From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Thu, 12 Nov 2026 09:27:29 -0800 Received: from mail-oa1-f62.google.com ([209.85.160.62]) by mail.fairlystable.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1xRYa9-000PMX-Ey for bitcoindev@gnusha.org; Thu, 12 Nov 2026 09:27:29 -0800 Received: by mail-oa1-f62.google.com with SMTP id 586e51a60fabf-4ad637cf04csf1236fac.1 for ; Thu, 12 Nov 2026 09:27:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20260707; t=1794504443; x=1795109243; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-sender:content-type :mime-version:subject:message-id:to:from:date:sender:from:to:cc :subject:date:message-id:reply-to:content-type; bh=F8nbDwiBuyZoPOHSFnCjtIXDkBW8WLuVES3JjX1bJVE=; b=NEpZ1YgRVmvSJWrtTrvD3SzpQIgpmDHh2LYOOgx0ai6yvqG95nEDY0c+OUJkQsJtu5 mOnbTXQ1ttzpPzG0ffQjKeU2nfqcIepfGsADRIR8vFoNIwlQPdRAub9sWyNc9evDcMKO FYU3RbEpATXselOfhHdASfyzsLtv4umHfyCmZ+cHSynt1oTMb5BXHhtBfbeHJTie58FO V2IN/2pW/0yGo/YMlToZC0Fh2j0nVadksXcoZyDNogu3jb18IH/ncYJiMWS9czxIYM5L 5vmE+XLykTfiWi4MVAIv5QdfeQN9U2gIYNDLUILu4B4JW5Hi/QGuYHl5lg0KZe8B+mV3 ILDQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794504443; x=1795109243; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-sender:content-type :mime-version:subject:message-id:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=F8nbDwiBuyZoPOHSFnCjtIXDkBW8WLuVES3JjX1bJVE=; b=mT+HObG+XZaKZe9dChPuxMwRLPXYSB4c29Hkvx5GLfE4amKK9fhqPE8s8rxH3aMZER kaJ0zvDOYk5GUO803JNia7nH7wwTvNsBJe7UG7CXVupjeEqML5hoNzYOGG+W+4MosRG1 Xd+b1u275/c3swXkyDTxWGHGMFEYgq3ELgxvWtLeYhNEkAdW1uy1cd0ahi90pQp+L5DH UBVKWgWsuhixGq9lrr7RQAn5UiYvb7fDzcAfLTw4W7H9koyiM72bkc0YaZnN7l7as84w LulwOEc9Xz9MTL9suCbE8HhaNEtOpZbGLOB9XqiOij2Yc1zITk1/kXP9FeDO6dibXdsh 5vZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794504443; x=1795109243; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-sender:content-type :mime-version:subject:message-id:to:from:date:x-beenthere :x-gm-message-state:sender:from:to:cc:subject:date:message-id :reply-to:content-type; bh=F8nbDwiBuyZoPOHSFnCjtIXDkBW8WLuVES3JjX1bJVE=; b=Yy+0lbVd8B34C1HeKXcUNXuGWDVpfIdZr1QqTEbYRq/On9oGaFtDoemU+8t7C4On58 tWnQUygCoXQgpIieDzbQDsOKhmrOZU+55f2WvX643sLnQ3RleaVXO06aTDFFiX/eQcIt WtsvLXicSQdeOqJu9CbavpYesdvdBSYVVQ0EPqXg0vxYdWN2q6hlzurR+FOLv2HLC8MD bVKFY+XqgUhvdiKUPMhvQ5wVkrIY+Z/virLveytyODQWS0YoIdYs/VQxnrVv/Ogn5Vp4 FF5rxszl8FQYrAIjL4zErRPNRr+up62iX/5ymdC6o7rtcfqpDp8Hz5SVAmmNoij/xvYv b0OQ== Sender: bitcoindev@googlegroups.com X-Forwarded-Encrypted: i=1; AL+hErHQ2wgmsxFd7xuT6y3VQdVX2MLFPa3pcIVpBiZxcEwvx5EXNZcwKdIrPZfj85T9JYFJrrlFPDRQV5cO@gnusha.org X-Gm-Message-State: APuU4Z9JeD4RKw5oUWmztq61I1NoFcsQA7ONr+KxRVAhT2lFPb+qapMy +SENZ49lOq0n8SRtSEsztZnzrkeOMkSx75NBgx9PoVmjxwX5Vzxx1dPx X-Received: by 2002:a05:6870:9124:b0:4ad:5f41:5257 with SMTP id 586e51a60fabf-4afdf4df62amr434337fac.4.1794504442920; Thu, 12 Nov 2026 09:27:22 -0800 (PST) X-BeenThere: bitcoindev@googlegroups.com; h="ATskLdfVFruo9sNOIZajlF78f54+E+lMRbxs7yxs8O5XhNor4Q==" Received: by 2002:a05:6871:e50b:b0:494:b4b7:86b4 with SMTP id 586e51a60fabf-4afde97fbf7ls122203fac.0.-pod-prod-04-us; Thu, 12 Nov 2026 09:27:16 -0800 (PST) X-Received: by 2002:a05:6808:6707:b0:4ea:e4cc:ab33 with SMTP id 5614622812f47-56b96bd41bcmr5243518b6e.35.1794504436478; Thu, 12 Nov 2026 09:27:16 -0800 (PST) Received: by 2002:a05:690c:a7ca:b0:8b2:da26:98d2 with SMTP id 00721157ae682-8b3557c8d7cms7b3; Thu, 12 Nov 2026 09:25:21 -0800 (PST) X-Received: by 2002:a05:690c:60c5:b0:8b3:5121:3d57 with SMTP id 00721157ae682-8b4aa2fdf46mr1759317b3.63.1794504320810; Thu, 12 Nov 2026 09:25:20 -0800 (PST) Date: Thu, 12 Nov 2026 09:25:20 -0800 (PST) From: Hans Stringuer To: Bitcoin Development Mailing List Message-Id: <9463348c-b2ec-4c6f-b9ec-2e9e2fc7d105n@googlegroups.com> Subject: [bitcoindev] BIP Draft Post-Quantum Address Format (bc1z) using ML-DSA-65 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_121241_1163330803.1794504320531" X-Original-Sender: hans.stringuer@gmail.com Precedence: list Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com List-ID: X-Google-Group-Id: 786775582512 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Score: -0.5 (/) ------=_Part_121241_1163330803.1794504320531 Content-Type: multipart/alternative; boundary="----=_Part_121242_420657135.1794504320531" ------=_Part_121242_420657135.1794504320531 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Dear Bitcoin Development Community, I'm sharing a draft BIP for a quantum-resistant address format for Bitcoin,= =20 developed as part of the safe-btc project=20 (https://github.com/Zaenus/btc-safe). ## Summary This BIP proposes a new `bc1z` address format using ML-DSA-65 (FIPS 204)=20 post-quantum signatures. The format commits to a SHA-256 hash of the ML-DSA= =20 public key, revealing the full public key only at spend time in the witness= =20 =E2=80=94 similar to how P2WPKH works today. ## Motivation Bitcoin's ECDSA and Schnorr signatures are vulnerable to Shor's algorithm= =20 on a cryptographically relevant quantum computer (CRQC). Once a public key= =20 appears on-chain, a quantum attacker can derive the private key and spend= =20 the funds. Approximately 6.9 million BTC (~$586B) sits in addresses with=20 exposed public keys. ## Design Highlights - **Address format:** `bc1z<32-byte SHA-256=20 commitment>` - **Spend witness:** ` ` - **Soft fork compatible:** Old nodes see `bc1z` outputs as=20 anyone-can-spend (witness version > 1) - **Off-chain reference implementation available:** Python library with key= =20 generation, signing, verification, migration helper, and quantum canary=20 monitor - **Signature aggregation prototype:** SNARK-wrapped ML-DSA signatures=20 compress ~33KB of individual signatures to ~2KB for 10 signatures ## Repository https://github.com/Zaenus/btc-safe The full BIP draft is in `docs/bip/0001-pq-address-format.md`. ## Request for Comments I'm looking for feedback on: 1. Address format design (HRP `bc1z`, witness version 0x02, 32-byte=20 commitment) 2. ML-DSA-65 parameter choice (security vs. signature size trade-off) 3. Soft fork deployment considerations 4. Migration path for existing UTXOs 5. Whether the community sees value in pursuing this before a CRQC exists This is an early draft intended to start discussion. I'm happy to revise=20 based on community feedback. Best regards, Hans https://github.com/Zaenus --=20 You received this message because you are subscribed to the Google Groups "= Bitcoin Development Mailing List" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoindev+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/= 9463348c-b2ec-4c6f-b9ec-2e9e2fc7d105n%40googlegroups.com. ------=_Part_121242_420657135.1794504320531 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Dear Bitcoin Development Community,

