[bitcoindev] Re: In defense of a PQ output type

Dplusplus
2026-04-09T20:34:29Z

[-- Attachment #1.1: Type: text/plain, Size: 5236 bytes --]

Antoine,

Yes, +1 on decoupling the PQ signature discussion from the "freeze"
discussion.

As one example of what this could look like, P2Q (
https://github.com/casey/bips/blob/280fb529b27949b42721bfbf5f255e67b9a1103b/bip-p2q.md)
formalizes that decoupling. P2Q is a new SegWit version (v3) with spending
rules identical to Taproot today, but with an explicit roadmap: a future
soft fork could disable key-path spending for v3 outputs only, without
touching existing P2TR UTXOs.

Users who send to a P2Q address are deliberately opting in to that future
possibility. The cryptographic decision and the social decision about
unmigrated coins become cleanly separable. It also preserves Schnorr's
benefits (FROST, MuSig2, Taproot channels, etc.) for everyone who wants to
continue using them in the meantime, while P2MR does not.

The part that feels strange to me is the assumption I keep seeing that
SegWit v1 key-path spending will "simply" be disabled in a future soft
fork. That bakes confiscation into the roadmap without ever asking users to
opt in. Whether "freeze" ultimately wins is a decision for the market to
make on its own timeline.

D++
On Thursday, April 9, 2026 at 12:06:19 PM UTC-7 Antoine Poinsot wrote:

> Many of us appear to be in favour of introducing post-quantum signatures to
> Bitcoin via a new Tapscript operation, conditioning the CRQC resistance on
> a
> future invalidation of Taproot key spends. I would like to offer an
> argument in
> favour of introducing such post-quantum signatures as a new output type
> instead,
> that does not depend on invalidating a spending path on existing outputs.
>
> First of all, it's important to clarify what we are trying to achieve. We
> need
> to accept that, by virtue of being faced with an uncertain existential
> threat to
> the network, there are scenarios, however unlikely, in which the network
> does
> not survive. Not all plausible futures are worth optimizing for. For
> instance,
> one in which PoW ends up broken only a few years after EC crypto, or one
> where
> the entire Bitcoin userbase *must* migrate within a handful of years.
>
> I think there are two futures worth optimizing for primarily:
> - a CRQC never materializes and users can continue benefiting from the
> properties of a Bitcoin network relying on classical cryptographic
> assumptions;
> - a CRQC materializes on a long enough timeframe that PQ signature schemes
> that
> maintain today's properties can be designed, vetted and adopted, and the
> vast
> majority of the userbase migrated.
>
> And because hope is not a strategy, it's important to also have a "break
> glass"
> emergency plan in case a CRQC emerges on a shorter (yet still reasonable)
> timeframe. I think the current proposals for hash-based PQ schemes fit this
> category. If they became the only safe option available, it would
> certainly make
> Bitcoin a lot less attractive. But having them around is good risk
> mitigation
> *regardless* of whether a CRQC emerges.
>
> It's often argued that a freeze will be necessary anyways, therefore we
> might as
> well disable the Taproot keyspend path simultaneously and simply introduce
> the
> PQ scheme today in Tapscript. I personally reject the premise, but more
> importantly i think we should separate the concerns of 1) making a PQ
> scheme
> available and 2) freezing vulnerable coins. Yet introducing a PQ scheme
> inside
> vulnerable Taproot outputs locks us onto the path of eventually freezing
> vulnerable coins, as it will inevitably turn users of the PQ scheme into
> supporters of a freeze.
>
> This approach would tie the availability of a PQ scheme to reaching
> consensus on
> a future freeze. Frankly, i do not believe the latter is achievable, let
> alone
> at this stage with so little evidence that a CRQC will materialize anytime
> soon.
> By contrast, there is a much stronger case for introducing a PQ scheme in
> the
> near term purely as a risk mitigation measure. Coupling the two decisions
> would
> necessarily delay the deployment of a PQ scheme, unnecessarily exacerbating
> risks whether or not CRQCs become a reality.
>
> Another drawback of the PQ output type approach is that it would make those
> outputs distinguishable from Taproot ones, which is suboptimal in the
> event that
> a CRQC never materializes. But i would argue that even in this case, the
> cost is
> minimal. The users most likely to adopt PQ outputs today (those securing
> large
> amounts of BTC with a small set of keys) already have vastly different
> usage
> patterns from Taproot users: they often reuse addresses and use legacy
> output
> types (and show little interest in upgrading).
>
> Best,
> Antoine Poinsot
>

--
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/dbaf0dcf-3a47-4790-b45a-639a22de45b9n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 7896 bytes --]