Transcript 0:00 So what's, what's funny is like all the, all the quantum fudsters, like the people who are like, "Oh, Bitcoin's over because quantum can..." Like Willow or something, it's like you're just like totally full of shit. 0:09 Like there's, there's -- like we have a plan. We have, uh, eighty percent of coins are not vulnerable. Like there's not a lot of reason to, to be super concerned. Like there's no way quantum computers will kill Bitcoin. 0:22 I, I, I don't think there's cause to worry. 0:24 Well, I'll tell you who is concerned, like really very concerned about this quantum threat to the point where there's laying out roadmaps and deadlines and like, "We need to be ready by this date," and that's the US government. 0:37 They, they have a specific date in which they want to phase out elliptic curve cryptography entirely, wh-which is the year twenty thirty-five. 0:44 Uh, they also have like, uh, roadmaps towards the transition to post-quantum cryptography. 0:52 So if we want Bitcoin to be at least as secure as the government expects their own systems to be, then we basically have five to ten years. 1:02 You know, like if you're just looking at the writing on the wall, if you're just looking at what the government is doing, then it's pretty clear that they know something we don't. 1:10 [upbeat music] Welcome back to Bitcoin Season Two. I'm Charlie Spears with Blockspace Media. 1:27 We have an interesting topic today. 1:30 You know, everybody in the world is talking about quantum computing after the Google Willow chip announcement in the past week or two, and that means that we are also talking about how does quantum computing maybe affect or find some parts of Bitcoin vulnerable. 1:50 This could mean up to a million or so of Satoshi's Bitcoin that they mined back in the day, and maybe even your Bitcoin, depending on their security. 2:00 And because this is such a deep and technical topic, I have hit up our connection, Hunter Beast, a Coloradan Bitcoin dev, to help explain this. 2:11 Hunter has written a BIP, which does not have a yet a number, but it's one of the ones I think out there doing the best, uh, work, uh, feet on the pavement, uh, actually talking about and, uh, talking about solutions, uh, to a potential Bitcoin vulnerability. 2:29 But before any of that, a word from our sponsor. Bitcoin Season Two is brought to you by Botanix. 2:35 Botanix Labs is pioneering a new direction for DeFi with the first EVM L2 running on Bitcoin that's built to be forward secure, decentralized, and share gas fees generated by the network with users. 2:48 See the future of DeFi at Botanix, botanixlabs.xyz. All right, I'm gonna bring Hunter up. Hunter, thank you so much for coming on Bitcoin Season Two. How are you doing? 2:59 [lips smack] Oh, geez, uh, got a lot of irons in the fire. Um, so just been, uh, really productive, and when I'm productive, I'm happy. So yeah. Same. 3:11 I mean, you've kind of become a bit of like the, the voice for the, the Bitcoin and quantum, um, narrative right now, but you have multiple irons in the fire. I think you've got the Ducat or Ducat stablecoin project. 3:23 What other things are you involved in? Yeah. So, uh, one thing that is a more recent development is, uh, I'm going to be joining Mara as a protocol engineer. Ooh, I didn't know that. That's a big announcement. 3:39 So, uh- Yeah. -congratulations. Yeah. Thank you. Um, and, uh, uh, 3:45 one reason they wanted me to join was because of the work that I'm doing on, uh, uh, quantum resistance and, uh, um, in particular, they want to deploy a side chain that, uh, uh, employs that. 4:01 But we haven't really announced too many details on that, so, um, uh, more on that soon. Yeah. Um, that, uh, I'm excited to learn more about that. 4:10 Maybe we do a -- we re-repick that conversation up again whenever you guys are further along with that. 4:17 Um, so, uh, I kinda said, like, you know, I have a bit of a hybrid audience here, and I want -- And a lot of people have no idea about anything to do with quantum, and, and frankly, I think a lot of people lack even a basic understanding of Bitcoin, even if they own a lot of Bitcoin. 4:34 And then these two things are kind of difficult to explain. 4:37 So my thought is we start out with some kind of high level, like simplified, um, like talking points, and then I can, uh, let you take the gloves off and go deeper into some of the obscure technicalities of this. 4:51 So, um, let's, uh, let's, let's first of all go back to like what kicked off this most recent narrative, which is Google CEO Sundar Pich-Pichai, uh, tweeted and announced their Willow chip. 5:04 Um, it said that a quantum breakthrough, and we saw a bunch of people have different takes on it. What is your take on the Google chip news, and maybe put in context of the bigger quantum discussion? Yeah. 5:17 So up until this point, it really does feel like we've, uh, been working with sort of like early quantum computing in that, uh, it's, it's basically like the vacuum tubes and relay computers of old, right? 5:36 Like of the nineteen forties and fifties. Uh, we're, we're, we're using mercury delay lines and that sort of thing. Um, uh, if, if you know your old computing history. 5:47 Like, like the old, like Turing, Alan Turing computer- Yeah...from the movie. That- Yeah...that kind of thing. That kind of thing. That old style. Yeah. Yeah. 5:53 Like, uh, uh, lots of wires and lots of physical components that you can touch with your hands and, uh, uh, often have to service, right? 6:02 So like one of the, uh, earliest, um, uh-Computers was called the AN/FSQ-7, and it was a military computer that, uh, used about ten or twenty thousand different vacuum tubes, and f- it had to be serviced every now and then. 6:20 Like, like you had to go into the computer and replace certain parts. 6:25 And you see people doing this with quantum computers, where they actually have to take out the, like, the cover of it and go in and play with the wires. 6:37 And it just reminds me so much of, like, the old, you know, approaches, uh, towards computing back in the '40s and '50s. And so, um, the reason I bring that up is because it really does seem a lot like the Willow, uh, 6:53 development is essentially, uh, the point where we went from using vacuum tubes to the point where we have a transistor. Like William Shockley's, uh, like, innovation, right, of, of an actual, like, PNP junction. 7:09 And, uh, uh, this is like, you know, still like something that, like, goes in, like, a little tin can, and, uh, uh, it's like, like early transistors were about this big, and they had three wires coming out of them. And, 7:24 uh, that's kind of where we're at right now is, is I think the-- We went from, you know, having a certain amount of qubits up to a hundred and five qubits now, and those a hundred and five qubits can work together using what are called el- error correction codes to act as a single unit, uh, where it goes from being physical qubits to a logical qubit. 