From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 13 Nov 2026 09:26:26 -0800 Received: from mail-oa1-f56.google.com ([209.85.160.56]) by mail.fairlystable.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1xRv2f-000RTM-Rg for bitcoindev@gnusha.org; Fri, 13 Nov 2026 09:26:26 -0800 Received: by mail-oa1-f56.google.com with SMTP id 586e51a60fabf-46617932071sf635349fac.0 for ; Fri, 13 Nov 2026 09:26:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20260707; t=1794590779; x=1795195579; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-sender:content-type :mime-version:subject:references:in-reply-to:message-id:to:from:date :sender:from:to:cc:subject:date:message-id:reply-to:content-type; bh=aPxG28BxJitpotTgXNoW9JMr1Ae9PS2icq2M6NDk20o=; b=OjhGcQvYKBN9QuzJY9UhrBWSWuXJ5P38C3lrseLQjqsdNqA8VhGfZCPaNzKhXsNdEu +xwPETYzY85lJsx4oVOZshrLi2ARi5lo+UvCBbJoAblQ8xueqRlz0wF9F4KgO4tcbIeG cc1f/0OtbHC8bWOnfeg8e60zxSAekVxBBfJoeoRYr4mq452hjr3ovzqpCgDErr1x5oyq l0s8Ty5UTr4Tj2jE5Rjwwz+/E9xFfxp4de7XqdopINSvQ7unBIMv/Hlr87XnZonVCDSU M1sXInXKDaNVoJfXwDj6fnKtMrqLn+mVwkneb2PTEEuYlxJV9JfMuZTqhLdrBiwSXGaV hs8g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794590779; x=1795195579; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-sender:content-type :mime-version:subject:references:in-reply-to:message-id:to:from:date :from:to:cc:subject:date:message-id:reply-to:content-type; bh=aPxG28BxJitpotTgXNoW9JMr1Ae9PS2icq2M6NDk20o=; b=T5NlkAoAsyFxSpurMsQukTnPb/NcrODLNYeIWoJbP0Mjd+esTV3QgyTIHqOhN7SwZP ChVI2ngxYu9DOdsD3+f+GQcoAtFK1zF0vEssomBeKv6nf2Hsb0J5D0/Gv7nKCZvE9uMk QqgjDVfRL0yCy9VR0ZGdInS5yx+MZ5Nb9unmeMxW4vZDEhhQRbH7B1Ivnh8rNJleaCPu vVvPw2SpugcCSkBk8e42QwlcMaMpVFrYSH+G8+dAoTq+TvYSbGGvwckYRL/UxdyW9GAm JTU4Jc6g/nXJb6XdLlf2OCKlwcl4M5rtbdk+0WxB5caDTmwVg1kg4f9use5AQ2ZP1vVn lGPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794590779; x=1795195579; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-sender:content-type :mime-version:subject:references:in-reply-to:message-id:to:from:date :x-beenthere:x-gm-message-state:sender:from:to:cc:subject:date :message-id:reply-to:content-type; bh=aPxG28BxJitpotTgXNoW9JMr1Ae9PS2icq2M6NDk20o=; b=o4pPA7AiU6PXRzY3KKvV9jsj1Y8xnIWVmEg2YYoHzgHNRLloeX8f2SNiFxdTPKY+9z DNkYNL2URWwuKOf69NoLc8JLWJg+0VhVEnOCYnAmz6B6GS+wXW/65WtWdKVdvWxAoXob SzLBb6y0CJ4mpOF6BzRKngG3SGS6YW5uvCiJdymQrgl9F8zRlloN6HQ4HZOSrye1PNqk J8q45C8r0u3inbgY4haG8n1dikm8nONnH5BZqt2J+99pLdhX6FkRGnUTfiVGpA0wqKlE wIhuzhG9b2YuojVaZMuT3CucgwZZWwzhlRy8rF84+BOmU3NTiKD6gnXGuCCQPlJxa5Xb K8Kg== Sender: bitcoindev@googlegroups.com X-Forwarded-Encrypted: i=1; AL+hErEu8aIgRLUn8S4Hi4oz1gxCIgTWZ6F7PXIkkBM74tQY2wTmZfmy7GTL19GvTzxhm27dcHZEu8mA5Ryi@gnusha.org X-Gm-Message-State: APuU4Z8qjf5Luj5U/+Hy8YTHdxp35gFkiBgqzr841PVKeF3a/iaDlqyS 3yFsZIXi2B063iEoRBD6Ygq28PYdkcU8CNIl6YMFS690oPJYYMFahsvi X-Received: by 2002:a05:6871:c018:b0:475:a112:126d with SMTP id 586e51a60fabf-4afdf4ed41emr2662895fac.26.1794590779342; Fri, 13 Nov 2026 09:26:19 -0800 (PST) X-BeenThere: bitcoindev@googlegroups.com; h="ATskLdeI7B2CLb0FnFfxx3mRgzglD0b3YZE2Lsy694iushTd9g==" Received: by 2002:a05:6871:e50b:b0:494:b4b7:86b4 with SMTP id 586e51a60fabf-4afde97fbf7ls1021073fac.0.