Quantum Threats and Bitcoin’s Response
As quantum computing technology progresses, public-key cryptography systems face serious challenges. Bitcoin’s ECDSA signatures rely on the secp256k1 curve; theoretically, a sufficiently powerful quantum computer running Shor’s algorithm could solve discrete logarithms and forge transaction signatures. In a paper published on April 9, StarkWare researcher Avihu Levy introduced a scheme called Quantum Safe Bitcoin (QSB), claiming it can resist quantum attacks without altering Bitcoin’s core protocol, drawing widespread attention from the community.
Core Mechanism: Hash-to-Signature Puzzle
The core of QSB is a “hash-to-signature” puzzle. The system hashes a transaction-derived public key using RIPEMD-160 and treats the output as a candidate ECDSA signature. Only a tiny fraction of random hashes meet the strict formatting rules required for valid signatures, creating a proof-of-work condition. The paper estimates the probability of success at roughly 1 in 70.4 trillion attempts. This approach builds on earlier work known as Binohash, which embeds one-time signature schemes into Bitcoin Script, thus shifting security from elliptic curves to hash pre-image resistance.
Quantum-Resistant Security Foundation
Because the puzzle depends on hash properties rather than elliptic curve hardness, it remains resistant to Shor’s algorithm. A quantum attacker would gain only a quadratic speedup from Grover’s algorithm, leaving meaningful security margins. The paper estimates about 118 bits of second pre-image resistance under a Shor threat model. The construction operates within Bitcoin’s existing scripting limits, including a cap of 201 opcodes and a maximum script size of 10,000 bytes. It uses legacy script structures and avoids any need for consensus changes or soft forks, a feature that may appeal to developers wary of protocol fragmentation.
Transaction Process and Implementation Challenges
The transaction process unfolds in three stages, according to the proposal. First, a “pinning” phase searches for transaction parameters that produce a valid hash-to-signature output, binding the transaction to a fixed structure. Next, two digest rounds select subsets of embedded signatures to generate additional proofs tied to the transaction hash. Finally, the transaction is assembled with all required preimages and verification data.
The design introduces tradeoffs. QSB transactions exceed standard relay policy limits, meaning they would not propagate across the network under default settings. Instead, they would require direct submission to miners through services such as Slipstream. The scripts also consume significant space and computational resources. Despite these constraints, the cost of generating a valid transaction appears within reach. The paper estimates total compute expenses between $75 and $150 using cloud GPUs, with the workload scaling across parallel hardware. Early testing reports successful puzzle solutions after several hours using multiple GPUs.
Current Status and Outlook
The project remains incomplete. While the paper and script generation tools are finished, parts of the pipeline, including full transaction assembly and broadcast, have not been demonstrated on-chain. Still, the proposal adds to a growing body of research exploring how Bitcoin could adapt to a future with quantum computing. By avoiding protocol changes, QSB presents one path that relies on existing rules rather than consensus upgrades, a direction that may shape further debate on long-term network security.