7:50 And that's when things start getting a little, um, interesting because then all, all it is is a scaling problem. And, uh, we've gotten really good at putting transistors on chips and, uh, details on chips. 8:06 Uh, these are, uh, eh, qubits, for example, are held in what are called Josephson junctions, um, but that's also getting into the weeds, so. Yeah, well, that's getting in the weeds. 8:15 I k- so it's kinda like we're going from the vacuum tubes to an- the, uh, what I think modern-day hardware still kind of uses, which is types of transistors. Right. 8:28 Um, I also he- I, you know-- You also say error correction, and does this get into the topic of, like, noise when, um- Right... 8:35 like talking about quantum-- This might be another kind of good follow-up to explain this concept of noise when, uh, talking about quantum computing. Right. 8:46 So th- any little thing like a vibration or, uh, like, uh, uh, uh, like, uh, a radio wave, things like that, they, they all have to be kinda isolated from, uh, the, uh, external environment, and that's one re-reason why they're, uh, the chips have to be cooled to super cold temperatures, basically almost as close as we get to ab-absolute zero, colder than space. 9:10 And, um, 9:13 yeah, so, uh, essentially noise i-is a, a product of external vibrations, could be external phenomena, radio waves, that sort of thing, and they can cause an entangled circuit to, uh, decohere. 9:32 They, they call it decoherence. And so, um, the, uh... 9:39 And, and what, what, what makes quantum computers special is that they're able to entangle these quantum bits together, uh, t-to the point where they have th-they share the same state, um, until they're read. 9:54 And then when they're read out, uh, there's, uh, like a, a collapse of the wave function basically, which is a term that's borrowed from multiverse theory. 10:03 And in the latest, uh, Google Willow paper, they said that this aff- basically affirms the notion that quantum computers exist within a multiverse, and they parallelize computation across multiple universes, and then the most likely, uh, solution, uh, collapses into, like, the actual what we read, the, the result that we read from the chip. 10:31 And so the more qubits you get, especially the more logical qubits you get, you can start modeling complex systems like, um, like, uh, uh, elliptic curve cryptography. 10:46 And, uh, in particular, you don't even need to model the entire, uh, process of, of, of turning a private key to a public key. Instead, you're going from a public key to a private key. 11:01 And the way it does this is that it searches through this like, this what they call Hilbert space, which is like the whole problem space of every potential possibility. 11:11 And it-- then the quantum computer is able to find, arrive at like, uh, a, a close enough solution. 11:19 And so long as, uh, we can check to see if, you know, that number goes back to a private-- a public key that-- and it matches the public key, then you found the private key. 11:30 And so, uh, that's, that's a huge, huge problem for elliptic curve cryptography because it, it relies on this assumption that doing that particular thing is quite hard, quite computationally expensive. 11:43 And, uh, unfortunately, uh, quantum computers kind of break that rule. They, they're able to optimize these problems to the point where they are solvable within, uh, days or hours or minutes. 11:58 We're gonna come back to this concept of, like, a quantum comp-computer breaking elliptic curve cryp-cryptography and how that applies to Bitcoin. 12:07 I think I wanna, um, again talk aboutQuantum at a high level and just talk about it, um, the urgency with which we should or shouldn't, um, actively look at solutions or mitigations to things that quantum would break. 12:26 Um, uh, like, how urgent is it that we start talking about quantum? Like, um, w- I've, I've heard people be critical of, uh, this saying, "Well, it's never gonna happen. Quantum's a LARP. 12:40 We don't-- This is not really a thing we need to be concerned with." Um, but, uh, yet it seems to me that there is some material reason, like, why we should be discussing this. 12:55 Um, like, could we wake up next week and, and see that, like, something about Bitcoin or just cryptography in general is broken from quantum? What's your take on this? 13:05 Well, I'll tell you who is concerned, like really very concerned about this quantum threat to the point where there's laying out roadmaps and deadlines and like, "We need to be ready by this date," and that's the US government. 13:19 And they, they have a specific date in which they want to phase out elliptic curve cryptography entirely, and they also have spec- wh-which is the year twenty thirty-five. 13:29 Uh, they also have, um, like, uh, roadmaps towards the transition to post-quantum cryptography. Uh, they sort of go from like twenty twenty-nine to twenty thirty-two. And, 13:44 uh, so if we want Bitcoin to be at least as secure as the government expects their own systems to be, then we basically have five to ten years to, uh, catch up. 13:56 And there's -- I, I, I think what, m- you know, like if you're just looking at the writing on the wall, if you're just looking at what the government is doing, then it's pretty clear that they know something we don't. 14:08 Uh, and, you know, they, they, they've been working on this problem too in parallel. I've met, uh, engineers who work for Raytheon who are working on the quantum problem. 14:19 This is a, a defense con- prime contractor, and there's also a company called In-Q-Tel you may have heard of. 14:25 They're, um, essentially the private, uh, branch of the CIA, and they invest in quantum computing projects all the time, like Rigetti and IonQ. And so, um, like, there's definitely a lot of, uh, 14:41 you know, they, they, they call it spooky action at a distance. This is just spook action right here, like [chuckles] right at home. 14:47 [laughs] And, uh, so, uh, I, I, I'm just saying that, like, there, there are things that w- neither of us have the need to know, and, uh, unfortunately, um, 15:04 like, we, w- as civilians, we, we, we really just can't know and, uh, uh, for whatever reason, for better or worse. And as a result, like, you know, like, 15:16 really the, the point I'm trying to make is that, uh, if the government is worried, then we should be worried. 15:25 So let's get into how this applies to Bitcoin 'cause, like, um, I, I mean, I -- One of the great responses, well, you know, if, if quantum breaks Bitcoin, then it breaks a lot of other things too, and yeah, that's true. 15:38 I think it's important, it's an important point to make. But I wanna, like, try to flesh out and qualify and differentiate the different ways that, uh, quantum could challenge different parts of Bitcoin. 15:51 I think you actually do this pretty well in your, in your, uh, proposal, 15:57 um, because I think a lot of people just kinda say quantum as this big boogeyman, and it's like, and it's just this one mo- you know, single dimension type thing. 