P2WOTS: 64 Slot Winternitz Signature UTXO's (Witness Version Three) #2194

This document proposes P2WOTS, a new native Bitcoin output type using witness version three. It provides post quantum security using only SHA-256, with no elliptic-curve key material anywhere.

The 34 byte scriptPubKey commits to a Merkle Key Tree over 64 independent WOTS+ one time key pairs (w=256, L=34). This allows safe address reuse where each spend consumes a fresh slot key without ever violating the WOTS+ one time property.

Single sig witness: 42 items (~434 vbytes) Native k-of-n multisig supported. Sighash follows BIP-341 structure with distinct domain tag. Full block verification overhead 736ms

Reference implementation against Bitcoin Core available and custom signet based on this code is live.

Requesting assignment of a BIP number!

@opus-lux Thank you for your proposal, but it was opened here prematurely, before community discussion of your idea on the mailing list (opening a PR here and then sending a mailing list post, as you have done, is the inverse). Please see the README and BIP 3 for the process (thanks!)

@jonatack Hey, I will wait for community feedback before resubmitting. Sorry for getting mixed up on the order of things!

ProfitProTip

<img width="658" height="658" alt="Image" src="https://github.com/user-attachments/assets/7f53b158-69fd-4a56-8712-10f7748afc8e" />