path: root/9c/9d4d140c5f426d2ed9c15e98349999ebad9676

Delivery-date: Mon, 31 Mar 2025 02:44:03 -0700
Received: from mail-oo1-f56.google.com ([209.85.161.56])
	by mail.fairlystable.org with esmtps  (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.94.2)
	(envelope-from <bitcoindev+bncBDZPZFXW2IMRBWOHVG7QMGQENKDWJNA@googlegroups.com>)
	id 1tzBgY-00032M-3E
	for bitcoindev@gnusha.org; Mon, 31 Mar 2025 02:44:03 -0700
Received: by mail-oo1-f56.google.com with SMTP id 006d021491bc7-602513d2204sf1394719eaf.3
        for <bitcoindev@gnusha.org>; Mon, 31 Mar 2025 02:44:02 -0700 (PDT)
ARC-Seal: i=2; a=rsa-sha256; t=1743414236; cv=pass;
        d=google.com; s=arc-20240605;
        b=DIkhAQ9yWVXnO+nryoyyD4RHGoVZJ1MvTCjGWOEdj7Pbz52oIlPTb12ZoGxAdtKcMT
         3LB+nBmcM54NV6wZ+XToBl9SeuGX7K++62OwfDmiRlToKguE/3+LMMEstvvrXpQ62FWv
         s6GjZipxg+xlcVBkwcS2OIPaHSgeLbCKnglH2qZab+DK1MNhL5Ml/+RQLZbMx1YplBqb
         ccFCnhuhxhLROh1KGJdjypkzFmhuLtjWSgE3jTIULUdJgn5tS1lx0F9G6yA1/ATnG2aG
         8BiL/WDwK124vp3eXpT5jqcDMBZkvld2u2XtBYngUfnnmbL1GfQ2xkvT34f+I3mooU6s
         XLAw==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:cc:to:subject:message-id:date:from
         :in-reply-to:references:mime-version:sender:dkim-signature
         :dkim-signature;
        bh=FNrPib2hr8yq2+2zmT7c8sLQuk0IUVbuFoSPTc1iDdI=;
        fh=QJJZLknJXeELqTLhTM/mdRnT+e+RtqKRDUx8cQQMpeI=;
        b=T3sif0JFNoXPDBk0TbE77PMC9OCLKDzT41tLXWBhnOKoDL7RW8RY64QE0dpfnbtrjt
         1a09HI9N4o42eYxd2NwOkoHVM3Rb7noykgtlFUiaaLv9mT2GprZA5kZp26qhFQlx8Ig3
         f+/mBbXLdcFWo0ITRkWNYvT3wW0olLxVnz0JvkuvCqYcJYQ4uzlh1S0bYJUjxp434MYP
         uKCld2CDDffi/AILixM8mJHgMVZbmBKJzSN8ypcguPOwSrWjB/YbLT3gqWQVMeZKxFui
         A0RuAdBSs7MV6LaolQzoF50d1Gm6NhCiadaH56CN5D9/4pvaj/WlDc5ujJCX8ORnKOTV
         h9QQ==;
        darn=gnusha.org
ARC-Authentication-Results: i=2; gmr-mx.google.com;
       dkim=pass header.i=@gmail.com header.s=20230601 header.b=e0IDCuq5;
       spf=pass (google.com: domain of martin.habovstiak@gmail.com designates 2607:f8b0:4864:20::935 as permitted sender) smtp.mailfrom=martin.habovstiak@gmail.com;
       dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;
       dara=pass header.i=@googlegroups.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlegroups.com; s=20230601; t=1743414236; x=1744019036; darn=gnusha.org;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:x-original-authentication-results
         :x-original-sender:cc:to:subject:message-id:date:from:in-reply-to
         :references:mime-version:sender:from:to:cc:subject:date:message-id
         :reply-to;
        bh=FNrPib2hr8yq2+2zmT7c8sLQuk0IUVbuFoSPTc1iDdI=;
        b=Ws2hJgHHaTOVjaTsbQ9wuwIvqSsnrIkByxe/K+XbAh1kmKYEEwZc7WKEywxaBaSzr+