16:06 But when we get into, like, how it would actually break certain components of Bitcoin, then I think we can have a productive conversation about this. 16:15 Um, can you -- Yeah, can you describe, um, maybe the different ways or dimensions that, uh, quantum could, uh, challenge or the, the different dimensions that Bitcoin may be vulnerable to quantum computing? Yeah. 16:31 So there's two ways that we know that Bitcoin is vulnerable. Uh, one is, uh, the hash function SHA-256 or, uh, as it's used in proof of work, uh, double SHA-256. Um, that actually doesn't complicate things much further. 16:49 They're, uh, if it's, if it's just hashed twice over, um, it, it might add like a little bit more complexity, but, uh, it's really like the number of bits is what you're worried about, and two fifty-six is quite a few bits actually, when we're talking about hash functions. 17:06 Uh, there's an algorithm called Grover's algorithm, and it can essentially, uh, reverse the inputs to the black box function to a black box function. 17:17 And so, um, it's, uh, if, if you imagine like, you know, SHA-256 as a black box function that where it has like inputs like the preimage of, you know, the block template and the header and that sort of thing, uh, and, uh, and then you have the number with a bunch of zeros, then, you know, there might be a way to optimize that with, uh, either Grover's or another algorithm called BHT that, uh, allows you to, like, come up with the hash collisions, basically. 17:48 And so, um, that said, uh, Grover's, and BHT is based on Grover's, uh, they, um, th- these algorithms don't scale very well. 18:03 Uh, like they're, uh, whenever you add another bit, um, it's certainly like, uh, is s- it's an improvement overWhat a classical computer would do, would need to do. 18:19 But as far as qu-quantum computers go, it's a more computationally intensive algorithm to deploy than what's needed to break elliptic curve cryptography, which is a completely separate thing. 18:32 Like hash, hash and- hash functions are considered to be more computationally e-expensive for quantum computers to break, and as a result, they also are, um, uh, considered to be more quantum resistant hashes. 18:50 Uh, whereas, uh- a-and, and let's also acknowledge another thing about proof of work. 18:55 Uh, you know, like, like when people say, you know, uh, it will, quantum computing break Bitcoin, and people are like, "Well, no, uh, proof of work, like a fifty-one percent attack still requires an extraordinary amount of computing power." 19:10 And like quantum computers aren't gonna be so efficient that they're gonna just completely displace all the, you know, hash at once. 19:18 And so instead what'll probably happen is miners will aug-augment their fleets with quantum ASICs or something like it and, you know, they'll, they'll just upgrade. You know, like it'll just be an upgrade function. 19:31 And like that, that's, that's, that's true. Like, like that's, that's like a common point I've, I've heard against quantum computing and it's like, no, no, they're, they're, they're not wrong. 19:40 That's probably gonna h- be how it plays out. But before that, [chuckles] uh- Well, I, what I hear is a, what I hear is a quantum ASIC. 19:47 So like we've got the S19, S21, and then we're talking like an S100 and it's the, you know, Bitmain's pioneer quantum ASIC. This is the reductionist future, which actually is pretty cool to me, so. Yeah. Uh, yeah. 20:02 It's, it's meant to be, uh, deployed, uh, in vacuum on the moon. Yeah. So. That, that's where we get the whole space mining idea. Right. Um- Well, like space mining doesn't necessarily make a ton of sense because- Wait. 20:12 [chuckles] Uh, there's like the thermal- This might be out of scope, but I, [chuckles] I know, but I know it, yeah, the heat is- Yeah, well, the, the, the thermal, uh, the thermals of that is, is more difficult because, uh, not only do you have to collect your energy from solar arrays, but you also have to radiate it. 20:26 Uh, and, uh, so any, any energy you get in, you have to put out in space. However, on the moon, that's a different story. You can actually do what's called the selenothermal heat rejection. 20:37 So it's like kinda like geothermal, but on the moon, and you can just have water coolant loops just like injecting heat down into the lunar, uh, uh, soil. 20:48 And, uh, um, and also heat is, is also quite, quite a bit of a commodity on the moon also. Yeah. Uh, we, we've had like, um, uh, lunar rovers like just break because they get too cold. So. Yeah. 21:02 Well, Hunter, this is out of scope. We gotta get back. [chuckles] We gotta get back to the quantum. [laughs] Well, you know, like off, off, off-worlding hash rate is gonna be a thing, you know? 21:11 [chuckles] Okay, so, so, so my-- what, you know, to again, to hand wave like Bitcoin mining really not for the foreseeable future, like a, a significant cause for concern in a quantum, 21:24 you know, and we don't consider it as quantum vulnerable. But you're talking about, um, the cryptography that secures, uh, a lot of Bitcoin, the public/private key, uh, cryptography. 21:40 Um, explain-- Let's do an explain like I'm five version. You have explained it a couple times already, but like 21:46 I wanna try to, yeah, uh, for, for the listener who really doesn't know like the whole -- they know they, they've got their, their seed phrase, right? 21:55 And they're like, "I've got my seed phrase, I've got my Bitcoin, I'm self-custoding." 21:58 Like they, let's say the user knows that part, but what do you -- like explain what you're talking about when we, when we talk about quantum could break this cryptography. Yeah. 22:10 So to get from your seed phrase to an address, for example, uh, these are like, uh, two things that Bitcoiners are quite familiar with, uh, at a high level. To get from a seed phrase to a, 22:25 uh, address, you need to go through this whole process of, first of all, the seed phrase goes through, uh, what's called a password-based key derivation function, and 22:38 it basically hashes the shit out of your, um, like your, your words, and, uh, then it'll result in a number, and this number will then put it through, uh, this is, this is going from what's called BIP-39 to BIP-32. 22:56 And Y- BIP-32 basically specifies how you take this number, the seed that you get from, uh, the PBKDF to go into what's called a HMAC or a Hash 23:08 Message Authentication function, and that is a five hundred and twelve-bit number. And so then you go from that HMAC to, uh, es- essentially, uh, something called, um, 23:25 hierarchical deterministic key derivation, and this is then using what's called a descriptor. 23:34 And a descriptor i-includes like the network, uh, whether it's testnet or mainnet, uh, what account you're using on your, like, your hardware device, uh, and then also whether, uh, your address that you're generating is going to be f- used for receive or change. 23:59 And then finally, the address index, which is, uh, like what, at what point in, like what, what list of, like you, you, uh, BlueWallet will show you sometimes a list of all the different addresses your wallet generates. 