Bitcoin does not face a near-term quantum-computing threat, according to Ledger chief technology officer Charles Guillemet, though it may take years to prepare the network for a post-quantum world.
Guillemet analyzed SHRINCS, an unfinished Bitcoin-specific hash-based scheme consisting of a short stateful signing path based on Flexible XMSS and WOTS+C signatures. It also contains a long stateless recovery path based on ideas from the SLH-DSA signature algorithm.
The target security level for this specification is about 128 bits of classical security and 64 bits of quantum security, but it is still in draft form without a full security proof.
Bitcoin wallets today use ECDSA and Schnorr signatures, which could be broken by a quantum computer running Shor’s algorithm, should such a cryptographically relevant quantum computer be practical and built — no such quantum computer is publicly known to exist.
Illustrating the difficulty of the problem, SHRINCS stateful signatures vary between 548 and 4,619 bytes, and the stateless fallback is 5,777 bytes, compared to Schnorr signatures, which are 64 bytes.
The compact path means that no one-time signing key can be reused, which implies that restoring from an old backup or from cloned devices may result in loss of funds.
The user could still derive the signing key from the original seed and move the funds, but a much larger signature would be required.
Read More: Why Is Crypto Crashing? Bitcoin, Ethereum and XRP
Existing wallet functionality also complicates migrations: many established Bitcoin wallet features — non-hardened BIP32 derivation, threshold signing based on Schnorr signatures — do not translate well to hash-based signatures.
Hardware limitations could also be an issue, as some post-quantum implementations may have increased hashing, memory, and signing times compared to current Bitcoin transactions.
SHRINCS is not an adopted Bitcoin improvement. Other quantum Bitcoin proposals, BIP 360, Pay-to-Merkle-Root and BIP 361, which suggest a gradual transition away from legacy ECDSA and Schnorr signatures for post-quantum signature schemes once available, exist in draft form.
Both are Draft proposals in the official Bitcoin BIP repository. Existing public keys could be subverted, or an attack could occur due to finding a key between broadcasting and confirming a transaction.
Read More: Bitcoin ETF Outflows Hit $450M as BTC Falls Below $76K After CLARITY Act Setback
An as yet unsolved problem for dormant BTC, if migrated in the future, is how coins in quantum-vulnerable outputs can be processed if the coin holders lost access to their keys, disappeared, or simply never upgraded their wallets.
It is easier to choose cryptography, according to Guillemet, than to coordinate wallets, users, and legacy funds that must move with it. Such coordination is needed because protocol changes cannot protect funds users fail to migrate.
