This is an Informational BIP that defines four exposure levels for existing Bitcoin outputs against an attacker holding a cryptographically relevant quantum computer: EXPOSED_AT_REST, EXPOSED_ON_SPEND, NOT_EXPOSED and UNDETERMINED. The first two are BIP 360's long exposure and short exposure vulnerabilities stated per output. The document adds the operational rules under BIP 360's per-type list: what counts as revealed, for which outputs, what to report when history is truncated, a fail-closed default, test vectors, and an informative appendix of per-level action keys that wallet developers asked for.
Scope: observation only. No consensus, policy or P2P change. It does not score risk and does not propose freezing or forced migration.
Discussion:
- Delving Bitcoin: https://delvingbitcoin.org/t/standardizing-an-exposure-classification-for-existing-outputs-pre-bip/2866 (murch suggested submitting as Informational; wallet feedback led to Appendix A)
- bitcoin-dev: https://gnusha.org/pi/bitcoindev/010001a06dd4cdd9-b8082042-8750-4e9a-917e-2053c919e4c4-000000@email.amazonses.com/ (conduition's review led to v0.3.0)
Reference implementation and 25 test vectors, CC0: https://github.com/duncan0k/pubkey-exposure-classification
Revision history since first posting: v0.2.0 tightened the derived condition; v0.3.0 separated attacker-spendability from holder-provability (conduition); v0.4.0 added Appendix A (GemWallet); v0.5.0 mapped the levels onto BIP 360's terms and corrected P2MR from NOT_EXPOSED to EXPOSED_ON_SPEND (murch's pointer to BIP 360 surfaced the error); v0.5.1 notes the pre-activation anyone-can-spend case for witness v2 outputs.
Disclosure: I used an LLM to help draft the English. The classification, the rules, the vectors and the mistakes are mine, and I answer for all of it.