24:16 Uh, and- Claro's really good at this, and this is also similar for the Ordinals folks, when you have your x verse and you keep creating new wallets, those are just addressesThey're in the same, there's br- you know, s- by the same private key, so you're talking about that kind of mechanism. 24:31 Yeah, exactly. And so each one of those then gets hashed again, and this hash is then, uh, th-this produce -- This is actually the private key. 24:45 And then when you go from the -- In order to go from a private key to a public key, you need to, uh, multiply it by i-in a certain way, in a s-specific way. 24:59 Uh, but this is defined in what's called the, uh, Secp256k1 signature algorithm. Uh, and, uh, this is a, a, uh, specification for elliptic curve cryptography. 25:14 And, uh, it, there, there's like -- they're like a, a group for, for built, for, for actually developing this and, and that's where the Secp comes from. 25:24 And then, uh, two fifty-six is the number of bits of security that this, uh, s- uh, elliptic curve cryptography provides. And, um, and then, uh, K1 stands for what's called Koblitz curve. 25:42 And so this is, uh, uh, basically the fact that, uh, the parameters for the elliptic curve, uh, are calculated in a way that seems mathematically sound. 25:57 Whereas there's another version of Secp which is called Secp256R1, and it's also known as, uh, P256, I think. And it, uh, 26:11 uses suspiciously picked, like, what they call random constants. Finger quotes for listeners, he's saying finger quotes random. Right. Yeah. [laughs] Yeah. Finger quotes random constants. 26:23 And, uh, they, uh, these may have been chosen in advance by, uh, organizations like the NSA. Uh, and so, 26:37 um, and what's so funny is that, like, no web browser uses Secp256k1. It's not NIST approved. It's not, like, standardized. 26:51 It is like this, like it exists in, in sort of like this, like, uh, uh, how would you say, um... It's, it's, it's, it's like even kind of, uh, excluded by cryptographers like, uh, Daniel J. Bernstein. 27:09 And so, uh, he, he's a well-known cryptographer who, who, uh, worked on, uh, some cryptography for Google, and he also later worked on a post-quantum cryptography, uh, signature algorithm called SPHINCS. And, um, 27:26 so he's, he's, he knows his stuff, and he, he ranks Secp256k1 slightly lower on his SafeCurves website than, you know, uh, his favorite algorithm, which is, uh, based on Edwards Curve, uh, Ed25519. 27:45 And, uh, this is, uh, this elliptic curve is, is often used for like encrypted communications, like Signal uses it. Uh, and, uh, at least, a-and also I think, uh, Monero uses it, um, or some, some version of it. 28:01 Uh, but it's like, it's like it's, it's, it's kind of like, uh, uh, favored by cryptographers, whereas, um, Secp256k1 kind of stands on its own as like this unique curve that nobody uses, that's not standardized, that Satoshi picked. 28:17 And, uh, for some reason, it just kind of, it's, it's stuck with Bitcoin. It's worked pretty well so far. 28:24 And, uh, so I, uh, I, I, I think that, you know, that's, that's, that's an interesting background for like why we use this algorithm. And, 28:38 uh, what's interesting about, uh, uh, like the transition to post-quantum cryptography is that NIST has been leading these rounds of communication. 28:49 And so, um, of, of like evaluating these, these post-quantum cryptography algorithms, and they, they're, they're often kind of, uh, very -- It requires a, a very specialized cryptographer to understand the mechanisms behind it, the mathematics behind it, how it, it defers a great deal from, uh, like, like there's a number of different approaches based on either hashes or lattices or lattice cryptography. 29:19 Uh, there's even newer stuff called, uh, super singular elliptic curve iso-isogenies. And isogeny fields are, uh, basically like higher order elliptic curves. 29:32 Uh, and, uh, they use cr- what are, what's called a quaternion to encapsulate these, uh, these, um, like s-signatures and, and public keys. 29:47 And so, um, and, and we, we-- i-in the, in the BIP, we've sort of, uh, uh, picked from... Th-there's, there's, there's dozens of these algorithms under development or, or that have been developed. 30:01 And in the BIP, we've essentially, um, chosen four. We've narrowed it down to four, uh, based on various criteria. And, uh, some, some of these are controversial, some were less controversial. 30:15 Some of them are like, use more memory, use more space on, on the, uh, uh, on, on the blockchain, and they also use more, uh, computational power. 30:27 But, uh-Conversely, um, some are more experimental, uh, one of them is not even approved by NIST just yet. And so, um, it's, uh, it, it really is like, uh, we don't know for sure 30:44 what'll be the gold standard and also what is the best for, uh, use with Bitcoin, and so that's what we have for, and we're, we're essentially going to let the market decide what they want to use and what they wanna spend, uh, to, uh, secure transactions. 31:03 So you started out explaining like I was five, and you ended up s- explaining like I was a doctorate in- [laughs]... uh, [laughs] in, in quantum. 31:11 But, like, uh, I-- this, this is pretty interesting 'cause, 'cause you say basically we have to figure out a different hashing function, uh, to which is quantum resistant to secure- A, a different signature algorithm actually. 31:26 It's, it's, it's different. To interact, okay. Yeah. So, like, hashing functions are-- SHA-256 is actually pretty decent as far as- Yeah... post-quantum cryptography is concerned. 31:36 Um, it's, it's, it's the problem is that there's, there's this other algorithm called Shor's algorithm, S-H-O-R, that can be used to, uh, like, r- essentially provide the reverse of a public key. 31:53 That's, that's the, that's the simplest way I can put it. And, uh- Gotcha... it, it, it does this by factoring numbers basically, where, uh, there's something called the discrete log problem, and, [lips smack] 32:04 uh, essentially it says that it is hard for, uh, for classical computers to factor the original numbers that were used to multiply into a very large number. 32:16 And so, uh, there's a lot of information lost there whenever you multiply two big numbers. 32:22 And so finding the original number, especially if it's as large as, as, uh, two hundred and fifty-six bits, which is a number that's larger than the number of atoms in the known universe, then, uh, finding that, like, the private key that corresponds to a public key is, is actually highly improbable and very difficult to find if you're brute forcing, unless you have- But-... 32:43 some other optimization mechanism. Yeah. But with quantum, we could theoretically, depending on the signature algorithm, could reverse engineer that. I use the term reverse engineer. 32:56 Is that even a useful, uh, definition in this case? Yeah. I mean, like, I haven't heard of a good, uh, 33:08 nomenclature that is standardized, uh, for that process. 