         KkG7tNGEbrde17uaCV0oSusoG84o8jrcKTa80ur7jd5xFhFKQeVGKQm5mzh6HeJhAW7R
         zytqqk9JOGotOj7wqqivhR+7TCwq8Z+ifAJiq2afgNqqaWm/wtsXxmONW3tKcxG7oy4F
         C8QuIyeTK2F5/PzbUgEfRW5Mwnw9KblzRS+bOPS9IcGso6KQkT2aCd7cuczg4NaDgzkL
         PRkegiXB9RIHJcCzzXPceqm3QbxCZuQtgPOSb9xNFDBlEjrNiRCrzxDzVPfcu/bnxzbe
         7/rQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743414236; x=1744019036; darn=gnusha.org;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:x-original-authentication-results
         :x-original-sender:cc:to:subject:message-id:date:from:in-reply-to
         :references:mime-version:from:to:cc:subject:date:message-id:reply-to;
        bh=FNrPib2hr8yq2+2zmT7c8sLQuk0IUVbuFoSPTc1iDdI=;
        b=IBiFmkUeXXc4SKEnY57F1mB1SPVcLm+zVKj7zCDXjntDocc5Rou9dl76dXRLL/x24P
         KVjvmfLpLekVmTM/3ssSfrIhhC0DL33dheli7k4dQSw7Xix3GnD0VH1vK0Bml9M/yUvi
         PUYgZdO5b3A5kmaYE0ANg5GQgR1UmUIlSMO732ssxjrAPVf8H2yuwmb0Crk0BqMEosCn
         ukP8es3UypSc3mJm6iXbWgN9u2VIt0Sdjvu7Owp0RkKt+DPNkd8uc6E4+h+NhARTH8CO
         1YMqo9jYHyz49G285IpEvM5Oqy2sKRHxVWi7GI0MeklmEIO/UF7cdhDMHUbLlmayO6p7
         z/Qw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743414236; x=1744019036;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:x-original-authentication-results
         :x-original-sender:cc:to:subject:message-id:date:from:in-reply-to
         :references:mime-version:x-beenthere:x-gm-message-state:sender:from
         :to:cc:subject:date:message-id:reply-to;
        bh=FNrPib2hr8yq2+2zmT7c8sLQuk0IUVbuFoSPTc1iDdI=;
        b=Ot8dRF4j778/bsVLaRsOAV1pjerkF9HBiQPMmnCuUQNo6iMPDozAwjQS8KhwRmDXX7
         3YH0BGIWhXIRDxAYQXuED4EjQON1WYNXuA0e9WDe0PhMkLIhHRpTzufuYFLz9iTxMfKB
         e2W71Hw3Wa9QWzFRWxNhxugQWf96Ek/G/s83HUeGLu1Dpn1kM3IjWVhCiV0L9+YU/OJl
         /SCQ24vT+1PwxhsK6XPMI9/QMkaHxjlSQU9MXXyhYWR/Me7Rjz8IfaJ1yq8QRaXmQUst
         5x2OXpm/nxiVg/TWwtFj5mITF15HtDW2qcutT+G4R2Uf0IYIH9Mbb3j+wNIlFfDXYxyo
         9N5A==
Sender: bitcoindev@googlegroups.com
X-Forwarded-Encrypted: i=2; AJvYcCXPLWFpnracOrjcllXKjMapqMS+Dl8UrXucFtKM+ODWa0D/z7DUo7jyNM7YiyCiG0lcMTRUNdmYF/R5@gnusha.org
X-Gm-Message-State: AOJu0Yy6qJ9ytq18RuKqjknsx5WS2U/edp6cat9U7BgjOVjX1aVlqUS+
	11sgJBikBErgH50hUaBPHYT7MHJYUxLYnjl7Qt96Gr4wkCrUcfFd
X-Google-Smtp-Source: AGHT+IGl1ZkI8X7ySOO21iY21jHYUmXhMLFoOz2IRJoxFQBICaaC//ALXjRdIClwjTfyMu1LK2QHtg==
X-Received: by 2002:a05:6808:120a:b0:3f6:a6a8:d339 with SMTP id 5614622812f47-3ff0f4e5e90mr4099065b6e.3.1743414236391;
        Mon, 31 Mar 2025 02:43:56 -0700 (PDT)
X-BeenThere: bitcoindev@googlegroups.com; h=ARLLPALNpjNRbGqdiGvuei8UiHnnv8poRh4u+x7sU1FYWNp1vQ==
Received: by 2002:a4a:cb18:0:b0:602:40ed:5c6f with SMTP id 006d021491bc7-60278d81f1fls939234eaf.0.-pod-prod-06-us;
 Mon, 31 Mar 2025 02:43:53 -0700 (PDT)
