Loading video...
Video Failed to Load
Can a sufficiently powerful quantum computer forge the signatures used to authorize Bitcoin and Ethereum transactions? What would it take to upgrade both networks before that happens? In this new lecture, Stanford cryptographer Dan Boneh explores why blockchains may turn to signatures built from hash functions. He also presents... show more
120,741 views • 1 month ago •via X (Twitter)
31 Comments
@danboneh Got $QRL?
Fascinating lecture. The migration problem may ultimately be as important as the cryptography itself. Interesting to see hash-based cryptography becoming such a central part of the conversation around quantum-resistant blockchains. Neptune Cash is an interesting example of this approach.
@danboneh satoshi's recovery problem is massive
Bitcoin addresses that have already exposed a public key, reused ones, old UTXOs sitting on chain, are vulnerable the second a capable quantum machine exists, no new transaction required. Ethereum accounts carry similar exposure once a key has signed. Swapping the signature scheme is the easy part on paper. Getting every wallet, exchange and node to adopt it in a coordinated window without splitting consensus is the part these lectures tend to skip
@danboneh Ethereum will pave the way for everyone else and become the first quantum safe L1 in the world (and eventually be the base layer for the global economy secured by ethereum:native)
@danboneh
Boneh's framing undersells how political this gets before it's even technical. Bitcoin has only changed its signature scheme once, adding Schnorr through Taproot, and that took years of debate with no deadline forcing anyone's hand. Forcing a mandatory move off ECDSA on a network with no central coordinator, no CEO, no upgrade committee, is a governance fight first and a cryptography fight second
@danboneh these are golds. i have been subscribed to your youtube channel and its gold mine.
@danboneh planning the upgrade before the emergency is the hard part. cryptography gets less exciting when the deadline arrives.
This is our thesis Quantum will kill off some coins, and greatly depreciate others The top 10 will be re-arranged by 2029 We believe in peer to peer electronic cash, and we can't afford for it to fail; it's important for civilization as a whole. Fix the money, fix the world. No matter how many AI systems, robots, self driving cars, neural implants and other amazing innovations we make, as long as the money system is inherently unsound, unfair, and controlled by hidden operators, we cannot advance. Civilization cannot go forward - everything runs on money here, it's required to coordinate humans at scale. You can trade a potato for an egg, but if you want to build an airport, you need tens of thousands of people coordinating around one goal, for this, we need money. If the underlying system everything is based on is corrupt, everything built on top will be corrupted, slowly, over time. We know Bitcoin won't adapt in time - it will take heavy damage in the markets; if the encryption can't be trusted, the entire project is moot. We believe Bitcoin will survive but won't be #1 anymore. Ethereum is doing well adapting, bullish Many chains just won't make it Quantus and other PQC chains are the natural evolution of peer to peer electronic cash, and of sound money.
@danboneh 🔐⚛️ Incredible research by Dan Boneh. But as your crypto startup scales revenue, don't let heavy corporate taxes & wire fees eat your profits. Setup a HK/BVI entity (0% tax) & global crypto banking! DM
@danboneh love that it ends on the hard questions 😉
@danboneh Thanks guys this is really good. We are trying to reach out, can you please DM us
@danboneh Where can I read more on the bitcoin updates?
@danboneh Useful Bitcoin angle. The strongest conversations still come back to custody, liquidity, scarcity, and what holders can independently verify.
@danboneh 🐐
@danboneh Usability is the part that will decide whether this upgrade actually sticks
@danboneh The signature scheme is only half the upgrade. Addresses need migration too
@danboneh Hey @grok What is @ekosproject ?
@danboneh bitcoin can't even answer the most basic of coding issues it has, let alone quantum.
