Re: [bitcoindev] Algorithm Agility for Bitcoin to maintain security in the face of quantum and classic breaks in the signature algorithms

Matt Corallo
2026-02-13T16:22:16Z

On 2/12/26 3:35 PM, Ethan Heilman wrote:
>  Replying to Waxwing, and Matt in this email
>
> Waxwing:
> > If supply and demand is king, why not just delete supply as much as possible? No more mining?
>
> I agree with you that a soft-fork that simply burns outputs to reduce supply is unlikely to
> activate. I do agree with Matt's point given the specific circumstances here.
>
> Everyone would want soft-fork1. It freezes coins that would otherwise be stolen with the promise to
> unfreeze them with a planned PQ ZKP proof of seed phrase. Even the people whose coins would be
> frozen would want soft-fork1 since it protects them. This makes it very likely that if the threat of
> quantum theft is credible, soft-fork1 would activate and everyone would be happy with this result
> (assuming it activates in time).
>
> Now time passes, and the people whose coins are frozen want soft-fork2. They feel they have waited
> long enough, but there is a problem. While soft-fork1 was trivial to write, soft-fork2 requires a
> complex PQ ZKP that will become consensus critical to Bitcoin. This is a complex task requiring
> expertise. Will it actually get done? By whom?
>
> Assume soft-fork2 actually gets built. Now it has to get activated. Blocking a soft-fork is much
> easier than activating a soft-fork and this will be a particularly contentious soft-fork.
>
> Some will argue it is unfair that holders who did the right thing and upgraded to secure outputs
> will be forced to on the consensus risks of a dangerous soft-fork simply to unfreeze coins that the
> original owners didn't even bother to secure. Others will just stall soft-fork2 by saying it hasn't
> been tested enough or there isn't consensus. Making this worse, miners are unlikely to want to
> increase supply. Getting miners to activate soft-fork2 is much harder than soft-fork1.
>
> Soft-fork1 activated because everyone was aligned. Soft-fork2 no longer has that alignment and is
> much riskier.
>
> "Aww shucks, we really support unfreezing these coins, but we the miners just don't think the
> current iteration is ready for prime time, why don't you put more work into it and try again in five
> years." - every five years until the heat death of the universe.
>
> Matt:
> > I believe this is largely only possible either with an ethereum-style "difficulty bomb" or
> simply doint it all in one go.
>
> The do it all in one go approach avoids the incentive problem, but how will this be built? How many
> cryptographers are willing to invest the years of effort to create a soft fork that is unlikely to
> activate, all to protect holders who can't be bothered to move to a safer output?
>
> The most likely outcome is some kid just writes a simple soft-fork that freezes all the insecure
> outputs, and miners activate it because they have cover to reduce supply/pump the price. I'm not
> endorsing this course of action, but it impacts my thinking on building PQ ZKP proof of seed phrase.
> I ask myself why spend 5+ years on a PQ ZKP proof of seed phrase soft-fork just to watch a low
> effort soft-fork annihilate all that work?

I think this is all totally fair analysis, but I certainly hope the availability of decent PQ ZKPs
will improve over time and at least one PQ ZKP will be generally considered high quality by the time
a CRQC is on the immediate horizon. If you think that's unlikely, this is maybe something the
Bitcoin community should fund in the shorter term!

> > No, P2TRv2 and P2MR are totally equivalent here. Because address reuse is rampant, P2MR will
> *also* require an equivalent P2MR-disable-soft-fork. The only material difference is the cost, and
> some small minority that doesn't do heavy address reuse.
>
> Wallets that encourage Schnorr key reuse with P2MR should be thrown out the metaphorical airlock.

I agree! But also I try to be realistic. I mentioned in another email but a wallet reliably in the
top three app store results for "Bitcoin wallet" over the past few years (Trust wallet) started off
with fresh addresses regularly, then made it optional because it confused their users, then they
simply removed it entirely because no one ever turned it on.

> Wallets claiming quantum safety must warn a user if that user has exposed a Schnorr public key on
> the blockchain and make it easy to move to a new address. There is UX work to be done on this
> problem, but it is achievable and worthwhile.

There has been some non-zero work to improve this situation for as long as I've been in Bitcoin, and
its only gotten worse and worse over the years. I wish I shared your optimism.

Matt

--
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/1e0842c2-a89b-44b6-a9d7-bc4a43636e9e%40mattcorallo.com.