33:15 Um, I, I could look into it more, but basically, uh, for lack of a be- better way of putting it, uh, yeah, it's, it's just like the finding the original, uh, private key, uh, to a public key. 33:28 So you, you can kind of consider it as reversing that function. [clears throat] Okay, so that gets us into, um, some of the meat and potatoes of, like, what specifically, uh, your BIP and what specifically is at risk, 33:45 um, in, uh, for Bitcoin, and then gets into, uh, exactly what you're proposing. 33:53 You are saying there are certain signature algorithms, there are certain types Bitcoin held in certain addresses or by certain public keys which are more vulnerable to quantum, uh, computing. 34:07 You call them cryptographically relevant quantum computers, or CQR- Cryptoanalytically, yeah. Re- Cryptoana-cryptoanalytically relevant quantum computers, and you say 34:18 w- that we, that we at least, we, we can with high probability say that this, these Bitcoin held in these addresses is probably more vulnerable. And, and you're saying we can upgrade through a soft fork, um, 34:34 the cryptography used to generate addresses so that it is theoretically quantum secure or l- not quant-- not vulnerable given our known, given our understanding of cryptography. Um, 34:49 can you give me a little more insight and context, um, on the, like, what Bitcoin is vulnerable and why? Um, I know you, I think you said there, I'm looking at the BIP, you have, I think, four types of addresses. 35:05 Can you explain those a little bit? Yeah. So, uh, there's four different address types that we've outlined that, uh, like we, we basically explain some are safe or some are vulnerable. 35:20 [lips smack] And then there's also four different scenarios in w- in Bitcoin where, uh, uh, essentially a public key may be exposed. And so whenever a, a public key is exposed, that's when w- we're in the danger zone. 35:36 And, [lips smack] uh, so early pub-- e- early addresses were essentially a public key encoded as the, uh, locking script or what they call the s- the script pub key. But, um, 35:54 that, uh, uh, uh, essentially is, um, yeah, like the entire public key, uh, all sixty-five bytes of it, uh, available for anybody with a quantum computer powerful enough to, uh, take the funds in those addresses. 36:11 Then there's, uh, Taproot, which is far more recent, but it's a thirty-two by X only public key, and so it's kind of like a 36:24 just the X coordinate, but it's easy enough to find the Y coordinate that corresponds with the X coordinate. 36:29 And so it might as well be, for all intents and purposes, a fully exposed public key as well.And, uh, that said, there are, uh, public key hash 36:43 addresses, and those are considered quantum resistant because as I said earlier, hashes are considered quantum resistant, and so, uh, to some degree at least. And, uh, so there's the, 37:01 there's two more common of the public key hash address types. There's the, um, ones that start with the number one and have just a bunch of like alphabetical like number letters encoding. It's called Base58 encoding, 37:19 and this is also known as a legacy address. And then there's also native SegWit addresses. 37:27 They start with BC1Q and have a much limited, more limited character set of thirty-two characters, and so they look kind of different. They don't have like capital letters, for example. 37:39 And, and so ballpark- And those are, those are safe. Gotcha. 37:43 So, uh, you know, for anyone who's listening who's kind of made it this far, they've trudged through some of the technical discourse, give me like a one-liner which is like, so how much Bitcoin is at risk? Uh, about 37:58 it could be somewhere between two to four million coins. Which would be like ten to twenty percent of Bitcoin, a lot, a lot -- the lion's share of which is probably, uh, Satoshi's, mined by Satoshi, right? Mm-hmm. 38:14 Which will get us into, uh, I think a good way to, to wrap this up. But I wanna go into, you've, you talked about, um, like taking Bitcoin in these public key hash addresses 38:31 and, um, again, kind of reversing, uh- Not, not the public key hash addresses. Or the, the, sorry, the legacy addresses. Mm-hmm. And you can- Well, no, the, the legacy addresses are fine. 38:44 It's, uh, anything that has the public key exposed, so that would be the pay to taproot, and that would be the pay to public key, the very old addresses. Yes. Pay to, pay to public key. Correct. 38:54 That's what I'm thinking of. Yeah. Okay. So pay to public key, um, we could -- that would be a lot of Satoshi's Bitcoin. Um, we can probably derive a -- quantum computers could derive a private key from that. 39:05 Um, that would be a long-range attack. I was not a -- I hadn't really considered, I didn't, I wasn't aware of this, uh, short-range attack model until I read through your BIP. 39:16 Can you explain what a short-range attack is? 'Cause I think that might help differentiate additionally. Yeah. So that's when, that's a -- so there's, there's four scenarios in which your public key is exposed. 39:28 Uh, one is if you're using a very old address from, you know, twenty ten or so, if you're using pay to taproot addresses, uh, to secure coins, it's not a good idea because, uh, the, the public key is there. 39:42 Um, then there's also whenever you spend your coins, they enter the mempool, 39:50 and, uh, any, uh, whenever your tr- transaction's in the mempool and it hasn't been confirmed yet, that's gonna be a period of time where a quantum computer with sufficient power, this is like a much more powerful quantum computer than is needed to get at Satoshi's coins, uh, the, then, 40:10 you know, it, it, it might be able to redirect where your transaction's going. Uh, but, um, that -- we haven't seen that ty-- kind of, kind of a-attack just yet, uh, I don't believe. 40:22 We can't really know for sure, but it's, we're not, we're not quite in that ter-territory yet. 40:27 Uh, it's also unclear if that, if, if it's been done with any of, um, early coins, certainly not just Satoshi's coins because we, we noticed that there's a, a sort of pattern that his, uh, coins kind of follow. 40:42 Uh, though this is somewhat controversial, but, uh, a lot of people acknowledge that the Patoshi pattern is how we can identify which coins were Satoshi's, and we haven't seen those coins move just yet. 40:53 But, uh, there's also some game theory involved in just like if you had a quantum computer, you know, which one, which, what do you do with it and that sort of thing. Yeah. 41:01 And also, if the government has a quantum computer, they're probably gonna have a different, uh, idea of how to use it than, you know, uh, a civilian q-quantum computer. And so, um, 41:13 there's, there's a number of considerations there, but, uh, ultimately, uh, the, uh, the, the, the, the third case, uh, where you, is, is where you, uh, expose your public key is when you, when it enters the mempool. 41:29 And then finally, the fourth case, the fourth scenario that, uh, a public key will be exposed is once the con-conf-- the, the transaction is confirmed. 