I'm sharing a draft BIP for = a quantum-resistant address format for Bitcoin, developed as part of the sa= fe-btc project (https://github.com/Zaenus/btc-safe).

## Summary<= br />
This BIP proposes a new `bc1z` address format using ML-DSA-65 (F= IPS 204) post-quantum signatures. The format commits to a SHA-256 hash of t= he ML-DSA public key, revealing the full public key only at spend time in t= he witness =E2=80=94 similar to how P2WPKH works today.

## Motiv= ation

Bitcoin's ECDSA and Schnorr signatures are vulnerable to S= hor's algorithm on a cryptographically relevant quantum computer (CRQC). On= ce a public key appears on-chain, a quantum attacker can derive the private= key and spend the funds. Approximately 6.9 million BTC (~$586B) sits in ad= dresses with exposed public keys.

## Design Highlights

- **Address format:** `bc1z<witness version 0x02><32-byte SHA-25= 6 commitment>`
- **Spend witness:** `<ML-DSA signature (3,309 by= tes)> <ML-DSA public key (1,952 bytes)>`
- **Soft fork compat= ible:** Old nodes see `bc1z` outputs as anyone-can-spend (witness version &= gt; 1)
- **Off-chain reference implementation available:** Python libr= ary with key generation, signing, verification, migration helper, and quant= um canary monitor
- **Signature aggregation prototype:** SNARK-wrapped= ML-DSA signatures compress ~33KB of individual signatures to ~2KB for 10 s= ignatures

## Repository

https://github.com/Zaenus/btc= -safe

The full BIP draft is in `docs/bip/0001-pq-address-format.= md`.

## Request for Comments

I'm looking for feedback= on:

1. Address format design (HRP `bc1z`, witness version 0x02,= 32-byte commitment)
2. ML-DSA-65 parameter choice (security vs. signa= ture size trade-off)
3. Soft fork deployment considerations
4. Mi= gration path for existing UTXOs
5. Whether the community sees value in= pursuing this before a CRQC exists

This is an early draft inten= ded to start discussion. I'm happy to revise based on community feedback.
Best regards,
Hans
https://github.com/Zaenus

--
You received this message because you are subscribed to the Google Groups &= quot;Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoind= ev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoind= ev/9463348c-b2ec-4c6f-b9ec-2e9e2fc7d105n%40googlegroups.com.
------=_Part_121242_420657135.1794504320531-- ------=_Part_121241_1163330803.1794504320531--