CTRL/SHIFT - 13 06 2026 CHAPEL STAGE - WOLFGANG VITALE - THE ROAD TO POST QUANTUM BITCOIN

Okay. All right. Um, yes it works. Let's start. So we talk about I mean this only 20 minutes so I will need to go fast.

But the idea we have two parts. One to talk about quantum computing threat in general and the timelines like when we are going to get the quantum computer powerful enough and then what it means for Bitcoin. That's the second part. So let's start from the threat and yeah there is no way around that. Sorry, formatting is not perfect.

Didn't really work. But uh yes, the content is there. And uh yes, the idea here, the real problem is that there is an algorithm short algorithm that breaks classical public key cryptography. That's a big big problem in general for secure internet communication, but also for our cryptocurrencies and blockchain based technology in general. Why?

It's because basically you can extract a private key from a public key. That's no bueno at all. So, Bitcoin will be impacted if we don't do anything. Of course, devs are deving are deving and we are doing something. But, uh, let's go step by step.

This is the problem. Shorce algorithm. If you have a quantum computer powerful enough to run it, then we have a problem. What does it mean powerful enough? Well, these things have changing over time.

We have optimization both from the hardware side and software side, error correction side. But where we stand today is that the order of magnitude we need 1,00 around 1,000 order of magnitude logical cubit that are high quality enough meaning logical error rate low enough. So the thing here is that uh over time we have uh seen that requirements went down. Basically the gap between what we can build and uh what we need to achieve is shrinking. So the timelines are accelerating.

That's the problem here. This is the latest update from Google. We have also seen other updates but this is still the order of magnitude 1,000 logical cubits and error rate 10 to minus 12. Now logical cubits okay but you need to build them. So you still build them from physical cubits and um when we look at the requirements on how many physical cubits you need to build a cryptographically relevant quantum computer like a CRQC how we call them that really depends on the technology that you use.

So if it's a superconductor based, if it's a neutral atoms, trapped ions and so on, these numbers change. So you should really try not to mix um projections from different technologies together. But uh this result was very important. This is from or atomic also March 2026 where they see 26,000 physical cubits only, you know, only 26,000 physical cubits which is much lower than other estimates on millions. But still, of course, it's not enough just to look at the number of physical cubits.

You should look at what is the assumed physical error rate and that's not obvious.1% or 99.9% fidelity and also this is supposed to run for 10 days. So you know yes you can extract maybe a private key from a public key but it takes 10 days. So this is very important for you to know what is the uh threat model.

Let's look at the timelines because these things have been changing uh fast. So I start from this point this is true. So this is just a fact. Uh NIST is mandating postquantum cryptography by 2035 meaning that classical public key cryptography will be disallowed. Now of course this doesn't mean that NI is saying there will be a quantum computer in 2035.

Uh this mandate it's not an estimate on when we are going to have a CRQC but it's an important point to know. So when well another thing you can do you can look at industrial road maps. Of course, you take these road maps with a grain of salt and you can look at different track records between different companies on what they've been able to actually deliver. But yes, if you look at the road maps, what you will find out is that the order of magnitude, both the number of logical cubits and error rate that would be enough to build the CRQC is centered around 2032. But uh okay, that's just road maps.

Let's look at what companies are actually doing already today in terms of postquantum uh migration and uh you can see companies like Google and Cloudflare and others Apple and so on that they already implemented solutions for postquantum encryption and uh this is important because there you know two different kinds of threat. You want to be prepared for when the quantum computer arrives but also you want to be prepared in advance to be protected against store now decrypt later harvest now decrypt later attacks. So in that case you need to be protected in advance long before the CRQC is uh capable and indeed both Google and Cloudflare already upgraded their their services for postquantum encryption but what changed is that very recently both Google and Cloudflare accelerated their timeline to introduce to include also postquantum authentication. So this is supposed to be there by 2029 already. Meaning that both these companies are telling us that they believe that there is a non-negligible chance that we have a CRQC already by 2030.

What does non-negligible mean? Maybe 1% maybe 2% it depends. It can be very low and still significant because the impact is catastrophic. Other data points on the timeline we have DARPA and the QBI quantum benchmarking initiative. And here it's interesting to see how their predictions or anyway assessments changed over the years.

Only recently and this is new. This is a new thing. Only recently they feel confident to say this March 2026. They feel confident to say that someone will build a utility scale quantum computer by 2033. That's their mandate, their goal to understand if there is a chance that this happens.

And now they're saying it's likely that someone will do it. We don't know which tech, but someone will do it. Then you can uh ask uh the experts for instance but you have to ask properly right because QBI for instance by the way what QBI was saying we said someone will build a utility scale quantum computer but what does it mean is it a CRQC not super obvious but uh here this question was very clear what is the likelihood that someone will build a CRQC capable of break an actual CRQC that breaks RSA in 24 hours and uh yes the chances are on the same line non-negl negligible in 5 years. So 2030 2031 we have a likelihood of 5 to 15%. Which is absolutely not only non-negligible I would say very high.