X-Forwarded-Encrypted: i=2; AJvYcCW4I5I3w66SiYg6Hfn/8XXCUdzZXYlVOUICioxB8N4a+4A2dVNfucEKg1J6TcNgJmdjv5B5NKhUPsUm@googlegroups.com
X-Received: by 2002:a05:6808:3204:b0:3f9:c668:2cb8 with SMTP id 5614622812f47-3ff0f503a5amr4880974b6e.13.1743414233062;
        Mon, 31 Mar 2025 02:43:53 -0700 (PDT)
Received: by 2002:a05:6808:1aa6:b0:3f9:f009:458e with SMTP id 5614622812f47-3feefa6b8b7msb6e;
        Sun, 30 Mar 2025 13:16:20 -0700 (PDT)
X-Forwarded-Encrypted: i=2; AJvYcCVYPm2BQ79rJYJzIwbcQtR4sZ8ZsOyyM9O8O2smFHvKqsRl/GMq95/2GJcYrQ6cxQ6v73hpApdXJdh7@googlegroups.com
X-Received: by 2002:a17:90b:2e88:b0:2ff:6a5f:9b39 with SMTP id 98e67ed59e1d1-305320af145mr11131507a91.18.1743365779294;
        Sun, 30 Mar 2025 13:16:19 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1743365779; cv=none;
        d=google.com; s=arc-20240605;
        b=NVe/5GyzvP1mXk8KE/9njArM8g+E2rrcxlHuxKjQ3GJIEJ6hWcW5OyDJd7YdfchfSH
         LWtZ92ykxCVq5TUDX8cYGsuW72a7Joe8eoT6UgsFAScfMeHt4wseQGzATBX+xPskqOAg
         bEaH/rHHOPVxFQE+ILVUYME3Ek4aXKYnpaba77931mDI1MxXRseNu4kg0MyACSLEKmug
         +f8g1pR3hIkazRrYrer4Q7DyaKkUVRB6b2F5qvOQsMrywGbjzqmk7ltS2jaMcS3/JVL6
         z8vqTxq5XHfUyPr3B03pXa2CRSyQWJJsRyl/y8h0oTBCQgJWFXRBXBR8NvGCVNtEtc7+
         /e0g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
        h=cc:to:subject:message-id:date:from:in-reply-to:references
         :mime-version:dkim-signature;
        bh=JEd6X0Xv/W8NTAonIWbMfS5VvxRXYZGCdBZkc65dYsQ=;
        fh=0bvm54fff+WAXYWRInJJOgfsaqOBv/VUdsJ1keY8NyE=;
        b=Egsbfw/mfnnVWF/2/tdzdm2/txmPkMDrH+RBEfyzlNuyka4ScgVOBnOth7yAynYdY0
         lQdTQzq5Q2g+XkKXQORe+yoSSsGnfJ2EPRPXvDnajImJlE/PxdLLif0QXHtc4I0D4dbe
         dzUN5r8+pbpqLqTN6+f0RNih7230Xflgld+9qpxwFnmftXbhWeKbYQGR1ALk0257iKso
         BdyAT8m0FWffsKvZyG3ZZNgFOcJTSn4yXOeG+b8EXu+tkpsJqMKLBtpuwnT5csH4KN66
         hi7u2FeNeWjRrUhmzANd71tvtWrGvQftwuTvtWqh+mitXlB7A3HPuHbCt4Gz69MPB/Zb
         k2Xw==;
        dara=google.com
ARC-Authentication-Results: i=1; gmr-mx.google.com;
       dkim=pass header.i=@gmail.com header.s=20230601 header.b=e0IDCuq5;
       spf=pass (google.com: domain of martin.habovstiak@gmail.com designates 2607:f8b0:4864:20::935 as permitted sender) smtp.mailfrom=martin.habovstiak@gmail.com;
       dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;
       dara=pass header.i=@googlegroups.com
Received: from mail-ua1-x935.google.com (mail-ua1-x935.google.com. [2607:f8b0:4864:20::935])
        by gmr-mx.google.com with ESMTPS id 98e67ed59e1d1-3051cc5b291si528021a91.0.2025.03.30.13.16.19
        for <bitcoindev@googlegroups.com>
        (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
        Sun, 30 Mar 2025 13:16:19 -0700 (PDT)
Received-SPF: pass (google.com: domain of martin.habovstiak@gmail.com designates 2607:f8b0:4864:20::935 as permitted sender) client-ip=2607:f8b0:4864:20::935;
