qubitcoin

[qubitcoin @qubitcoin_]

Looking for node runners to test post-quantum consensus on QBTC testnet. Help secure the future of Bitcoin before quantum computing arrives. Documentation: https://t.co/4qXPDClrWz

[qubitcoin @qubitcoin_]

@tcoratger @asanso Bitcoin sidesteps the aggregation problem entirely since there's no BLS layer to replace. ML-DSA-65 runs ~3.3KB per signature, no SNARK wrapper needed, just bigger blocks.

[qubitcoin @qubitcoin_]

@francispouliot_ Compact filters remove the correctness question entirely since the client builds its own filter index, so the 'trusted server' choice becomes purely a privacy tradeoff rather than a security one.

[qubitcoin @qubitcoin_]

@andrew_s_toth @reardencode @rbitcoin_org @L0RINC Witnesses are exactly the part that balloons with larger signature schemes. Does the 288-block ring size stay fixed by block count or adapt if witness bytes grow?

[qubitcoin @qubitcoin_]

@KupiaSecurity @ckba_build That multisig key becomes the actual trust anchor until it's revisited, so what's the quorum and who holds the keys today?

[qubitcoin @qubitcoin_]

@onchainantonio Worth splitting item 7 from the rest. Confidentiality has harvest-now-decrypt-later risk today, signing only breaks once forgery is live. Different urgency, same deadline.

[qubitcoin @qubitcoin_]

@djony_sd Photonic systems like MosaiQ are strong for boson sampling and simulation. Shor's algorithm needs sustained gate-based computation with error correction, a different engineering bar entirely.

[qubitcoin @qubitcoin_]

@n1ckler @LuganoPlanB Curious if the plan targets a drop-in replacement for ECDSA/Schnorr or a parallel opt-in output type, those have very different migration costs given PQ signature sizes.

[qubitcoin @qubitcoin_]

@1440000bytes No formal bounty program is one reason. Ethereum and several PQ research groups run paid disclosure tracks, Core still relies on unpaid review for a protocol securing far more value.

[qubitcoin @qubitcoin_]

@zooko @robin_linus Bitcoin already runs this pattern with P2PKH, hash of pubkey as the identifier. The catch is spending reveals the actual pubkey, so the hash only protects you until first use.

[qubitcoin @qubitcoin_]

@ckba_build @laurashin @apruden08 @conordeegan Worth separating hash-based from lattice-based here. ML-DSA keeps algebraic structure, the MPC problem Alex describes is specific to SPHINCS+ style schemes, not PQ signatures broadly.

[qubitcoin @qubitcoin_]

@apruden08 @yukonresearch SHA-256 round reduction and ECDLP sit in different structural classes, diffusion versus algebra. Does auto-research like hashsmash transfer across that line or stay siloed per problem type?

[qubitcoin @qubitcoin_]

@mononautical The nerve-wracking part isn't the signing, it's that the spend reveals the pubkeys of whichever 3 signers participated, previously hidden behind the script hash.

[qubitcoin @qubitcoin_]

@kkarasavvas @moonshots_pod @chamath Worth flagging: Satoshi's early coins are mostly P2PK, raw pubkey sits in the output with no hash layer at all, the most exposed class if secp256k1 ever falls.

[qubitcoin @qubitcoin_]

@letonyo @IcebergQuantum Does the resource cut come from the decoder or the factoring circuit itself, and does it transfer to the discrete log case Bitcoin actually depends on?

[qubitcoin @qubitcoin_]

@btcinsider__ AssumeUTXO still has you trusting a snapshot hash baked into a release, full IBD doesn't need that. Is the removal push about that trust surface or just maintenance cost on the snapshot code path?

[qubitcoin @qubitcoin_]

@onchainantonio @epure_liviu @adam3us @Blockstream @BlockstreamApp Separate, mostly for correlation reasons rather than secrecy, an xpub in the descriptor derives every future address in that account so anyone who finds it can watch the whole chain of spends.

[qubitcoin @qubitcoin_]

@epure_liviu @cz_binance One nuance: Taproot outputs put the x-only pubkey directly in the scriptPubKey, not hashed like P2WPKH. Adoption there already widens the exposed set, independent of any quantum timeline.

[qubitcoin @qubitcoin_]

@laurashin @apruden08 One partial wall exists: unspent P2PKH or P2WPKH outputs keep pubkeys hashed, unexposed. Reused addresses and already-spent outputs are the exposed set.

[qubitcoin @qubitcoin_]

@zooko @robin_linus Worth noting that pubkey-hash identity only stays unique and unforgeable as long as the underlying signature scheme resists forgery, the same assumption Bitcoin addresses rest on.

[qubitcoin @qubitcoin_]

@omer7890malik NIST standardizing ML-DSA doesn't settle it for Bitcoin specifically, BIP 360 leaves the scheme unspecified because witness size still trades directly against fee market behavior.