If that's true I mean we really really need to upgrade in advance. And of course you can ask yourself if the experts are always saying uh it will happen in 15 years. It was true in the past like if you check these polls uh it's always 15 years later but something really changed in 2025. These are answers from 2025. So post wheelow that was December 2024 and uh once it's clear that error correction can work and there are multiple demonstration between different companies now the uh timelines have accelerated so we can see it both from the opinion of the experts and also from the actions of the companies.

This is where we stand with the landscape of quantum computing today. We have this gray area where the companies are that are building the hardware and then the red curves on the top right you see the requirements both in terms of number of cubits and error rates to build a CRQC. So there's still a huge huge gap to be clear but the thing is that the gap is shrinking if you check what happened from 2021 and so on. So both from the other side and the softer side when these curves or areas uh uh get very close then yes we're in trouble. So to summarize on the timeline, I agree with this uh statement or summary from Scott Aronson at the end of December at the end of 2025 when he was saying that all the building blocks are there and we need to put them together but it's really not just an engineering challenge.

So we are not at the scale we are not at the situation in which you just throw more money and more effort into it and it just works. But the building blocks are there. There is no reason to believe that CRQC will not happen. But there are still challenges, huge challenges in uh time, money, engineering, and willpower. So it's it's not obvious that it will happen uh anytime soon.

Still, there is no time to relax. Why? Yes. Uh let's focus on Bitcoin for this presentation. And Bitcoin will be impacted if we don't do anything.

Let's start from the number. The fact this is just a fact. 7 million Bitcoin are quantum vulnerable today. What does it mean? is that if there is a CRQC ready to be used, it can extract uh the private keys from the public keys corresponding to 7 million BTC and start sweeping this uh coins.

Of course, this can be done offline and then released if these people believe that they have an advantage released later. But this is the situation of we have 7 million bitcoin vulnerable. A part of it is just because it's stored on an unsafe address type. an address type that publicly you know automatically reveals directly exposes the public key and others because of reused address I have here also the summary the different types of addresses and sometimes I hear that you know the exposed addresses are legacy addresses but it's not true because all the tap routt addresses are also exposed indirectly in the in the key spend the public key exposing the public key and that's sort of a vulnerability uh but if you ask who designed it. It's not a vulnerability.

It's a design choice which is uh also true uh because it's more efficient. Anyway, one thing is clear, postconquer Bitcoin requires moving on from elliptic curve cryptography that is broken by the shortest algorithm. And if you think about it, it's also, you know, weird that Bitcoin that is supposed to last for centuries has one hard-coded dependencies on one specific form of public key crypto. So it's probably good to move on and introduce some sort of uh cryptographic agility on Bitcoin. Now the good news is that there are postquantum signature schemes that work have been standardized.

They are safe or at least as safe as hash uh crypto as hash functions. But uh you know these um signatures were not really standardized for blockchain as a use case. Bitcoin has limited resources in terms of throughput. These signatures are huge. So, you know, we cannot just plug and play the solution directly into Bitcoin.

But the good news is that Bitcoin developers are of course aware of this trade-off and addressing solutions. So, trying to optimize this trade-off here between the signature size and the total transaction throughput of Bitcoin. Now, let's look at the current state of the solutions or anyway what the Bitcoin devs are doing to address the postquantum upgrade. And we have BIP 360. I believe it's a good candidate for having at least the first step towards postquantum uh uh or quantum resistance.

And the idea here is really to preserve taproot. We like tap routt but remove this uh nonvulnerability or anyway remove this uh the key spend. So uh the keypad spend allowing people basically to continue use taproot without directly exposing the public key. An advantage here is also that taproot is uh very facilitates basically further upgrade to introducing new signature schemes. So that's a I would say a really good first step and the proposal is there.

It's discussed and we will see if we find an agreement this year or next year. Then we have the work from uh Blockstream. So Blockstream is proposing hashbased signatures. Now hash signatures are huge as I said at least the ones standardized in list but what the block devs are doing are trying to find ways to shrink these uh signatures and uh you know one very important thing that you can do instead of having uh stateless signatures you have stateful signature where you're not supposed to use the same state more than once but anyway here there is a good engineering effort to ensure that the signatures are small enough to avoid destroying the throughput of bitcoin and still have some sort of uh throughput good enough. So how does this work?

You have two paths. You have a compat path for a very small signature but you have to take care of the state and that's challenging. So normally you would do this only on an hardware wallet or anyway dedicated signer and then for all kind other kinds of wallets. So for backup you will use a fallback path that is stateless and is still as secure but the signature is huge but you're not supposed to use it many times. uh you only only when you do backup.

