Coinbase's Post-Quantum Bitcoin Upgrade Proposal

Five-phase migration to address quantum threats; what to do with millions of dormant bitcoins after the old address public keys have been leaked?

Written by: David Christopher, Bankless

Compiled by: Saoirse, Foresight News

On October 21, Brian Armstrong shared Coinbase's latest ideas for enhancing Bitcoin security against quantum computer attacks.

Preparatory work began in January this year: Coinbase established an independent quantum advisory board, with members including cryptography researchers Scott Aaronson, Dan Boneh, and Justin Drake. In July, Coinbase, in collaboration with BlackRock, Fidelity, Strategy, and others, founded the Bitcoin Security Alliance, committing $15 million over the next three years for research in Bitcoin security. Now, Coinbase has fully articulated a comprehensive plan for building quantum-resistant Bitcoin, covering new address types, signature schemes, and migration plans for existing assets.

Designing an Iterative Upgrade Underlying Scheme

Coinbase's core idea: decouple the address container that stores Bitcoin from the signature mechanism that unlocks the assets. The address container is used to hold Bitcoin, while the signature mechanism is the method for unlocking the assets.

Currently, no one can predict which quantum-resistant signature scheme will offer the highest security and practicality in the long run. Therefore, Coinbase aims to design a type of address that can accommodate multiple signature algorithms; when changing cryptographic schemes in the future, there will be no need to redevelop the entire address system.

Coinbase has proposed two alternative technical routes: BIP-360 (P2MR), which will introduce a new type of Bitcoin address to reduce the exposure risk of quantum attacks; the other scheme is P2TRv2, which supports quantum-resistant signatures.

Both schemes meet Coinbase's pursuit of flexibility, but neither can be considered a complete solution on its own. Especially BIP-360, which still requires additional upgrades to support quantum-resistant signatures.

Coinbase also proposed a hybrid address concept: users can either continue using the existing signatures or use quantum-resistant signatures to spend the same funds. However, this scheme has a drawback: as long as the old signature method is still usable, the funds remain vulnerable to quantum attacks. The hybrid address can only serve as a transitional measure, not a long-term solution.

Selecting Compatible Signature Algorithms
After establishing the core principle that the address design must be flexible, the next key question is: which quantum-resistant signature algorithm should Bitcoin adopt?

Coinbase listed four candidate schemes:

• ML-DSA: Based on lattice cryptography, already standardized, with balanced overall performance; the downside is that the signature data size is relatively large.
• SLH-DSA: Also standardized, built on mature hash functions; the signature size is larger than ML-DSA.
• FN-DSA (Falcon): Smaller signature size, but high difficulty in secure implementation, not yet standardized.
• SHRINCS: An experimental scheme designed specifically for Bitcoin, with a smaller signature size, but very strict key management requirements.

Coinbase proposed four candidate algorithms for Bitcoin's quantum-resistant signatures: lattice-based ML-DSA, FN-DSA (Falcon), and hash-based SLH-DSA, SHRINCS, each with its own advantages and disadvantages regarding signature size, implementation difficulty, and whether there is a NIST standard.

The biggest contradiction in the selection of schemes comes from the signature size. Quantum-resistant signatures have a data volume much larger than the signatures currently used by Bitcoin, which will occupy more block space, potentially reducing network transaction throughput and increasing transaction fees.

Therefore, Coinbase suggests evaluating different schemes from multiple dimensions, including security, cost of use, processing speed, hardware wallet compatibility, and the migration cycle for high-risk Bitcoin assets.

Another factor to consider is the key management model.

Stateful Signatures: Require users to keep track of the usage records of each signature key. If a key is inadvertently reused after recovering from an old wallet backup, an attacker could forge signatures and steal assets. Given the risks, why consider this? The advantage lies in efficiency. Stateful signatures can be made smaller, potentially maintaining lower fees, but the risks increase accordingly. Therefore, Coinbase recommends that Bitcoin also support stateless signatures, which do not require tracking key usage status.

In addition, Coinbase hopes that the signature scheme can adapt to institutional custody service providers. Many institutional custody businesses use multi-signature architectures, where private keys are split and stored across multiple servers. Some lattice-based schemes are better suited for such architectures, and compatibility is also an important evaluation criterion.

Of course, Coinbase has its own commercial considerations. As one of the largest custodians of Bitcoin, it hopes that the upgrade scheme can be compatible with its own security infrastructure. However, institutions hold a large amount of Bitcoin, and their needs cannot be ignored in the overall Bitcoin ecosystem.

Phased Asset Migration

Beyond selecting a signature scheme, Coinbase's goal is to create a clear roadmap to guide the gradual migration of Bitcoin assets to quantum-resistant addresses.

The plan outlines five potential implementation phases:

1. Early trial phase: Allow users to voluntarily transfer assets to quantum-resistant addresses.
2. Hybrid address phase: Enable hybrid addresses that are compatible with both traditional signatures and quantum-resistant signatures for a smooth transition.
3. Secure migration phase: Explore techniques to hide public keys during transfers to reduce the exposure to quantum attacks.
4. New rule implementation phase: Gradually restrict transfers to old addresses with security vulnerabilities, ultimately prohibiting asset spending from old addresses.
5. Final wrap-up phase: Establish rules for disposing of remaining assets in old addresses, with optional methods including setting a migration deadline, freezing assets, limiting transaction amounts, or establishing an asset recovery mechanism.

Coinbase proposed five phases for migrating Bitcoin to quantum-resistant addresses: from voluntary upgrades by users, hybrid address transitions, hiding public keys to reduce risks, to gradually restricting old addresses, and finally deciding on the disposal methods for remaining assets in old addresses.

Coinbase has not finalized any ultimate plan. The primary task at this stage is to assess the feasibility of various schemes, including the compatibility performance of non-upgraded wallets and nodes, and then determine the final scheme based on that.

Addressing Dormant and Lost Bitcoins Separately

Next is the most controversial topic: how to handle Bitcoins that have been sitting idle for a long time?

Millions of Bitcoins are stored in old addresses where the public keys have already been leaked, including block rewards mined by Satoshi Nakamoto. Some belong to long-term holders, while others may have been permanently lost.

These assets are prime targets for quantum attacks. If someone secretly develops a high-performance quantum computer, they could steal these Bitcoins before the entire industry becomes aware of the risks.

Coinbase neither advocates for direct freezing or forced recovery nor suggests neglecting the issue. Instead, it proposes to separate the discussion of dormant coins from the signature upgrade, avoiding the divergence around dormant Bitcoins from hindering the quantum security upgrade process for all users.

If an asset recovery mechanism is to be established, Coinbase proposes two hard prerequisites:

• The mechanism itself must possess quantum-resistant characteristics: attackers cannot use the leaked public keys to steal assets through this recovery mechanism.
• It must cover various extreme scenarios: there should be contingency plans for situations where holders lose recovery credentials, systems are under high load, or users miss deadlines.

In summary, Coinbase views this proposal as a reference material for public discussion, rather than a final blueprint. No single company or developer can unilaterally decide the direction of Bitcoin's development, and achieving consensus across the entire ecosystem is even more challenging than the development of cryptographic technology itself.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.