Dear Bitcoin Development Community,<br /><br />I'm sharing a draft BIP for a quantum-resistant address format for Bitcoin, developed as part of the safe-btc project (https://github.com/Zaenus/btc-safe).<br /><br />## Summary<br /><br />This BIP proposes a new `bc1z` address format using ML-DSA-65 (FIPS 204) post-quantum signatures. The format commits to a SHA-256 hash of the ML-DSA public key, revealing the full public key only at spend time in the witness — similar to how P2WPKH works today.<br /><br />## Motivation<br /><br />Bitcoin's ECDSA and Schnorr signatures are vulnerable to Shor's algorithm on a cryptographically relevant quantum computer (CRQC). Once a public key appears on-chain, a quantum attacker can derive the private key and spend the funds. Approximately 6.9 million BTC (~$586B) sits in addresses with exposed public keys.<br /><br />## Design Highlights<br /><br />- **Address format:** `bc1z&lt;witness version 0x02&gt;&lt;32-byte SHA-256 commitment&gt;`<br />- **Spend witness:** `&lt;ML-DSA signature (3,309 bytes)&gt; &lt;ML-DSA public key (1,952 bytes)&gt;`<br />- **Soft fork compatible:** Old nodes see `bc1z` outputs as anyone-can-spend (witness version &gt; 1)<br />- **Off-chain reference implementation available:** Python library with key generation, signing, verification, migration helper, and quantum canary monitor<br />- **Signature aggregation prototype:** SNARK-wrapped ML-DSA signatures compress ~33KB of individual signatures to ~2KB for 10 signatures<br /><br />## Repository<br /><br />https://github.com/Zaenus/btc-safe<br /><br />The full BIP draft is in `docs/bip/0001-pq-address-format.md`.<br /><br />## Request for Comments<br /><br />I'm looking for feedback on:<br /><br />1. Address format design (HRP `bc1z`, witness version 0x02, 32-byte commitment)<br />2. ML-DSA-65 parameter choice (security vs. signature size trade-off)<br />3. Soft fork deployment considerations<br />4. Migration path for existing UTXOs<br />5. Whether the community sees value in pursuing this before a CRQC exists<br /><br />This is an early draft intended to start discussion. I'm happy to revise based on community feedback.<br /><br />Best regards,<br />Hans<br />https://github.com/Zaenus

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &quot;Bitcoin Development Mailing List&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an email to <a href="mailto:bitcoindev+unsubscribe@googlegroups.com">bitcoindev+unsubscribe@googlegroups.com</a>.<br />
To view this discussion visit <a href="https://groups.google.com/d/msgid/bitcoindev/9463348c-b2ec-4c6f-b9ec-2e9e2fc7d105n%40googlegroups.com?utm_medium=email&utm_source=footer">https://groups.google.com/d/msgid/bitcoindev/9463348c-b2ec-4c6f-b9ec-2e9e2fc7d105n%40googlegroups.com</a>.<br />