Su=
nset date creates a clear deadline and incentive to improve their security =
rather than an open-ended =E2=80=9Csome day=E2=80=9D that invites procrasti=
nation.</span></p></td></tr><tr style=3D"height:43.7925pt"><td style=3D"bor=
der-width:1pt;border-style:solid;border-color:rgb(0,0,0);vertical-align:mid=
dle;padding:5pt;overflow:hidden"><p dir=3D"ltr" style=3D"line-height:1.38;m=
argin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:11pt;font-family:=
&quot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transpa=
rent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:no=
rmal;font-variant-alternates:normal;vertical-align:baseline">Attackers</spa=
n></p></td><td style=3D"border-width:1pt;border-style:solid;border-color:rg=
b(0,0,0);vertical-align:top;padding:5pt;overflow:hidden"><p dir=3D"ltr" sty=
le=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"fon=
t-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);=
background-color:transparent;font-variant-numeric:normal;font-variant-east-=
asian:normal;font-variant-alternates:normal;vertical-align:baseline">=E2=80=
=A2 Economic incentive diminishes as sunset nears, stolen coins cannot be s=
pent after Q-day.</span></p></td></tr></tbody></table></div><p dir=3D"ltr" =
style=3D"line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:=
12pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,mon=
ospace;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-v=
ariant-numeric:normal;font-variant-east-asian:normal;font-variant-alternate=
s:normal;vertical-align:baseline">Key Insight:</span><span style=3D"font-si=
ze:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);back=
ground-color:transparent;font-variant-numeric:normal;font-variant-east-asia=
n:normal;font-variant-alternates:normal;vertical-align:baseline"> As mentio=
ned earlier, the proposal turns quantum security into a </span><span style=
=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(=
0,0,0);background-color:transparent;font-style:italic;font-variant-numeric:=
normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertic=
al-align:baseline">private incentive to upgrade</span><span style=3D"font-s=
ize:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);bac=
kground-color:transparent;font-variant-numeric:normal;font-variant-east-asi=
an:normal;font-variant-alternates:normal;vertical-align:baseline">.=C2=A0=
=C2=A0</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;ma=
rgin-bottom:0pt"><span style=3D"font-size:11pt;font-family:&quot;Courier Ne=
w&quot;,monospace;color:rgb(0,0,0);background-color:transparent;font-varian=
t-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:nor=
mal;vertical-align:baseline">This is not an offensive attack, rather, it is=
 defensive: our thesis is that the Bitcoin ecosystem wishes to defend itsel=
f and its interests against those who would prefer to do nothing and allow =
a malicious actor to destroy both value and trust.=C2=A0=C2=A0</span></p><p=
 dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><s=
pan style=3D"background-color:transparent;color:rgb(0,0,0);font-family:&quo=
t;Courier New&quot;,monospace;font-size:11pt;text-align:center"><br></span>=
</p><blockquote style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb=
(204,204,204);padding-left:1ex" class=3D"gmail_quote"><span style=3D"backgr=
ound-color:transparent;color:rgb(0,0,0);font-family:&quot;Courier New&quot;=
,monospace;font-size:11pt;text-align:center">&quot;Lost coins only make eve=
ryone else&#39;s coins worth slightly more. Think of it as a donation to ev=
eryone.&quot; - Satoshi Nakamoto</span></blockquote><br><p dir=3D"ltr" styl=
e=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font=
-size:11pt;font-family:&quot;Courier New&quot;,monospace;color:rgb(0,0,0);b=
ackground-color:transparent;font-variant-numeric:normal;font-variant-east-a=
sian:normal;font-variant-alternates:normal;vertical-align:baseline">If true=
, the corollary is:</span></p><p dir=3D"ltr" style=3D"line-height:1.38;marg=
in-top:0pt;margin-bottom:0pt"><span style=3D"background-color:transparent;c=
olor:rgb(0,0,0);font-family:&quot;Courier New&quot;,monospace;font-size:11p=
t;text-align:center"><br></span></p><blockquote style=3D"margin:0px 0px 0px=
 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class=3D"gm=
ail_quote"><span style=3D"background-color:transparent;color:rgb(0,0,0);fon=
t-family:&quot;Courier New&quot;,monospace;font-size:11pt;text-align:center=
">&quot;Quantum recovered coins only make everyone else&#39;s coins worth l=
ess. Think of it as a theft from everyone.&quot;</span></blockquote><br><p =
dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><sp=
an style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospace;co=
lor:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;fon=
t-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:b=
aseline">The timelines that we are proposing are meant to find the best bal=
ance between giving ample ability for account owners to migrate while maint=
aining the integrity of the overall ecosystem to avoid catastrophic attacks=
.=C2=A0=C2=A0</span></p><br><h2 dir=3D"ltr" style=3D"line-height:1.38;margi=
n-top:18pt;margin-bottom:4pt"><span style=3D"font-size:17pt;font-family:&qu=
ot;Courier New&quot;,monospace;color:rgb(0,0,0);background-color:transparen=
t;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-a=
lternates:normal;vertical-align:baseline">Backward Compatibility</span></h2=
><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"=
><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monospac=
e;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal=
;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-ali=
gn:baseline">As a series of soft forks, older nodes will continue to operat=
e without modification. Non-upgraded nodes, however, will consider all post=
-quantum witness programs as anyone-can-spend scripts. They are strongly en=
couraged to upgrade in order to fully validate the new programs.</span></p>=
<br><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0=
pt"><span style=3D"font-size:11pt;font-family:&quot;Courier New&quot;,monos=
pace;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:nor=
mal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-=
align:baseline">Non-upgraded wallets can receive and send bitcoin from non-=
upgraded and upgraded wallets until Phase A. After Phase A, they can no lon=
ger receive from any other wallets and can only send to upgraded wallets.=
=C2=A0 After Phase B, both senders and receivers will require upgraded wall=
ets.=C2=A0Phase C would likely require a loosening of consensus rules (a ha=
rd fork) to allow vulnerable funds recovery via ZK proofs.</span></p></span=
></div>
</blockquote></div></blockquote></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com">bitcoind=
ev+unsubscribe@googlegroups.com</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
bitcoindev/4d9ce13e-466d-478b-ab4d-00404c80d620n%40googlegroups.com?utm_med=
ium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msgid/bitcoind=
ev/4d9ce13e-466d-478b-ab4d-00404c80d620n%40googlegroups.com</a>.<br />

------=_Part_411051_711094452.1752458860757--

------=_Part_411050_1470926048.1752458860757--