-pod-prod-04-us; Fri, 13 Nov 2026 09:26:13 -0800 (PST) X-Received: by 2002:a05:6808:4f07:b0:4d6:90d4:6bc with SMTP id 5614622812f47-56e6573120amr2402295b6e.46.1794590772867; Fri, 13 Nov 2026 09:26:12 -0800 (PST) Received: by 2002:a05:690c:449:b0:8b2:da26:98d2 with SMTP id 00721157ae682-8b4b0f29cbfms7b3; Fri, 13 Nov 2026 04:18:56 -0800 (PST) X-Received: by 2002:a05:690c:c4e5:b0:8ab:4989:bc9d with SMTP id 00721157ae682-8b4aa3126d2mr16349867b3.65.1794572335811; Fri, 13 Nov 2026 04:18:55 -0800 (PST) Date: Fri, 13 Nov 2026 04:18:55 -0800 (PST) From: Hans Stringuer To: Bitcoin Development Mailing List Message-Id: <9a435a81-4146-4e9f-b7da-3858fb3ef4f7n@googlegroups.com> In-Reply-To: <9463348c-b2ec-4c6f-b9ec-2e9e2fc7d105n@googlegroups.com> References: <9463348c-b2ec-4c6f-b9ec-2e9e2fc7d105n@googlegroups.com> Subject: [bitcoindev] Re: BIP Draft Post-Quantum Address Format (bc1z) using ML-DSA-65 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_1012_1461493060.1794572335508" X-Original-Sender: hans.stringuer@gmail.com Precedence: list Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com List-ID: X-Google-Group-Id: 786775582512 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Score: -0.5 (/) ------=_Part_1012_1461493060.1794572335508 Content-Type: multipart/alternative; boundary="----=_Part_1013_793469299.1794572335508" ------=_Part_1013_793469299.1794572335508 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi all, I posted an initial draft for a quantum-resistant address format yesterday.= =20 After feedback and closer review, I've made several corrections to the=20 specification. The updated draft is at: https://github.com/Zaenus/btc-safe/blob/main/docs/bip/0001-pq-address-forma= t.md Key changes: 1. **Witness version 0x03, not 0x02.** Version 0x02 (bc1z...) is allocated= =20 to BIP-360 (P2MR). This proposal uses witness version 0x03, as discussed in= =20 the April Delving Bitcoin thread on ML-DSA-65 address formats. 2. **HRP is "bc", not "bc1z".** Witness version 0x03 encodes as the=20 character "r" in bech32m, so addresses start with `bc1r...`. The encoding= =20 is bech32m (BIP-350), matching Taproot. 3. **Sighash is BIP-143.** Signatures use the same digest as SegWit v0=20 transactions, adapted for witness version 3, defaulting to SIGHASH_ALL. 4. **Aggregation is a mock prototype.** The signature aggregation module in= =20 the repo uses a deterministic hash construction, not a real zk-SNARK=20 circuit. Compression numbers (~192-byte proofs) are illustrative only. A=20 real circuit (Circom/Noir/SP1) with trusted setup is required before any=20 on-chain use. 5. **Test suite updated.