Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin and quantum computing

nehanarula.org

Post reply on HN
Print view View original

121–130 of 147 posts

Re: Bitcoin and quantum computing

#121

Post by nehan »

littlecranky67 wrote: post #117
EthanHeilman wrote: post #49

Earlier quoted context omitted.

> fork the chain at a snapshot before the attack, patch the protocol, and call that Bitcoin? It won't work. The only way to authenticate who ones what coins is with signatures. If the signature algorithm is broken, you can't tell who the original owner is to move the coins to a safe signature algorithm. You need to more to safer signature algorithm before the break, after the break it is game over. > It’s worth remem…

You have to consider the network-level forwarding, not only the crypto. The noderunners could role out a new version that uses whatever heuristics to identify transactions that are likely from an attacker. If transaction aren't forwarded, they don't end up in the mempool and thus not in the blockchain. And yes, then the attacker might try to manipulate those heuristics and filter etc. It would become a cat-and-mouse…

The point is you can't distinguish transactions that are from an "attacker" when the underlying signature scheme is broken. The Bitcoin P2P network has some metrics to disconnect from nodes that might be trying to DoS you, but if a transaction has enough fees, is spending unspent coins, and has a valid signature, it's valid.

Re: Bitcoin and quantum computing

#122

Post by nehan »

dodobirdlord wrote: post #74
nehan wrote: post #25

Earlier quoted context omitted.

two things: 1) Short markets in Bitcoin don't have unlimited depth, and the centralized ones are KYC'd so there's some risk there 2) What if it doesn't tank the price? One thing people have suggested is just burning all the vulnerable coins[1]; it reduces supply so maybe the price will... go up? The point is there's uncertainty. [1] https://x.com/lostbutlucky/status/2040878873731080681

What risk are you envisioning in #1?

Sorry I wasn't clear there. Because most of the short-depth is controlled by centralized exchanges, there's a risk you won't be able to actualize your short (withdraw, either in crypto or to a bank account), even if it's successful -- they could just block you from withdrawing and/or report you for fraud.

Re: Bitcoin and quantum computing

#123

Post by throw0101d »

EthanHeilman wrote: post #49
glerk wrote: post #20

One thing that is not addressed: say this quantum attack happens tomorrow and everyone agrees it was an attack, what would prevent the community (miners, node operators, and users) to hard fork the chain at a snapshot before the attack, patch the protocol, and call that Bitcoin? There would be loss of value of course, but it is not unrecoverable. It’s worth remembering that Ethereum forked for much less (not even a b…

> fork the chain at a snapshot before the attack, patch the protocol, and call that Bitcoin? It won't work. The only way to authenticate who ones what coins is with signatures. If the signature algorithm is broken, you can't tell who the original owner is to move the coins to a safe signature algorithm. You need to more to safer signature algorithm before the break, after the break it is game over. > It’s worth remem…

> It won't work. The only way to authenticate who ones what coins is with signatures. If the signature algorithm is broken, you can't tell who the original owner is to move the coins to a safe signature algorithm.

If you publish/take a snapshot of the ledger at (say) 23:59 UTC everyday, and publish it with a SHA2/3 hash, people will know what the state of ownership was at that time. Then if a break occurs at any later point you cannot trust any transaction afterwards, but some portion of folks can attest to their ownership.

There will be some portion of folks that did some legitimate transactions that could come into question, but at least it's not necessarily everyone.

Re: Bitcoin and quantum computing

#124

Post by littlecranky67 »

nehan wrote: post #121
littlecranky67 wrote: post #117

Earlier quoted context omitted.

You have to consider the network-level forwarding, not only the crypto. The noderunners could role out a new version that uses whatever heuristics to identify transactions that are likely from an attacker. If transaction aren't forwarded, they don't end up in the mempool and thus not in the blockchain. And yes, then the attacker might try to manipulate those heuristics and filter etc. It would become a cat-and-mouse…

The point is you can't distinguish transactions that are from an "attacker" when the underlying signature scheme is broken. The Bitcoin P2P network has some metrics to disconnect from nodes that might be trying to DoS you, but if a transaction has enough fees, is spending unspent coins, and has a valid signature, it's valid.

I did say heuristics, not valid/invalid. You can do all sorts of analytics upon receiving a transaction, and then decide to forward or drop the transaction based on that heuristics. Valid/Invalid could become the minimum requirement for a transaction to be forwarded.

Re: Bitcoin and quantum computing

#125

Post by extraduder_ire »

weakened_malloc wrote: post #73
pants2 wrote: post #34

Earlier quoted context omitted.

The Bitcoin “value overflow incident” on August 15, 2010 is probably the closest thing and that didn't affect the price much (though one BTC was around 8c at the time)

This time you'll have hundreds of billions of BTC that will be hacked by someone who will probably instantly unload it. In that scenario it's hard to see the price of it not dropping >90%, so you'd have to think people would prefer a roll back. That said, I don't know how you could even do a roll back, you're not rolling back to a 'safe' state since the keys aren't safe at that point.

"Instantly" being at least ten minutes (average) in this case.

Re: Bitcoin and quantum computing

#126

Post by EthanHeilman »

throw0101d wrote: post #123
EthanHeilman wrote: post #49

Earlier quoted context omitted.

