Bitcoin's Path to Quantum Resistance

Introduction

Private keys are foundational to Bitcoin, enabling users to securely control and transfer bitcoin without an intermediary. Today, that security depends on cryptographic signature schemes that have proven resilient against classical computing attacks.

While cryptographically relevant quantum computers (CRQCs) do not yet exist, sufficiently powerful systems could eventually undermine the security of private keys. As a result, researchers are evaluating quantum-resistant signature schemes that could preserve Bitcoin’s security in a post-quantum environment.

The challenge is that quantum-resistant signature schemes are significantly larger than those used today, creating trade-offs between security, scalability, and transaction efficiency. This article examines the leading approaches under consideration, including stateful and stateless designs, and the potential pathways for integrating quantum-resistant signatures into Bitcoin.

Key Takeaways:

• Cryptographic schemes define the processes used to generate keys, create signatures, and verify transactions.
• The current signature schemes used in Bitcoin may eventually become vulnerable to quantum computers.
• Quantum-resistant signature schemes are inherently large, reducing the maximum number of transactions included in Bitcoin’s blocks.
• Researchers are evaluating combinations of quantum-resistant signature schemes to balance security, efficiency, and usability.
• A soft fork could enable multiple quantum-resistant signature types, allowing users to build customized security models based on their specific requirements.

Cryptographic Schemes

A cryptographic scheme is a framework that defines how keys are generated, signatures are created, and transactions are verified. These processes rely on advanced mathematics, computer science, and information theory to securely authenticate data and prove ownership. Bitcoin utilizes multiple cryptographic schemes to allow users to trustlessly (without needing to rely on a trusted third party) interact and communicate with one another.

ECDSA and Schnorr

Bitcoin transactions consist of many components, but the digital signature is the primary focus when evaluating quantum readiness. Today, Bitcoin transactions are authorized using either the Elliptic Curve Digital Signature Algorithm (ECDSA) or Schnorr signatures, which were introduced as part of the 2021 Taproot upgrade.

Both schemes rely on the elliptic curve discrete logarithm problem (ECDLP), a mathematical assumption that is considered secure against classical computers but could eventually be vulnerable to quantum computers.

Every Bitcoin transaction today relies on a digital signature scheme that could eventually require replacement or supplementation in a post-quantum environment. 

Signature Size Comparison

The default size of an ECDSA public key is roughly 65 bytes and a Schnorr (Taproot) public key is 32 bytes.^1,2 However, most Bitcoin public keys that use ECDSA today are compressed by default and stored at roughly half that size. The exact figures are less important than the broader implication, but it is important to understand that these keys are relatively small.

Public key size can matter because it directly affects fees and usability. Users pay for block space on a per-byte basis. Larger keys consume more block space, reducing the number of transactions that can be included per block. Therefore, the larger the key, the higher the fee.

However, these signature schemes may no longer be secure if a CRQC is created. Both ECDSA and Schnorr expose a user’s public key when signing a transaction. A sufficiently powerful CRQC could potentially use this information to derive the associated private key. Consequently, any compromise of the private key directly places the associated funds at risk.

A Proposed Solution

There are several quantum-resistant signature schemes under consideration, many of which remain active areas of research. One notable example is SHRINCS, a recently published Bitcoin Improvement Proposal (BIP) from Blockstream, a Bitcoin development and infrastructure company, that combines multiple quantum-resistant schemes to balance trade-offs.^3,4 

The proposal utilizes hash-based signature schemes, which are built on one-way hash functions that are not susceptible to attacks from a CRQC. These are already heavily relied on in Bitcoin today. The first component, a stateful signature scheme, adds additional complexity in exchange for greater efficiency. These schemes utilize a parameter known as a signature “budget,” which defines how many times a key can securely sign a transaction.¹

Although the budget remains large even when optimized for smaller signature sizes, the stateful design requires users to track a new parameter known as the “state” across all signing devices. If lost, reusing a key could compromise the scheme’s security guarantees. 

This added complexity of tracking a signature’s state creates challenges for wallet backup and recovery. For example, the traditional 12- or 24-word seed phrase backup would have no way of preserving the current state, potentially putting the user at risk if a wallet is restored on a new device.

In the event of a lost state, the proposal incorporates a stateless signature scheme as a fallback option. While stateless signatures eliminate the need to track state, they produce significantly larger signatures and are therefore more expensive to use. As a result, the stateless path is intended primarily for recovery scenarios when a user's stateful setup has been compromised or lost.

By combining stateful and stateless signature schemes, the proposal seeks to provide two distinct spending paths. First, a relatively efficient spending path for users in the best-case scenario. Second, a slight improvement over the National Institute of Standards and Technology’s (NIST) proposed stateless hash-based digital signature scheme (SLH-DSA) in the worst-case scenario.⁵   

While this approach improves efficiency, it materially impacts Bitcoin’s throughput—transactions per second (TPS)—a metric commonly featured by competing networks.

Quantum Readiness Timeline

Although SHRINCS has now been formalized as a BIP, a soft fork would still be required to introduce the rules to support scheme.

Due to the backward-compatible nature of soft forks, they may face fewer adoption challenges than some of Bitcoin’s more contentious historical changes. As a result, network participants could elect to push through such a proposal on an increased timeline to implement a solution before a CRQC becomes an immediate threat.

Users that consider the quantum threat imminent could migrate their funds to addresses compatible with the new framework while continuing to send via Schnorr signatures under normal conditions. If a CRQC threat emerged, users could then transition to the quantum-resistant spending path when applicable.

The social layer may prove to be the most challenging aspect of implementation given Bitcoin’s decentralized nature. However, if a credible CRQC threat materialized, the Fidelity Digital Assets® Research team believes the resulting urgency could accelerate consensus around a quantum-resistant upgrade.

Conclusion

Research into quantum-resistant signature schemes remains active, and additional time is needed to better understand the trade-offs and potential limitations of each approach. Minimizing key size to preserve Bitcoin’s transaction throughput remains a key concern, although the impact may be less pronounced considering the current state of a near-empty mempool.

SHRINCS represents one potential path forward as a recently formalized BIP. However, Bitcoin’s technical constraints and the inefficiencies associated with larger quantum-resistant signatures suggest that a future solution may resemble Bitcoin’s current state. 

Under this model, multiple address types and signature schemes exist to accommodate different user requirements. For example, users managing a single signature would choose a different scheme implementation from those that use collaborative or multi-signature custody.

For investors, the key takeaway is that Bitcoin's path to quantum resistance appears to be ongoing. While the CRQC threat does not appear imminent, Bitcoin’s open-source development community is actively evaluating a range of potential solutions. Although any eventual implementation may introduce new trade-offs, Fidelity Digital Assets® Research believes Bitcoin can strengthen its security while preserving the core properties that underpin its value proposition.

Get in touch with our team to discuss the latest developments in quantum computing and Bitcoin.