@danboneh Stop shilling thin air....BTC can't do anything without a layer of help! Useless to the world excluding early buyers and enormous energy consumption for what? You can't host anything, can't compute or store. Seriously, the UNDP has a solution, a real world utility: ICP DYOR
@danboneh el detalle que falta es que las firmas basadas en hash requieren guardar el estado de cada firma anterior, y perder ese estado te deja la billetera inutilizable
@danboneh study @monad
@danboneh $CELL @cellframenet 👀 👀 👀 👀 👀
@danboneh Quantum readiness for both networks is worth planning for now.
@danboneh Post-quantum signatures will be essential, but migration is a huge coordination challenge—especially for dormant wallets and legacy addresses on both networks
@danboneh @ekosproject Future of Ai Building future …..
@danboneh Does the migration risk for abandoned coins look similar to the risks we see in lending when borrowers lose access to collateral?
@danboneh very nice. but banking systems also are prone to be exposed in their private ledgers
@danboneh @QRLedger - exists
@danboneh Cellframe is here.
![BITCOIN RAILS #70: THE CASE FOR LATTICE-BASED SIGNATURES IN BITCOIN | with CTO of Ledger Charles Guillemet 🔗 YouTube: 🌿 Spotify: To date, post-quantum Bitcoin discussions have largely centered on which digital signature schemes offer the strongest cryptographic security against a quantum adversary. But cryptographic assumptions are only one dimension of security. Different signature schemes introduce different implementation and operational risks. How should Bitcoin weigh cryptographic conservatism against the complexity required to deploy that cryptography safely? While hash-based signatures are often favored for their conservative assumptions, CTO of Ledger, Charles Guillemet Charles Guillemet argues that evaluating primitives in isolation can obscure consequential risks at the systems level. Stateful hash-based schemes, in particular, introduce state-management requirements where operational or user error can have catastrophic consequences —despite their conservative cryptographic foundations. In this interview, Charles and I examine the tradeoffs of hash-based signatures and his case for greater consideration of lattice-based alternatives, i.e. ML-DSA. A very juicy episode for anyone seriously assessing Bitcoin's post-quantum design landscape. This episode of Bitcoin Rails is brought to you by: LayerTwo Labs LayerTwo Labs — developing research, software, and technologies for scaling Bitcoin via the integration of Drivechains (BIP 300/301) Hashi on Sui — a primitive for executing Bitcoin DeFi transactions, without having to trust a federated bridge or other centralized entity BitBox BitBox — an open-source Bitcoin-only hardware wallet, with smooth UX and no compromises on security. Check out Bitbox [dot] swiss and use code BITCOINRAILS to get a discount TIMESTAMPS: 00:00 — Intro 01:45 — How the quantum threat became real for Ledger 09:06 — NIST influence and what Ledger built into its SDK 21:25 — ML-DSA and why Falcon might not be the right choice 25:33 — The problem with hash-based signatures 31:38 — Stateful signatures and the throughput problem 36:48 — Does user error outweigh the security difference? 42:27 — Bitcoin post-quantum migration scenario 45:15 — Maintaining multisig capabilities in a post-quantum world 55:54 — NIST standardization process and the backdoor question 1:01:06 — Trezor's approach and device authentication 1:06:09 — Ledger’s approach to post-quantum signatures](https://image.24vids.com/tw-2092273519111385579/amplify_video_thumb/2092271558660165632/img/vLAew2F7HN1yExrB.jpg)