> fork the chain at a snapshot before the attack, patch the protocol, and call that Bitcoin? It won't work. The only way to authenticate who ones what coins is with signatures. If the signature algorithm is broken, you can't tell who the original owner is to move the coins to a safe signature algorithm. You need to more to safer signature algorithm before the break, after the break it is game over. > It’s worth remem…

> It won't work. The only way to authenticate who ones what coins is with signatures. If the signature algorithm is broken, you can't tell who the original owner is to move the coins to a safe signature algorithm. If you publish/take a snapshot of the ledger at (say) 23:59 UTC everyday, and publish it with a SHA2/3 hash, people will know what the state of ownership was at that time. Then if a break occurs at any late…

> but some portion of folks can attest to their ownership.

How? Alice pay's Bob 1 BTC at random address 0x1234. Someone shows up and says, I own that address and here is signature proving it. But the signature scheme is broken so anyone can do that. So you ask for documentation they own that address, well they have screencap of a message asking for payment from Alice. Is that real? Maybe you find the email of that user and ask them, but they could be lying. Now if you paid from coinbase, coinbase could vouch for you.

So you need some sort of court that sits in judgement over who owns what. That is going to be very expensive. While you are doing this, no one can move funds. What is the most likely outcome of such a system, well there is not CEO of Bitcoin, so you would probably end up with multiple courts producing conflicting rulings that no one would respect.

The whole notion of ownership courts is anathema to Bitcoin's philosophy and would completely undermine the social trust that makes Bitcoin valuable. If we are going to save Bitcoin from a CRQC we must act before a CRQC recovers everyone's private key.

There are three workable schemes:

* For public keys that in hashed addresses such as P2PKH (Pay-to-Public-Key-Hash) et al., if the public key is not known, then you could produce a ZKP that you know the public key (proof of pre-image). The main problem with this approach is that it only protects hashed addresses where the public key has not been leaked or exposed on-chain. It doesn't have enough coverage.

* You can do commit-reveal schemes, this makes miners far more trusted and again only helps with hashed addresses that haven't exposed the public key.

* You can do ZKP proof of HD Seeds, from most modern wallets have HD seeds. AFAICT You'd have to use STARKs but STARKs for HD seeds are too big for on-chain proofs. Not all HD seeds are protected and not all addresses have HD seeds. Just today Laolu published this demo for doing this, the proofs at 1.7 mbs https://groups.google.com/g/bitcoindev/c/Q06piCEJhkI

Re: Bitcoin and quantum computing

#127

Post by QuantumNomad_ »

xoa wrote: post #116
QuantumNomad_ wrote: post #103

Earlier quoted context omitted.

> It's the realized gains that get taxed. That's a completely generic feature of the tax system, the government doesn't give a shit (and shouldn't) what people decide has value in any given transaction If I buy a vintage computer second hand for $1500 and then manage to sell it to someone else for $2000, I don’t owe taxes on that. But if I buy $1500 worth of bitcoin and then sell those bitcoins for $2000, I owe taxes…

> If I buy a vintage computer second hand for $1500 and then manage to sell it to someone else for $2000, I don’t owe taxes on that. Uh, in the United States? Yeah, you absolutely do [0, 1]: > "If you make a profit through these activities, it’s considered taxable income. You can use the Form 1099-K, along with other records, to determine how much tax you owe. " > "Remember that all income, no matter the amount, is t…

> Uh, in the United States?

I don’t live in the US, and am not a citizen of the US.

> You may wish to review your understanding and confidence in your understanding of tax law.

The tax laws in my country are different from the ones in yours. I know the tax laws of my country well enough.

Re: Bitcoin and quantum computing

#128

Post by functional_dev »

EthanHeilman wrote: post #52
tomtomtom777 wrote: post #46

Earlier quoted context omitted.

2045 A=~1.0 seems way off. CRQC is still a theoretical construct with hurdles to overcome. Yes, there is a significant risk that it will exist somewhere in the next decades, but there is also still a significant chance that it will be shown to be practically impossible.

That is not what I am hearing from people working on CRQC. A prediction of a CRQC with 10% by 2030 was made by own of the top experts in this field. 2045 used to be the pessimistic outlook by experts with a bunch of experts predicting earlier. Recent work has shown that CRQC is actual 20 times easier to built that previously thought, accelerating all timelines. We are seeing significant progress in two different type…

Do you have a link to the paper showing the 20x improvement?

Re: Bitcoin and quantum computing

#129

Post by xoa »

QuantumNomad_ wrote: post #127
xoa wrote: post #116

Earlier quoted context omitted.

> If I buy a vintage computer second hand for $1500 and then manage to sell it to someone else for $2000, I don’t owe taxes on that. Uh, in the United States? Yeah, you absolutely do [0, 1]: > "If you make a profit through these activities, it’s considered taxable income. You can use the Form 1099-K, along with other records, to determine how much tax you owe. " > "Remember that all income, no matter the amount, is t…

> Uh, in the United States? I don’t live in the US, and am not a citizen of the US. > You may wish to review your understanding and confidence in your understanding of tax law. The tax laws in my country are different from the ones in yours. I know the tax laws of my country well enough.

>I don’t live in the US, and am not a citizen of the US.

Well good then, I guess you don't have to worry about any of this so long as no American ever gets a quantum computer! Not like any research on it happens here or anything so you shouldn't need to be concerned.

Post reply on HN