** All 43 tests pass with the corrected `bc1r`=20 format. The reference implementation (Python, ML-DSA-65 via pqcrypto, off-chain=20 only) is at https://github.com/Zaenus/btc-safe. I'd appreciate review of the corrected draft, particularly on: - Whether witness v3 is the right choice given BIP-360's allocation of v2 - Whether BIP-143 sighash is appropriate for witness v3 programs - Whether the community wants to pursue a PQ address BIP at all, given=20 BIP-361's migration framework Best regards, Hans https://github.com/Zaenus Em quinta-feira, 12 de novembro de 2026 =C3=A0s 14:27:23 UTC-3, Hans String= uer=20 escreveu: > Dear Bitcoin Development Community, > > I'm sharing a draft BIP for a quantum-resistant address format for=20 > Bitcoin, developed as part of the safe-btc project ( > https://github.com/Zaenus/btc-safe). > > ## Summary > > This BIP proposes a new `bc1z` address format using ML-DSA-65 (FIPS 204)= =20 > post-quantum signatures. The format commits to a SHA-256 hash of the ML-D= SA=20 > public key, revealing the full public key only at spend time in the witne= ss=20 > =E2=80=94 similar to how P2WPKH works today. > > ## Motivation > > Bitcoin's ECDSA and Schnorr signatures are vulnerable to Shor's algorithm= =20 > on a cryptographically relevant quantum computer (CRQC). Once a public ke= y=20 > appears on-chain, a quantum attacker can derive the private key and spend= =20 > the funds. Approximately 6.9 million BTC (~$586B) sits in addresses with= =20 > exposed public keys. > > ## Design Highlights > > - **Address format:** `bc1z<32-byte SHA-256=20 > commitment>` > - **Spend witness:** ` (1,952 bytes)>` > - **Soft fork compatible:** Old nodes see `bc1z` outputs as=20 > anyone-can-spend (witness version > 1) > - **Off-chain reference implementation available:** Python library with= =20 > key generation, signing, verification, migration helper, and quantum cana= ry=20 > monitor > - **Signature aggregation prototype:** SNARK-wrapped ML-DSA signatures=20 > compress ~33KB of individual signatures to ~2KB for 10 signatures > > ## Repository > > https://github.com/Zaenus/btc-safe > > The full BIP draft is in `docs/bip/0001-pq-address-format.md`. > > ## Request for Comments > > I'm looking for feedback on: > > 1. Address format design (HRP `bc1z`, witness version 0x02, 32-byte=20 > commitment) > 2. ML-DSA-65 parameter choice (security vs. signature size trade-off) > 3. Soft fork deployment considerations > 4. Migration path for existing UTXOs > 5. Whether the community sees value in pursuing this before a CRQC exists > > This is an early draft intended to start discussion. I'm happy to revise= =20 > based on community feedback. > > Best regards, > Hans > https://github.com/Zaenus --=20 You received this message because you are subscribed to the Google Groups "= Bitcoin Development Mailing List" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoindev+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/= 9a435a81-4146-4e9f-b7da-3858fb3ef4f7n%40googlegroups.com. ------=_Part_1013_793469299.1794572335508 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi all,