Received: by mail-ua1-x935.google.com with SMTP id a1e0cc1a2514c-86b9d1f729eso1637949241.3
        for <bitcoindev@googlegroups.com>; Sun, 30 Mar 2025 13:16:19 -0700 (PDT)
X-Forwarded-Encrypted: i=1; AJvYcCVUTFX1HTKKWpE6NtXGBJWrWloi0uJBLlNoHe81gr1dOoSXkzM/BOz4/zQWLQvQzUhhEcx1hFRwWTWd@googlegroups.com
X-Gm-Gg: ASbGncvyfDuWDleNma/TZmoh3T+e0VWCGuYHWOy7VZyM/faOIa8xN5ec8eqoV5s0lXr
	vrAxahzCy4hmS31yDaFMiZE/dkNpMZoHhz5EhU5UOTqNW4rU/erJ1psvY8l7o79nX5BSEiyLuCN
	TnWkj/BOQQpRVIvA22KZjVjKrQjw==
X-Received: by 2002:a05:6102:5246:b0:4af:deaf:f891 with SMTP id
 ada2fe7eead31-4c6d3824632mr3845009137.4.1743365778293; Sun, 30 Mar 2025
 13:16:18 -0700 (PDT)
MIME-Version: 1.0
References: <CALkkCJY=dv6cZ_HoUNQybF4-byGOjME3Jt2DRr20yZqMmdJUnQ@mail.gmail.com>
 <XHIL8Z4i4hji8LhbJ0AiKQ4eago2evXwjTGUOqqyAye_2nM3QicDpHo6KkcznBAHPUrIWSLj_GuiTQ_97KPjxcOrG8pE0rgcXucK2-4txKE=@protonmail.com>
 <CAH5Bsr0muoF27besnoQh32vL-keujeR+d-_JurE0+yXY5gPKQg@mail.gmail.com>
In-Reply-To: <CAH5Bsr0muoF27besnoQh32vL-keujeR+d-_JurE0+yXY5gPKQg@mail.gmail.com>
From: =?UTF-8?Q?Martin_Habov=C5=A1tiak?= <martin.habovstiak@gmail.com>
Date: Sun, 30 Mar 2025 22:16:08 +0200
X-Gm-Features: AQ5f1JovW6Dk_s3KbFXtaEeupP2WCdH6ZSYG_Cginp60cPGOxbQBEzi-6Ub-Kxw
Message-ID: <CALkkCJb4aJgpgBxrSqSwmCVb3wdnaDJDo7j+w_D7qC0wFpMOOw@mail.gmail.com>
Subject: Re: [bitcoindev] Hashed keys are actually fully quantum secure
To: Lloyd Fournier <lloyd.fourn@gmail.com>
Cc: Antoine Poinsot <darosior@protonmail.com>, 
	Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Content-Type: multipart/alternative; boundary="000000000000edcb0c063194f907"
X-Original-Sender: martin.habovstiak@gmail.com
X-Original-Authentication-Results: gmr-mx.google.com;       dkim=pass
 header.i=@gmail.com header.s=20230601 header.b=e0IDCuq5;       spf=pass
 (google.com: domain of martin.habovstiak@gmail.com designates
 2607:f8b0:4864:20::935 as permitted sender) smtp.mailfrom=martin.habovstiak@gmail.com;
       dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;
       dara=pass header.i=@googlegroups.com
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com
List-ID: <bitcoindev.googlegroups.com>
X-Google-Group-Id: 786775582512
List-Post: <https://groups.google.com/group/bitcoindev/post>, <mailto:bitcoindev@googlegroups.com>
List-Help: <https://groups.google.com/support/>, <mailto:bitcoindev+help@googlegroups.com>
List-Archive: <https://groups.google.com/group/bitcoindev
List-Subscribe: <https://groups.google.com/group/bitcoindev/subscribe>, <mailto:bitcoindev+subscribe@googlegroups.com>
List-Unsubscribe: <mailto:googlegroups-manage+786775582512+unsubscribe@googlegroups.com>,
 <https://groups.google.com/group/bitcoindev/subscribe>
X-Spam-Score: -0.5 (/)