![BITCOIN RAILS #59: Post-Quantum Bitcoin Signatures (+ their tradeoffs) | with BIP 360 co-author Ethan ✨ is on BlueSky✨ Heilman 🐱 and Blockstream Head of Research Jonas Nick 🔗 YOUTUBE: 🌿 SPOTIFY: According to BIP 360 co-author Ethan Heilman, Bitcoin needs a minimum of two soft forks to become quantum resistant: P2MR (or an output type that can safely execute PQ signatures) + a post-quantum checksig (signature scheme). Ethan and the BIP 360 team (including myself and Hunter Beast 🕯️) introduced the P2MR part via a BIP 360 update late last year—but the question remains, what’s the most appropriate PQ signature scheme for Bitcoin? They all have substantive tradeoffs, but hash-based signatures seem to be leading technical discourse—likely due to recent optimizations by Jonas Nick and the broader Blockstream research team. It was an honor to sit down with both of these men - arguably the two most influential and productive cryptographers in Bitcoin quantum mitigation right now - for an in-depth review of the leading PQ signature schemes and a temperature check on Bitcoin’s post-quantum planning process. TBH, if you want to skip the noise and jump straight to the signal on quantum, this is the interview to watch. In this episode, we discuss: - What needs to happen at the soft fork, infra, and mitigation levels to fully quantum-harden Bitcoin - Recent updates to BIP 360 + breakdown of the leading hash-based signatures schemes for Bitcoin (SHRINCS + SHRIMPS) - Why we may actually get consensus around a stateful scheme for Bitcoin - Comparisons of hash-based signatures vs Lattice and Isogeny-based schemes - Assessing the risks of both waiting too long and acting too fast (and why quantum is a better threat to be facing than a potential classical attack) This episode of Bitcoin Rails is brought to you by my NEW sponsors: - LayerTwo Labs LayerTwo Labs — developing research, software, and technologies for scaling Bitcoin via the integration of Drivechains (BIP 300/301) - Hashi on Sui — a primitive for executing Bitcoin Defi transactions, without having to trust a federated bridge or other centralized entity - BitBox BitBox — an open-source Bitcoin-only hardware wallet, with smooth UX and no compromises on security. Check out Bitbox [dot] swiss and use code BITCOINRAILS to get a discount TIMESTAMPS: 00:00 Intro 02:18 Ethan’s Quantum Wakeup 05:18 How Blockstream Enters Post Quantum 09:25 BIP 360 Explained 12:11 How Bitcoin Transitions to PQ 17:35 Choosing Post Quantum Signatures 23:20 How Blockstream Created SHRINCS 27:22 Signature Budgets Importance Explained 41:13 What are SHRIMPS? 44:51 SHRIMPS vs SHRINCS 47:48 Why SLH-DSA Alone Won’t Cut It 49:24 Is a SHRIMPS + SHRINCS BIP Coming? 51:51 Blockstream’s Big Plans for Liquid 59:04 Quantum Readiness Roadmap 01:02:22 Importance of a PQ Recovery Plan 01:05:35 How Long Would a PQ Migration Take 01:11:17 Quantum Watchlist Recommendations](https://image.24vids.com/tw-2051672209454756108/amplify_video_thumb/2051671562672082952/img/GYI9mVH4-kcDz2Gz.jpg)
![BITCOIN RAILS #69: ZERO-KNOWLEDGE PROOFS FOR POST-QUANTUM BITCOIN | with Benedikt Bünz 🔗 YOUTUBE: 🌿 SPOTIFY: While many Bitcoiners remain hopeful the network will embrace zero-knowledge proofs for protocol-level use cases, practical adoption has remained limited outside of BitVM and a handful of experimental proposals. Most of the world’s ZKP research has circled around Ethereum and other ecosystems, where significant resources have been dedicated to advancing these systems, particularly for scaling and privacy applications. One of the most notable contributors to this research is Benedikt Bünz ☕️ — professor of cryptography at NYU and collaborator of Dan Boneh, who together inarguably form one of the strongest blockchain-applied cryptography teams in the world. The pair recently announced they’ll be leading the new post-quantum cryptography unit localhost research — the first dedicated PQ research effort within a major Bitcoin development organization. With Benedikt leading the charge on the use of zero-knowledge proofs for post-quantum mitigation, the question emerges: will the post-quantum transition be the catalyst to finally bring zero-knowledge proofs to Bitcoin's core protocol? In more detail, Benedikt and I discuss: - Why ZKPs