I posted an initial draft for a quantum-resistant addres= s format yesterday. After feedback and closer review, I've made several cor= rections to the specification. The updated draft is at:

https://= github.com/Zaenus/btc-safe/blob/main/docs/bip/0001-pq-address-format.md

Key changes:

1. **Witness version 0x03, not 0x02.** Vers= ion 0x02 (bc1z...) is allocated to BIP-360 (P2MR). This proposal uses witne= ss version 0x03, as discussed in the April Delving Bitcoin thread on ML-DSA= -65 address formats.

2. **HRP is "bc", not "bc1z".** Witness ver= sion 0x03 encodes as the character "r" in bech32m, so addresses start with = `bc1r...`. The encoding is bech32m (BIP-350), matching Taproot.

= 3. **Sighash is BIP-143.** Signatures use the same digest as SegWit v0 tran= sactions, adapted for witness version 3, defaulting to SIGHASH_ALL.
4. **Aggregation is a mock prototype.** The signature aggregation modul= e in the repo uses a deterministic hash construction, not a real zk-SNARK c= ircuit. Compression numbers (~192-byte proofs) are illustrative only. A rea= l circuit (Circom/Noir/SP1) with trusted setup is required before any on-ch= ain use.

5. **Test suite updated.** All 43 tests pass with the c= orrected `bc1r` format.

The reference implementation (Python, ML= -DSA-65 via pqcrypto, off-chain only) is at https://github.com/Zaenus/btc-s= afe.

I'd appreciate review of the corrected draft, particularly = on:
- Whether witness v3 is the right choice given BIP-360's allocatio= n of v2
- Whether BIP-143 sighash is appropriate for witness v3 progra= ms
- Whether the community wants to pursue a PQ address BIP at all, gi= ven BIP-361's migration framework

Best regards,
Hans
<= a href=3D"https://github.com/Zaenus" target=3D"_blank" rel=3D"nofollow">htt= ps://github.com/Zaenus
Em quinta-feira, 12 de novembro de 2026 =C3=A0s 14:27:23 U= TC-3, Hans Stringuer escreveu:
Dear Bitcoin Development Community,

I'm sharin= g a draft BIP for a quantum-resistant address format for Bitcoin, developed= as part of the safe-btc project (https://github.com/Zaenus/btc-safe).

## Summary

This = BIP proposes a new `bc1z` address format using ML-DSA-65 (FIPS 204) post-qu= antum signatures. The format commits to a SHA-256 hash of the ML-DSA public= key, revealing the full public key only at spend time in the witness =E2= =80=94 similar to how P2WPKH works today.

## Motivation

Bitco= in's ECDSA and Schnorr signatures are vulnerable to Shor's algorith= m on a cryptographically relevant quantum computer (CRQC). Once a public ke= y appears on-chain, a quantum attacker can derive the private key and spend= the funds. Approximately 6.9 million BTC (~$586B) sits in addresses with e= xposed public keys.

## Design Highlights

- **Address format:*= * `bc1z<witness version 0x02><32-byte SHA-256 commitment>`
-= **Spend witness:** `<ML-DSA signature (3,309 bytes)> <ML-DSA publ= ic key (1,952 bytes)>`
- **Soft fork compatible:** Old nodes see `bc1= z` outputs as anyone-can-spend (witness version > 1)
- **Off-chain re= ference implementation available:** Python library with key generation, sig= ning, verification, migration helper, and quantum canary monitor
- **Sig= nature aggregation prototype:** SNARK-wrapped ML-DSA signatures compress ~3= 3KB of individual signatures to ~2KB for 10 signatures

## Repository=

https://github.com/Zae= nus/btc-safe

The full BIP draft is in `docs/bip/0001-pq-address-= format.md`.

## Request for Comments

I'm looking for feedb= ack on:

1. Address format design (HRP `bc1z`, witness version 0x02, = 32-byte commitment)
2. ML-DSA-65 parameter choice (security vs. signatur= e size trade-off)
3. Soft fork deployment considerations
4. Migration= path for existing UTXOs
5. Whether the community sees value in pursuing= this before a CRQC exists

This is an early draft intended to start = discussion. I'm happy to revise based on community feedback.

Bes= t regards,
Hans
https://github.com/Zaenu= s

--
You received this message because you are subscribed to the Google Groups &= quot;Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoind= ev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoind= ev/9a435a81-4146-4e9f-b7da-3858fb3ef4f7n%40googlegroups.com.
------=_Part_1013_793469299.1794572335508-- ------=_Part_1012_1461493060.1794572335508--