41:39 If, uh, like basically you, you've, you've already exposed your public key, it's in the signature now, so it's used to validate the transaction. And the, uh, the big, the big concern now is, uh, um, 41:57 if you were to ever spend -- So y-y-- if, if you were to reuse that address in the, and, and, and by essentially, uh, receiving funds to it, spending from it, and it gets confirmed from the mempool, if you use the old address again, 42:13 then that public key is already known, and so that, that address is not quite safe to use at that point. 42:20 And it's also not a good idea from a privacy standpoint because that associates, uh, additional outputs with the same address, so it's kind of like, uh, providing more information to chain anal-anal-analysis. 42:32 And so Bitcoiners are generally pretty good about address use because we know, we've been told from basically the get-go by Satoshi not to reuse addresses. 42:41 And, uh, so-Uh, it's, it's, it's interesting how, like, the early guidance and also the default of, you know, where Satoshi's coins go, uh, kind of preve- prepared us in some ways for the advent of quantum computing. 43:00 Um, what I mean by that is, uh, and I, I don't know if you wanna go into this, but is, is basically Satoshi's coins serve a useful purpose during a tr- a quantum transition, which is essentially, uh, to, um, uh, 43:19 make -- So, like, ev-every-- if Satoshi's coins weren't all in one single address, so it's not like one big honeypot. 43:26 There's about 34,000 different addresses, uh, where they have about a balance of, uh, an average balance of about 50 Bitcoin each, and that was the early block reward. And, uh, v- from epoch one or epoch zero- Yeah... 43:44 I think we can just call it epoch one. Yeah, so- Yeah, the first epoch. Yeah, let's just call it that. 43:48 And so, um, uh, and what's interesting is that because they're all spread out, it will take a quantum computer some time to get through them. 43:58 And for anybody transferring less than 50 Bitcoin worth of value in a single address, then they're kind of shielded, 44:06 uh, at least from a cryp-crypto economic standpoint, uh, by the fact that there are other coins that are more valuable, that are, that are sort of like, uh, um, uh, uh, like a m- a, a more valuable use of their limited quantum computing time to attack than, than they would be to attack your coins. 44:29 So there, there's just a bigger -- So it kind of, like, insulates us or gives us a little bit of a, a warning ahead of time 'cause Satoshi's created a bigger honeypot for a quantum computer than my own pitiful 2,000 Satoshi stack output. 44:44 Mm-hmm. Exactly. Yeah. 44:48 And what's, what's also funny is that, uh, like, things like ordinals, uh, are probably also kind of exempt or runes because they're on these, like, dust outputs that don't, you know, have a lot of value from, like, an on-chain standpoint. 45:05 Uh, so, like, if some, some, you know... 45:09 Like, th-those would probably be some of the, the last attacked, um- Well, well, you say that, but I'll, I'll provide a counterpoint here, which is, uh, ordinals people tend to reuse addresses the most and tend to do pay to taproot. 45:23 Yep. And so that would require that a quantum computer or quantum attacker be ordinals aware- Right... 45:30 and have s- awareness of secondary market pricing so they could see, well, there might only be 50 outputs, ea-each worth 546 sats in this address, but- Yeah, but by the, by the time we're at that point, like, they're gonna be scraping the bottom of the barrel, basically. 45:45 Yeah, exactly. They're gonna be trying to extract value from other, in other ways than just, uh, uh, taking coins that are on chain. 45:52 I'm just imagining a, a scenario where a quantum computer is trying to, like, look at the secondary market pricing of, like, a Bitcoin puppet [laughs] and being like, "Well, we could- Or Quantum Cat. 46:02 Yeah, we, yeah, Quantum Cat. We, well, we could get, buy, you know, attack Satoshi's coins, or we could get this big Quantum Cat's whale address. [laughs] Yeah. Yeah. 46:13 Um- It could, could amount- Uh, yeah, so I mean, that -- So, uh, I mean, there have been, I think, some, some people who have floated -- Th-this is where we get into the controversial, the two controversial thing, things about quantum, which is 46:27 various approaches to Satoshi's coins and the, or quantum witness data discount topic. Let's do the, the Satoshi coins one first, which is, um, some people have said, "Okay, well, what if we see Satoshi's coins move?" 46:38 Now, this is not just in the context of a quantum computer, it's also in the context of other scenarios, but, like, some people have suggested various things on, along a spectrum of, like, how permissionless and open do we feel Bitcoin? 46:52 Some people think, have said, "Well, the community, hand wave, could just refuse to accept or spend those coins." I don't know. What do you think of, uh... Have you seen... 47:05 I guess my actual question is, have you seen any compelling, um, proposals which don't sound insane for handling how Satoshi's, uh, Satoshi's, uh, quantum exposed coins? 47:23 Uh- Well, a-as I said before, like, Satoshi's coins serve a useful purpose, so if we were to compromise their capability to be spent, then that just, like, tightens the, like, the, like, it makes it, makes it sort of, uh, harder for plebs to transition. 47:41 It just gives them less time, and so, um, I, I'm opposed to it from that reason alone. But also, uh, uh, people have just said that it's, it has a sort of confiscatory, uh, like, heavy-handed, like, uh, 47:58 like, approach towards solving that problem. And, uh, actually, what's funny is that Vitalik's solution for Ethereum basically involves that. [laughs] Like, not only, not only do they wanna, like, 48:14 hard fork Ethereum to the point where they... 48:18 This is, like, before the quantum emergency, so they're just gonna reverse all the transactions till, you know, they realize, like, like, like to the point where before they, they realize that funds have been taken. 48:29 But also, uh, they wanna disable all the private key, uh, uh, basically every private key. 48:37 Like, um-They, they, if, if you use a private key to access your funds, then like, like a, like a JSON file or something like old school, uh, before they had seeds, like mnemonic seeds for MetaMask and stuff, uh, then you're, you're kinda SOL. 48:57 And so, like a lot of smart contracts, a lot of bridges, like just like it's gonna be a whole freaking mess, and yeah, so- That sounds a lot to me like, uh, very reminiscent of the ETH DAO hack in- Yeah... 49:10 I think in twenty sixteen, which is like- Yeah... oh, well, shoot, uh, well, we can, we can socially coordinate this out. Um, we're gonna roll things back just 'cause that stinks. 