haven’t been widely adopted by the Bitcoin technical community — and why the threat of quantum computers may change that posture going forward - How ZKPs could be used for signature batching to address larger post-quantum signatures in Bitcoin’s post-quantum era - Why Bitcoiners will likely prioritize hash-based signatures as an initial post-quantum scheme — rather than more efficient but less proven alternatives (e.g., lattice-based) - How ZKPs have evolved over the last decade and may finally be ready for Bitcoin’s strict requirements around trust assumptions - Why Benedikt and Dan are teaming up with localhost research to create the first post-quantum cryptography unit within a major Bitcoin development organization + what they hope to accomplish This episode of Bitcoin Rails is brought to you by: LayerTwo Labs LayerTwo Labs — developing research, software, and technologies for scaling Bitcoin via the integration of Drivechains (BIP 300/301) Hashi on Sui — a primitive for executing Bitcoin DeFi transactions, without having to trust a federated bridge or other centralized entity BitBox BitBox — an open-source Bitcoin-only hardware wallet, with smooth UX and no compromises on security. Check out Bitbox [dot] swiss and use code BITCOINRAILS to get a discount TIMESTAMPS: 00:00 — Intro 00:22 — Benedikt's background 04:10 — How Benedikt got into Bitcoin and cryptography 07:42 — First ZK project: proving exchange solvency after Mt. Gox 16:01 — ZK proofs explained 27:43 — How security gets popular & ZK proofs in Bitcoin 35:49 — Other applications of ZK proofs for Bitcoin 40:15 — Why ZK proofs haven't been adopted in Bitcoin 50:46 — Why the Bitcoin post-quantum transition needs ZK proofs 01:07:00 — Cryptographic agility and why lattices win 01:18:00 — The size problem and how SNARKs solve it 01:33:57 — Proving a Bitcoin block in a laptop in 1.5 seconds 01:37:12 — Bitcoin as the primary quantum target 01:40:47 — ZK proofs for seed phrase recovery](https://image.24vids.com/tw-2077037171521790155/amplify_video_thumb/2077029285437612032/img/adv6N-PXvunUqveH.jpg)
![BITCOIN RAILS #72: Bitcoin's Leading Post-Quantum Signature Proposal | with SHRINCS co-author conduition 🔗 YouTube: 🌿 Spotify: The first fully specified post-quantum signature scheme for Bitcoin has been proposed to the Bitcoin mailing list. The proposal introduces a full specification for “SHRINCS,” a hash-based signature scheme initially conceived by Jonas Nick and Mikhail Kudinov of Blockstream Research Blockstream — with specification details added by new co-authors conduition remix and BIP 360 co-author Ethan ✨ is on BlueSky✨ Heilman 🐱 Today, I’m honored to share a full whiteboard explanation of the scheme by its co-author Conduition — as well as a thorough discussion of the scheme’s key tradeoffs when compared to Bitcoin’s existing elliptic-curve signatures and competing post-quantum alternatives. In more detail, this interview includes: — A full whiteboard walkthrough of the scheme’s key components and its relationship to the NIST-standardized scheme SPHINCS+ — SHRINCs’ introduction of a compact stateful path - yes, I said stateful 🌶️ — Whiteboard explanations of all relevant cryptographic subschemes, including FORS, WOTS+C, and XMSS — Thorough discussion of the scheme’s tradeoffs and implications for Bitcoin’s existing functionality If you have a vested interest in understanding what may be the future signature scheme protecting Bitcoin transactions in a post-quantum world, this episode is a must-watch. WARNING: this episode is fairly technical — don't beat yourself up if you don't catch everything, or need to watch it a few times to grok the details. This episode of Bitcoin Rails is brought to you by: LayerTwo Labs LayerTwo Labs — developing research, software, and technologies for scaling Bitcoin via the integration of Drivechains (BIP 300/301) Hashi on Sui — a primitive for executing Bitcoin DeFi transactions, without having to trust a federated