--000000000000edcb0c063194f907
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Indeed, that's what I meant. Even crazy long period like two weeks is still
better than losing everything. I have also assumed RBF and related rules to
stay similar.

Still, a better scheme was proposed already that I was unaware of so far,
thus I withdraw my proposal in favor of that one.

D=C5=88a po 24. 3. 2025, 1:25 Lloyd Fournier <lloyd.fourn@gmail.com> nap=C3=
=ADsal(a):

>
>
> On Tue, 18 Mar 2025 at 00:48, 'Antoine Poinsot' via Bitcoin Development
> Mailing List <bitcoindev@googlegroups.com> wrote:
>
> I suppose you could in theory have, in addition to making spending old
>> outputs invalid on their own, a rule which dictates they may only be spe=
nt
>> along with a QR output at least X blocks old. This would give the honest
>> user a headstart in this race, but meh.
>>
>
> Yes this is how I read the OP "after sufficient number of blocks". I thin=
k
> this is a really nice idea. The head start can be arbitrarily large so th=
at
> the attacker simply cannot compete. It's probably not too difficult to
> design some honest RBF mechanism either such that you can bump the fee wi=
th
> a new QR signature if it's taking too long.
>
> LL
>
>
>
>> On Sunday, March 16th, 2025 at 2:25 PM, Martin Habov=C5=A1tiak <
>> martin.habovstiak@gmail.com> wrote:
>>
>> Hello list,
>>
>> this is somewhat related to Jameson's recent post but different enough t=
o
>> warrant a separate topic.
>>
>> As you have probably heard many times and even think yourself, "hashed
>> keys are not actually secure, because a quantum attacker can just snatch
>> them from mempool". However this is not strictly true.
>>
>> It is possible to implement fully secure recovery if we forbid spending
>> of hashed keys unless done through the following scheme:
>> 0. we assume we have *some* QR signing deployed, it can be done even
>> after QC becomes viable (though not without economic cost)
>> 1. the user obtains a small amount of bitcoin sufficient to pay for fees
>> via external means, held on a QR script
>> 2. the user creates a transaction that, aside from having a usual
>> spendable output also commits to a signature of QR public key. This prov=
es
>> that the user knew the private key even though the public key wasn't
>> revealed yet.
>> 3. after sufficient number of blocks, the user spends both the old and Q=
R
>> output in a single transaction. Spending requires revealing the
>> previously-committed sigature. Spending the old output alone is invalid.
>>
>> This way, the attacker would have to revert the chain to steal which is
>> assumed impossible.
>>
>> The only weakness I see is that (x)pubs would effectively become private
>> keys. However they already kinda are - one needs to protect xpubs for
>> privacy and to avoid the risk of getting marked as "dirty" by some
>> agencies, which can theoretically render them unspendable. And non-x-pub=
s
>> generally do not leak alone (no reason to reveal them without spending).
>>
>> I think that the mere possibility of this scheme has two important
>> implications:
>> * the need to have "a QR scheme" ready now in case of a QC coming
>> tomorrow is much smaller than previously thought. Yes, doing it too late
>> has the effect of temporarily freezing coins which is costly and we don'=
t
>> want that but it's not nearly as bad as theft
>> * freezing of *these* coins would be both immoral and extremely dangerou=
s
>> for reputation of Bitcoin (no comments on freezing coins with revealed
>> pubkeys, I haven't made my mind yet)
>>
>> If the time comes I'd be happy to run a soft fork that implements this
>> sanely.
>>
>> Cheers
>>
>> Martin
>>
>> --
>> You received this message because you are subscribed to the Google Group=
s
>> "Bitcoin Development Mailing List" group.
>> To unsubscribe from this group and stop receiving emails from it, send a=
n
>> email to bitcoindev+unsubscribe@googlegroups.com.
>> To view this discussion visit
>> https://groups.google.com/d/msgid/bitcoindev/CALkkCJY%3Ddv6cZ_HoUNQybF4-=
byGOjME3Jt2DRr20yZqMmdJUnQ%40mail.gmail.com
>> .
>>
>>
>> --
>> You received this message because you are subscribed to the Google Group=
s
>> "Bitcoin Development Mailing List" group.
>> To unsubscribe from this group and stop receiving emails from it, send a=
n
>> email to bitcoindev+unsubscribe@googlegroups.com.
>> To view this discussion visit
>> https://groups.google.com/d/msgid/bitcoindev/XHIL8Z4i4hji8LhbJ0AiKQ4eago=
2evXwjTGUOqqyAye_2nM3QicDpHo6KkcznBAHPUrIWSLj_GuiTQ_97KPjxcOrG8pE0rgcXucK2-=
4txKE%3D%40protonmail.com
>> <https://groups.google.com/d/msgid/bitcoindev/XHIL8Z4i4hji8LhbJ0AiKQ4eag=
o2evXwjTGUOqqyAye_2nM3QicDpHo6KkcznBAHPUrIWSLj_GuiTQ_97KPjxcOrG8pE0rgcXucK2=
-4txKE%3D%40protonmail.com?utm_medium=3Demail&utm_source=3Dfooter>
>> .
>>
>