Then we have isogeny based cryptography. I wanted to mention because you know we always talk about hashbased and ladies based cryptography because those are the ones that were standardized in the first round of N postquantum upgrade but we have another round by the way because we want to ensure that we also have other form of public key postquantum crypto and one interesting one is for sure isogynous. Why? because the signature size is extremely small compared to all the rest of the postquantum options and uh also they preserve the algebraic structure that make them amenable to have the same no you know the nice properties of elliptical cryptography that we almost gave up on them saying that okay we need to use hashbas for bitcoin well that's not true maybe we use hashbased cryptography as a first option and then we explore also other forms of public key crypto post but quantum crypto once we are more sure that this actually doesn't uh have a classical attack for instance that can destroy them. And then this is also an interesting paper.

This is from Starkware quantum safe bitcoin and they demonstrate that even without introducing any change to the protocol there are ways to have actually postquantum transactions on bitcoin and they find a way a very you know uh ingenious way. This comes from actually from bino hash from Robin Linus and um it was changed to emulate hashbased signatures in Bitcoin as is using only script as is. Uh the difference here is that um I mean the only thing is that these transactions are non-standard so they will not be propagated uh by default by the nodes but there are ways to get the transactions mined anyway. And uh the other challenge of course is that it's very expensive. Now there is a way also okay this is another proposal and in this case there is no change to the protocol and also the transactions are standard so if you're worried about very fast quantum computers that can extract your public your private key even when the transaction is just on the mool so during the block size one thing you can do you can make the life harder for this attacker saying you don't need to extract only one private key but you need to extract n private keys by doing a n of n multisync so you In the block time you need to extract maybe 99 public keys, private keys.

Why 99? Because 99 is the limit for your transaction to be still standard. So in this solution is not you know uh quantum safe but it buys you time and it's definitely an interesting interim solution. This comes from prelabops. Okay, last point is the bitcoin migration because I talked about solutions about how to upgrade bitcoin but even if you find an agreement on upgrading bitcoin you need people and holders to actually migrate and you need to organize this in some way.

So the migration strategy one very important thing to do is to decide at least if there is a deadline or not. Is there a deadline for the migration? Are you forcing everyone to migrate by a certain date or not? And this is a huge huge question because if you don't set a deadline then uh you know you let people do the migration when they want but you also accept that some people will not migrate and then a quantum CRQC will be able to extract these keys. So there is a problem then you can decide then okay we decide a date for a migration deadline but in that case if someone is you know is late or um yeah they will have their keys frozen or burnt depending on what we do because there will be no way for them to do the upgrade to the postquantum uh spend after the deadline and we have a big big problem here with the lost coins because I told people I said people might be late but also people might not control anymore their coins increase 1 million BDC.

So what do we do with these coins? This is a big questions and uh it's if there is a chain split, it's probably coming from here. We will see. There is also this thing people say that migrating is slow, which is true. If you want to migrate the full UTXO set, it will take five months even if you use the whole block space, but most UTXOs are dust.

So you should also consider that the total economic value. So there is a proposal on the migration timeline. This is not like a uh the authors are not saying this is the right way but at least this is a way to start discussing about it and the migration might work in this way where you first give people an option. This is a postquantum spend. If you want you can start migrating.

Then at some point you can only send to the postquantum. So you cannot create any more vulnerable UTXOs. And then there is phase B where basically the deadline happened and you cannot spend any more vulnerable coins. And at this point, the good news is that even if your coins are frozen, they're not burned. There are ways to recover these coins.

And this is with a zik proof of seed that has generated a private key. That's the possible option. Now, I will just mention there is also this canary approach because you know if I'm asking you to find the right year for a deadline, it's not obvious like who who was going to decide is 2032 a good year might very well be way too early or way too late. So there is this idea we don't set in advance the deadline and we have the migration deadline triggered automatically only when we have real proof that the CRQC exists and has been used and to do that you incentivize people to uh hack or anyway extract funds from a dedicated address on which people will contribute to uh incentivizing at least a good actor to use this address as a proof and not random coins from exchanges or Satoshi or whatever. Still you know this is an idea but uh we'll see how practical it is.

We have the see start proof of knowledge of seed. This is just to say that this is not just a concept that you can prove that you own um the seed that generated a private key. This has been implemented. The code is available and uh yes we would use cart to recover BIP32 wallets. What about those wallets that were not generated using BIP32 and there is no SID?

Is there no chance for these people? Well, first of all, if you own P2PK, you can move now, you know. So, you can do that, but to a quantum safe or anyway onspend safe um long exposure safe address, you can do that. But there is this concern that you know maybe there are some holders of lost of P2P addresses that they don't want to signal that they still own these coins. Moving may be seen as a loss of privacy.

So, there is this option here. This was introduced in March May uh by Paradmium and uh this is basically you time stamp and you prove that you timestamped the proof of owning a certain bitcoin address and then at the recovery would be based on uh yes verifying this proof. So this can work and it allows you to recover your P2PK coins after the freezing as long as we actually introduce a soft fork that allows this recovery. So you'll do this time stamp hoping that this actually happens. But uh yes that's what is available today and uh that's all for my presentation for today.

Happy to talk about any of the slides more in detail later. Thank you.