49:21 Whereas you and I, I would say probably most Bitcoiners would say, "Well, that's just how it is." Right. We're pretty -- We're die hard to the openness of the system. Right. And yeah. 49:33 Like ultimately, ultimately it's, it's not your keys, not your coins. That's like the fundamental rule of Bitcoin. And so, uh, if somebody else is able to f- get your keys, then 49:48 there's, there's been some miss, there's been a failure in operational security somewhere. And so, uh, and of course like this one complic- additional complication operational security is quantum computing. 50:02 And so, uh, if, if, if there's like one thing that viewers or listeners should understand is that, uh, uh, they should keep their coins in native SegWit addresses, which are hashed public keys, and they should never reuse an address. 50:21 And if there is a qu- a period of quantum emergency, ideally they have fewer than fifty Bitcoin per address or per wallet, um, uh, because wallets oftentimes consolidate UTXOs and consolidate addresses into change outputs that could be larger than fifty Bitcoin if you're, uh, so, uh, well-capitalized. 50:43 Uh, but, uh, finally, um, if, if that, if, if there is a, if you are caught with your, uh, proverbial pants down, then essentially what you need to do is you need to take your transaction where you're spending your tr- your, you're moving your coins to a new quantum-resistant address format that we specified in the BIP called, uh, uh, pay to quantum resistant hash or P2QRH, so it's just BC1R. 51:09 Uh, and we, we wanted to start with R 'cause it's, it looks like it's resistant, so it's easy to tell that this is a resistant address. And, 51:18 uh, if, if you're going from, you know, if you're, if you're, you're moving your transaction, you have to take it, 51:25 you ha- you basically have to take it directly to a miner you trust that's not going to try to take your coins, but instead is just gonna mine your transaction in a, in a private mempool, that they're going to insert your transaction in a block that they have the right to, to mine, and then it'll be mined in this block, and, uh, then, um, your, your public key will have been exposed, but the key, the coins will already been spent to a safe address. 51:55 And so, uh, then you're good and clear pending barring any kind of, uh, reorg activity. But, um, yeah, so, uh, which, which is usually quite rare. So, um, yeah, the, uh, uh, 52:11 ultimately I think, uh, miners will have a big, big part to play in the transition. 52:17 Just, uh, uh, there might even be like fraud proofs that people will try to, uh, like create around transactions that have been submitted to mining pools so that 52:29 y- you can detect and prove if, uh, a transaction you submitted has, um, essentially, uh, been, um, uh, sort of, um, 52:45 uh, taken from, from you by a mining pool that's sharing your transactions with, uh, a quantum attacker. 52:54 And so, uh, like we've, we've definitely thought through like all these different scenarios and but like ideally, ideally the, the, 53:04 the ideal s- scenario is that we get ahead of this, uh, eventuality, and we just be very well prepared for, uh, deploying a soft fork, if not already having one activated by this point, and then people will, you know, start moving their coins to the new address type. 53:26 Uh, whether this will happen, it's, uh, hard to say, but one thing I can say is that two of the biggest, uh, people to-- like the, the two stakeholder classes that have the most to lose from a quantum emergency are gonna be exchanges and investors and, uh, mining pools and miners. 53:45 And so, uh, 'cause oftentimes miners will reuse addresses, they'll, they'll mine to the same address all the time. 53:51 And, uh, and also these exchanges, cold wallets, like Binance is a cold wallet that has a quarter million Bitcoin in it that they've already spent from. 53:58 And so, um, and, and oftentimes these exchanges will post these addresses as sort of a proof of reserve so that, uh, like, you know, p- people know they have the coins there. 54:10 But the problem is it's also a huge honeypot for quantum computing. 54:14 Uh, though, you know, m- you might not take those coins to begin with because you don't want people to know you have a quantum computer just yet, so you don't wanna tank the market and that sort of thing. 54:23 So, uh, the only problem with using a quantum computer right now also is that you have no safe place to put your coins. 54:29 So, um, it's, it's kinda like one of those, those things where like we, we are definitely very early and, uh, to, to this, to this, which is good. It's a good place to be right now. Uh, we're not scrambling. 54:43 We're preparing. We have a plan.Uh, we have at least one plan that's hopefully viable, and so we're working towards it. There's a few other plans out there, but they're not quite as complete or well discussed. 54:55 Um, and yeah, so we're, uh... Like, there's, there's, there's sort of like, like, uh, uh, there, there, there is 55:05 cause to worry from, like, an existential standpoint, but so long as you practice the right, uh, sort of like operational security around your addresses and you're also just, um, uh, not doing anything too risky, you know, then you should be, you should be fine, uh, even after quantum emergencies 'cause these like, these, these, these little guidelines here and there that, you know, you just try to, uh, abide by just in case, you know, there is a, a big problem sometime-- someday. 55:38 So what's, what's funny is like all the, all the quantum fudsters, like the people who are like, "Oh, Bitcoin's over because quantum c- like Willow or something," it's like you're just like totally full of shit. 55:47 Like, there's, there's like we have a plan. We have, uh, eighty percent of coins are not vulnerable. Uh, you know, like there's, you know, like there's not a lot of reason to, to be super concerned. 56:00 Like, there's no way quantum computers will kill Bitcoin. Like, Bitcoin is antifragile, you know? Uh, there... And, and it secures two trillion dollars of value right now. And so, uh, there's... 56:10 It's not gonna be a point where [chuckles] we're not gonna like just do our best to, uh, get ahead of any kind of major threat to Bitcoin. 56:19 So, uh, that's ultimately, I, I, I don't think there's cause to worry, but there is, you know, um, a good reason -- there are good reasons to just want to get ahead of this whole scenario and ideally be proactive. 56:35 But even if we're not proactive, that's fine too, because we have Satoshi Shield and so, you know, like it's just ultimately, it's, it's not, it's not gonna be as bad as people think it will be. 56:48 Well, uh, maybe instead of the quantum, uh, witness discount, 'cause that's a little bit too big of a -- I think it might be too big of a, uh, topic to bite off for this podcast. 56:59 I might throw this back at you 'cause you, 'cause, uh, I think you characterize it pretty well, like 57:04 not terribly worried about quantum being this existential threat, but you say you advocate for being proactive about solving or addressing things around it. 57:16 Um, this gets into what I like to ask, I think, technical Bitcoiners at the end of each show, which is this gets into the, the bigger conversation of like, of soft forks in general, 57:30 and you seem to be advocating for a proactive approach to soft fork discussion ideation. But, um, I hear a lot of people say we should be reactive. 