bridge or other centralized entity BitBox BitBox — an open-source Bitcoin-only hardware wallet, with smooth UX and no compromises on security. Check out Bitbox [dot] swiss and use code BITCOINRAILS to get a discount TIMESTAMPS: 00:00 — Intro 01:26 — The SHRINCS BIP and how conduition got here 05:26 — Building slhvk and joining the Blockstream working group 08:34 — Why hash-based signatures, even without quantum 14:08 — What SPHINCS is and what stateless really means 18:45 — Losing count and why state is dangerous 24:44 — SHRINCS and the stateless backup WHITEBOARD SESSION STARTS HERE: 30:30 — Inside the SHRINCS public key 34:39 — Winternitz signatures and hypertrees 43:18 — Signature sizes and witness discount 51:42 — Inside the stateful side and FXMSS 1:01:25 — Where the stateful and stateless sides differ 1:08:50 — UXMSS, BXMSS and getting wallet devs up to speed 1:19:03 — FORS and the forest of random subsets 1:34:24 — What Bitcoin gives up with hash-based signatures 1:39:08 — Migration and where SHRINCS could be deployed](https://image.24vids.com/tw-2092971357797499071/amplify_video_thumb/2092969885244542976/img/cTncZSr6A48J7yq8.jpg)
![BITCOIN RAILS #61: QUANTUM CRYPTOGRAPHY FOR BITCOIN | with Dan Boneh Dan Boneh 🔗 YOUTUBE: 🌿 SPOTIFY: One of the most prolific and influential cryptographers in the world, it’s difficult to fully quantify the impact that Dan Boneh has had on Bitcoin and digital assets more broadly. Through both his own research and his mentorship of some of the space’s most important contributors — e.g. Andrew Poelstra, Benedikt Bünz ☕️, and Robin Linus — few people have done more to shape the cryptographic foundations underlying modern blockchains and digital finance. More recently, Dan co-authored Google's widely discussed paper, “Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities,” which reduced prior estimates of the resources required to run Shor’s algorithm against the elliptic-curve cryptography used by Bitcoin. The paper reignited debate around quantum computing timelines and the long-term security assumptions behind modern cryptocurrencies. In this episode of Bitcoin Rails, Dan and I discuss the current state of quantum computing, its potential implications for Bitcoin, and how he believes the Bitcoin community should think about preparing for a post-quantum future over the coming decade and beyond. And yes, Dan shares his take on the “when quantum” question in the interview, among other key perspectives. This episode of Bitcoin Rails is brought to you by my NEW sponsors: LayerTwo Labs LayerTwo Labs — developing research, software, and technologies for scaling Bitcoin via the integration of Drivechains (BIP 300/301) Hashi on Sui — a primitive for executing Bitcoin Defi transactions, without having to trust a federated bridge or other centralized entity BitBox BitBox — an open-source Bitcoin-only hardware wallet, with smooth UX and no compromises on security. Check out Bitbox [dot] swiss and use code BITCOINRAILS to get a discount TIMESTAMPS: 00:00 — Intro and Dan’s history with cryptography and Bitcoin 11:44 — Shor's algorithm: how a 1994 paper became cryptography's most important threat 16:39 — Building a quantum computer: superconducting qubits vs neutral atoms 25:37 — When should we start worrying about quantum computers? The timeline debate 31:51 — Have we already reached quantum computing's “ahá” moment? 39:09 — Inside the Google paper: how Shor's algorithm was optimized 49:57 — The Bitcoin mempool attack and the 10-minute window 59:21 — Mitigation: what should Bitcoin do to prepare for quantum? 1:11:54 — Hash-based vs lattice-based signatures: Dan's case for lattice 1:23:15 — ZK proofs, BIP361, and what to do with Satoshi's coins 1:31:52 — Encrypted mempools and MEV 1:38:29 — Why Bitcoin will survive quantum and Dan's message to Bitcoin builders](https://image.24vids.com/tw-2057110642662797602/amplify_video_thumb/2057106711635275776/img/Pa2J_IxNMDKku2uu.jpg)