--=20
You received this message because you are subscribed to the Google Groups "=
Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/=
CALkkCJb4aJgpgBxrSqSwmCVb3wdnaDJDo7j%2Bw_D7qC0wFpMOOw%40mail.gmail.com.

--000000000000edcb0c063194f907
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Indeed, that&#39;s what I meant. Even crazy long period l=
ike two weeks is still better than losing everything. I have also assumed R=
BF and related rules to stay similar.<div dir=3D"auto"><br></div><div dir=
=3D"auto">Still, a better scheme was proposed already that I was unaware of=
 so far, thus I withdraw my proposal in favor of that one.</div></div><br><=
div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"g=
mail_attr">D=C5=88a po 24. 3. 2025, 1:25 Lloyd Fournier &lt;<a href=3D"mail=
to:lloyd.fourn@gmail.com">lloyd.fourn@gmail.com</a>&gt; nap=C3=ADsal(a):<br=
></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-=
left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div dir=3D"ltr"><br=
></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr"=
>On Tue, 18 Mar 2025 at 00:48, &#39;Antoine Poinsot&#39; via Bitcoin Develo=
pment Mailing List &lt;<a href=3D"mailto:bitcoindev@googlegroups.com" targe=
t=3D"_blank" rel=3D"noreferrer">bitcoindev@googlegroups.com</a>&gt; wrote:<=
/div><div dir=3D"ltr" class=3D"gmail_attr"><br></div><blockquote class=3D"g=
mail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204=
,204,204);padding-left:1ex"><div style=3D"font-family:Arial,sans-serif;font=
-size:14px">I suppose you could in theory have, in addition to making spend=
ing old outputs invalid on their own, a rule which dictates they may only b=
e spent along with a QR output at least X blocks old. This would give the h=
onest user a headstart in this race, but meh.<br></div></blockquote><div><b=
r></div><div>Yes this is how I read the OP &quot;after sufficient number of=
 blocks&quot;. I think this is a really nice idea. The head start can be ar=
bitrarily large so that the attacker simply cannot compete. It&#39;s probab=
ly not too difficult to design some honest RBF mechanism either such that y=
ou can bump the fee with a new QR signature if it&#39;s taking too long.</d=
iv><div><br></div><div>LL</div><div><br></div><div>=C2=A0</div><blockquote =
class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px sol=
id rgb(204,204,204);padding-left:1ex"><div style=3D"font-family:Arial,sans-=
serif;font-size:14px"></div><div>
        On Sunday, March 16th, 2025 at 2:25 PM, Martin Habov=C5=A1tiak &lt;=
<a href=3D"mailto:martin.habovstiak@gmail.com" target=3D"_blank" rel=3D"nor=
eferrer">martin.habovstiak@gmail.com</a>&gt; wrote:<br>
        <blockquote type=3D"cite">
            <div dir=3D"auto">Hello list,<div dir=3D"auto"><br></div><div d=
ir=3D"auto">this is somewhat related to Jameson&#39;s recent post but diffe=
rent enough to warrant a separate topic.</div><div dir=3D"auto"><br></div><=
div dir=3D"auto">As you have probably heard many times and even think yours=
elf, &quot;hashed keys are not actually secure, because a quantum attacker =
can just snatch them from mempool&quot;. However this is not strictly true.=
</div><div dir=3D"auto"><br></div><div dir=3D"auto">It is possible to imple=
ment fully secure recovery if we forbid spending of hashed keys unless done=
 through the following scheme:</div><div dir=3D"auto">0. we assume we have =
*some* QR signing deployed, it can be done even after QC becomes viable (th=
ough not without economic cost)</div><div dir=3D"auto">1. the user obtains =
a small amount of bitcoin sufficient to pay for fees via external means, he=
ld on a QR script</div><div dir=3D"auto">2. the user creates a transaction =
that, aside from having a usual spendable output also commits to a signatur=
e of QR public key. This proves that the user knew the private key even tho=
ugh the public key wasn&#39;t revealed yet.</div><div dir=3D"auto">3. after=
 sufficient number of blocks, the user spends both the old and QR output in=
 a single transaction. Spending requires revealing the previously-committed=
 sigature. Spending the old output alone is invalid.</div><div dir=3D"auto"=
><br></div><div dir=3D"auto">This way, the attacker would have to revert th=
e chain to steal which is assumed impossible.</div><div dir=3D"auto"><br></=
div><div dir=3D"auto">The only weakness I see is that (x)pubs would effecti=
vely become private keys. However they already kinda are - one needs to pro=
tect xpubs for privacy and to avoid the risk of getting marked as &quot;dir=
ty&quot; by some agencies, which can theoretically render them unspendable.=
 And non-x-pubs generally do not leak alone (no reason to reveal them witho=
ut spending).</div><div dir=3D"auto"><br></div><div dir=3D"auto">I think th=
at the mere possibility of this scheme has two important implications:</div=
><div dir=3D"auto">* the need to have &quot;a QR scheme&quot; ready now in =
case of a QC coming tomorrow is much smaller than previously thought. Yes, =
doing it too late has the effect of temporarily freezing coins which is cos=
tly and we don&#39;t want that but it&#39;s not nearly as bad as theft</div=
><div dir=3D"auto">* freezing of *these* coins would be both immoral and ex=
tremely dangerous for reputation of Bitcoin (no comments on freezing coins =
with revealed pubkeys, I haven&#39;t made my mind yet)</div><div dir=3D"aut=
o"><br></div><div dir=3D"auto">If the time comes I&#39;d be happy to run a =
soft fork that implements this sanely.</div><div dir=3D"auto"><br></div><di=
v dir=3D"auto">Cheers</div><div dir=3D"auto"><br></div><div dir=3D"auto">Ma=
rtin</div></div>