57:43 I had a conversat-conversation last night, which went something to the tune of like, well, there's not a lot of activity. There doesn't seem to be a lot of demand for, for Bitcoin self-custody. 57:51 Why would we pursue, um, a soft fork towards a covenant which would improve the custodial self-custody experience and landscape? Um, we can do that when we come to it. Um, but, uh, 58:08 you know, that is -- that's one view of, I would say, reactive forking. Where-- What are your thoughts on this, and does your proactivity limit itself to just quantum or thoughts on soft forks in general? 58:24 Well, there's two sides to it, right? One is like Bitcoin is securing two trillion dollars worth of value, so if we're gonna mess with it, like, you know, we better have a damn good reason, right? 58:34 Um, there's also the other side of it where like, well, 58:39 uh, there -- Bitcoin is securing two trillion dollars worth of value, but it could be c-c-securing far more value if we had these covenants, if we had this kind of like trustless, uh, approach towards, uh, self-custody and that sort of thing. 58:54 Um, I'm not sure if I buy that argument so much, but what I do buy is the argument that there -- Bitcoin's quantum vulnerability is probably going to be in a barrier to adoption by nation-states and, uh, big investors. 59:10 Uh, it, it oftentimes comes up in their quarterly reports, you know, as like a risk that they, uh, are considering. I think MicroStrategy even ha- mentioned it in one of their recent reports. 59:21 And so, um, yeah, it's definitely a thing on people's minds, and if we don't have a good solution for it, then yeah, it'll, it'll, it'll definitely be like a barrier to adoption. 59:31 And so, um, there's like, there's that reason for, uh, being proactive. Uh, but that said, I'm also sympathetic to the reactive people's camps because, you know, I mean, I want Bitcoin to be successful. 59:46 I don't want us to like accidentally shoot ourselves in the foot at the last mile here towards, you know, like full hyperBitcoinization, uh, fifteen years in, uh, sixteen year-- going on sixteen years now. 59:58 And so, um, you know, like 1:00:02 I, I, uh, I think it's important to have a measured approach to this and not be freaking out, just be doing our best to prepare and, uh, have the tools ready when they're necessary and-- or when the community decides they're necessary. 1:00:19 But ultimately, um, like we'll, we'll hopefully have ways to field this technology ahead of time, uh, so that, you know, we'll be able to have wallets be prepared to build all this in and, and they'll, they'll, um, it'll just be ready to tr- to, to move over once, once that occurs. 1:00:38 So, um, you know, I, I, I, although, you know, as the BIP author, I, I advocate for its activationUm, I'm not, like, gonna be, like, fear-mongering or like, you know, pushing this actively as, like, a thing people should be guilted into doing, right? 1:00:58 [chuckles] Like, like, no, there, there, there are good reasons for and against, uh, and a lot of people who are against are maybe just against right now, so, you know, it's not like, it's not like the hard no, like, "Not on my note," you know, that kind of thing. 1:01:10 So, um, yeah, it's, it... Uh, and I also just want people to, uh, understand that, like, I'm not, I'm not trying to, like, force changes on Bitcoin, not trying to get... not attacking Bitcoin territory. 1:01:22 I'm just trying to, you know, uh, offer a solution should it ever be needed. I think there's many people like that who, uh, have-- They love Bitcoin. They want to improve it. 1:01:36 They have a specific thing and vision that they think that they can provide, and they try to release it out in the wild, and a lot of us get bogged down by our own, uh, our own personalities or other people's personalities, such is kind of the case and a bit of the curse of being totally engaged in the Bitcoin discourse. 1:01:59 Um, yeah. Yeah, well, like we're, we're, we're ultimately financial doomsday preppers, right? [chuckles] Like, we, we have this, like, doomsday scenario in mind, which is hyperbitcoinization. 1:02:09 It's had, uh, that name for a long time now, and, uh, we're just preparing for that possibility or that eventuality or that inevitability based on, you know, what we understand of the debt spiral and things like that. 1:02:23 And so, uh, unfunded liabilities and the dollar matrix theory, just, like, it all kind of pointing to the fact that the dollar could die one day. 1:02:30 And Bitcoin is basically the i-ideal, in my opinion, the ideal, uh, solution to that. And, uh, like, I mean, not everything is, about Bitcoin is ideal, but it is the best we have so far. Let's just say that. And, uh, so, 1:02:49 uh, uh, as a, as a result of us being kind of like doomsday preppers and, and trying to envision this like, you know, potential future, [sighs] 1:03:00 we also have to be aware that, like, there are nation-states working very actively towards, uh, breaking the technology that Bitcoin uses, and, uh, so, uh, for, for, for whatever reason, not, not just to break Bitcoin, but, you know, they're, they're just building this technology as a sort of, um, arms race. 1:03:19 And so, uh, yeah, it's... 1:03:21 I-it is important to, like, have, like, your doomsday prepper hat on, conspiracy theory hat sometimes, you know, uh, and, uh, just, just to be, like, a little paranoid because, you know, they say only the paranoid survive. 1:03:37 Very well put, Hunter. I thank you so much for coming on Bitcoin Season Two, and I don't think this is the last time. I'm pretty sure, uh, we'll have another episode at another, uh, major point in twenty twenty-five. 1:03:49 Um, where can people find you and, uh, continue the conversation? Yeah. So you can find me on X, uh, I'm at, @crypticquick. Uh, you can also find me on Nostr. Uh, my Npub is Npu- Npub QQQ. 1:04:02 [both laughing] Uh, no, and then also, uh, uh, you can find my Nostr on, on my X, uh, and also on my website crypticquick.com, and you can ultimately please donate if you can, if you think this is, like, a, a useful endeavor. 1:04:19 We have a website, uh, surmount.systems. This is sort of the outfit and foundation that we're working, uh, and building this, this, this BIP under. 1:04:27 I have two other people who I regularly bounce ideas off of in this organization, and, uh, we're just trying our best to, you know, uh, come up with good solutions ahead of time. 1:04:38 And so if you think this work that we're doing is valuable, we have a silent payments address, and we have a BOLT12 address, and, uh, um, also accept Zaps and things like that. 1:04:47 So, um, yeah, c- uh, you know, like, like price signals matter, right? Like, if, if people really truly think this is valuable, then please, uh, you know, um, incentivize us to put more of our time towards it. Cool. 1:05:01 Thanks so much, Hunter. I'll see you in twenty twenty-five. All right. Thank you. [upbeat music]
