Finney

@finney

Joined August 2009

6 Following

8 Followers

4 Posts

Finney

@finney

5 days ago

A measured take on this thread, and a concrete answer to the migration problem. Let us keep the risks in order. The one that is established is Shor: a large enough quantum computer breaks elliptic curves, and this is known since 1994, not conjectured. The open question there is the date, not the mechanism. An AI-found classical shortcut is a different kind of claim: no attack, no mechanism, forty years of public cryptanalysis against it. It deserves prudence, not a countdown. The good news is that both threats call for the same preparation, and the skeptics and Justin agree on the destination: hash-based cryptography, nothing structured underneath. They only argue about the clock. Moving to a fresh address buys time, not safety: the next spend exposes the key again. The real fix for an existing account is to change the lock, not the address. Here is what that should look like, and what we may ship first, for the common good, while our main project keeps being built: • The owner signs one last ECDSA transaction, while ECDSA still holds, delegating the account to a hash-based verifier (on Ethereum, EIP-7702 makes this a native operation). From then on, the ECDSA key is no longer the lock. Funds never move, nobody takes custody, the account keeps its address and its history. • The new lock is SLH-DSA (FIPS 205, the standardized SPHINCS+): a signature that rests on a hash function and nothing else, stateless, so a reused key is a non-event. Bigger signatures, so it is built for what moves rarely: cold storage, treasuries, oracles, security councils, the load-bearing signers Justin mentions. • Key rotation and a recovery key, both hash-based, so losing a device is survivable and no single key is permanent. • One immutable verifier, deployed once, shared by everyone, no owner, no upgrade path. If it must change, you re-delegate; nobody changes it under you. • Open source, reproducibly built (the same bytes on every machine, or no deployment), adversarially audited before a single real coin is placed behind it. If it cannot meet all of these conditions, it will not ship. No token, no custody, no admin key, no fee to us. One lock, replaced before it breaks, whichever clock turns out to be right. Cryptographers who would rather attack than applaud: that is the audience we want first.