<p></p>

-- <br>
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br>
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com" rel=3D"n=
oreferrer nofollow noopener noreferrer" target=3D"_blank">bitcoindev+unsubs=
cribe@googlegroups.com</a>.<br>
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
bitcoindev/CALkkCJY%3Ddv6cZ_HoUNQybF4-byGOjME3Jt2DRr20yZqMmdJUnQ%40mail.gma=
il.com" rel=3D"noreferrer nofollow noopener noreferrer" target=3D"_blank">h=
ttps://groups.google.com/d/msgid/bitcoindev/CALkkCJY%3Ddv6cZ_HoUNQybF4-byGO=
jME3Jt2DRr20yZqMmdJUnQ%40mail.gmail.com</a>.<br>

        </blockquote><br>
    </div>

<p></p>

-- <br>
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br>
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com" target=
=3D"_blank" rel=3D"noreferrer">bitcoindev+unsubscribe@googlegroups.com</a>.=
<br>
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
bitcoindev/XHIL8Z4i4hji8LhbJ0AiKQ4eago2evXwjTGUOqqyAye_2nM3QicDpHo6KkcznBAH=
PUrIWSLj_GuiTQ_97KPjxcOrG8pE0rgcXucK2-4txKE%3D%40protonmail.com?utm_medium=
=3Demail&amp;utm_source=3Dfooter" target=3D"_blank" rel=3D"noreferrer">http=
s://groups.google.com/d/msgid/bitcoindev/XHIL8Z4i4hji8LhbJ0AiKQ4eago2evXwjT=
GUOqqyAye_2nM3QicDpHo6KkcznBAHPUrIWSLj_GuiTQ_97KPjxcOrG8pE0rgcXucK2-4txKE%3=
D%40protonmail.com</a>.<br>
</blockquote></div></div>
</blockquote></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com">bitcoind=
ev+unsubscribe@googlegroups.com</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
bitcoindev/CALkkCJb4aJgpgBxrSqSwmCVb3wdnaDJDo7j%2Bw_D7qC0wFpMOOw%40mail.gma=
il.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/=
msgid/bitcoindev/CALkkCJb4aJgpgBxrSqSwmCVb3wdnaDJDo7j%2Bw_D7qC0wFpMOOw%40ma=
il.gmail.com</a>.<br />

--000000000000edcb0c063194f907--