Quantum Computers Could Steal Bitcoin in 9 Minutes

Transcript

Yeah, that distinction they made in the paper. Um so they could was so when when your Bitcoin is attacked in the mempool, um they call that an on spent transaction. That was alarming. I had not heard that before. I knew about the public key ones. Um but, you know, since that is the main risk people call out, I saw it when Justin Drake tweeted about this paper cuz, as you mentioned, he was a co-author. He said he felt that there was at least a 10% chance that by 2032 a quantum computer would recover But so I'm just going to I don't don't know if this is correct. SECP256K1 ECDSA private key from an exposed public key. Um do you do

you think do you agree with him about that? First of all, that it might happen and second of all, about you know, the 10% chance. So I am on I am on the record. You can you go through my tweets and find I have I have made bets with uh a handful of people that it's it for 2035 was the day this is a about a year ago I made this bet. Um for for 2035 it would happen. So I the statement that you just read, I do agree. The I have money on the table, so to speak, for 2035. And I look, I mean, I think after this new work and uh and people like Dolev working on this problem, I would feel pretty good about making a bet on 2032, quite honestly. I think a lot a lot of people would make feel good about making a bet on 2030. Um

I haven't actually it's funny since this work has come out I haven't uh looked at the prediction markets or anything, but it might be kind of interesting to see what they are doing. Um anyway, um I was just going to say you should you should uh put that on a prediction market. You know, we thought about doing that actually Project 11. It was an idea that we had that I still think is a good idea that we may do or others should do. But yeah, it's just it's like when when is Q-Day? And then and then and what's cool about that is you'd be able to maybe hedge against this risk. Like if you were worried that like bit protocols weren't going to prepare. This is kind of like what people talk about as the good thing about prediction markets. You can like hedge risk against certain events.

Obviously, that's all in theory, often not in practice just given how liquidity works there, but um yeah, I think it is a good idea. Okay so you know, I just wanted to address your comment about um Satoshi's coins and you know, whether or not burning is a good option. Uh I interviewed Bitcoin developer core developer Matt Corallo on my show about this and he said that uh he thought clearly the community was going to choose to burn all the coins where the public key was exposed and >> [laughter] >> I thought that was crazy in my opinion.

Not not that I'm saying I don't know if, you know, whether or not people choose that is you know, they they might, um but the notion that like it would be kind of easy to resolve that that struck me as implausible. I just even even if that was like the end outcome, I think there would be a huge fight. It's just like a big drawn out thing. Um but anyway, so let's talk a little bit more about the on spent attack that we mentioned um that you know, which is the one that happens when uh the transaction has been sent to the mempool.

Um so let's say that, you know, we're in this post-quantum world and um you know, Bitcoin or well, yeah, let's what do we we'll use Bitcoin has not uh become post-quantum and I, you know, send send a transaction or I broadcast a transaction. So like what exactly happens? Yep. So today, if if I like broadcast a transaction, what what what happens? So I send a transaction. What is a What is a transaction even? It's basically a message to the network that's formed a certain way that's digitally signed by me or you or whoever was the sender that says transfer one Bitcoin or 0.1 Bitcoin or 100 sats to Laura. Signed Alex.

Basically, that's kind I mean, it's like a simple way to think of it, but that's kind of what it is, right? Um and in order to verify that signature, critically, you need to include the public key. And and so and that's and maybe just for your listeners that may not be aware, Bitcoin addresses, which is kind of how you send money around. It's like the thing you reference when you're sending um the recipient. That address is a hashed public key. Um and this is a good good time to kind of highlight some other note from the Google paper. Hashes, many people may be aware, are used in mining. It's another cryptographic primitive. It's effectively you can kind of think of it

as like put something in one side and a jumble of randomness comes out the other side. It's used in mining and a whole bunch of other things. The Google paper actually said there's there is a quantum attack on hashing. It's called Grover's algorithm. It's not Shor's algorithm, it's a different one. And the Google paper said, "Look, Grover's algorithm is not going to be a near-term concern for a variety of reasons, but most importantly just the fact that the resources that Grover's algorithm would require is not 10,000 qubits. It's like astronomical numbers of qubits. So we can probably, you know, of course we can never take anything for granted. Just look at how progress has happened in the last year. But for now, I think we can probably view Shor's as the most as the as the more dangerous one. Okay, so back to the transaction example.

I sent I exposed my public key cuz it was hashed in an address, but now I have to expose it. And that's and that's important because in digital signature algorithms ECDSA the elliptic curve digital signature algorithm, the verifier to to know that the signature's authentic has to take as input the public key. They take the public key, they take the signature, and then they run an algorithm that says whether or not that signature was valid, yes or no. Okay so what does this have to do with Bitcoin and how does quantum enter in? Well, there's this concept of finality and Bitcoin is a little funny. I mean, it's it's kind of funny to say that it's funny because it was the original way to do it. Um but you know, most other protocols these days use something called proof of stake, which kind of has

a much firmer sense of finality, I guess, if you will. In Bitcoin, there's a chance that as miners mine a block, two miners find the same block at the same time and it may take a couple of blocks for the network as a whole to kind of recognize which tip of the blockchain is the right blockchain. Like which which tip corresponds to the right blockchain, right? And so this is why if you send a transaction to Coinbase, you're like, "I'm depositing some Bitcoin in Coinbase." They typically don't show it until an hour I think is standard, it used to be standard. And the reason is they want to give a few minutes for blocks to confirm, right?

And so what this Google paper is saying is their estimate for an on spent attack, they claim, could be run within a 9-minute interval potentially. And they have a lot of ideas for how it's like you could run a pre pre-computation and basically if you were if you were ready and waiting, it would take 9 It's kind of 9 minutes is best case, right? But the window here is really an hour, right? So 9 minutes is definitely less than an hour. So even in less than ideal conditions, it's possible with a fast clock quantum computer that I could go in the mempool, send a different transaction signing a message that I used your public key to, you know, I used your public key that you broadcast to recover your private key, sign a different message with a higher fee and be like, "Actually, don't send, you know, my Bitcoin to Laura.

Alex, send Alex's Bitcoin to I Dolev." I'm sorry to make Dolev the villain here in the story, but let's just take for your point of example, right? And um so that is what would happen in a real-time on spent attack. Now, one more thing but before I before I, you know, kind of conclude this answer is this doesn't only it's like you frame the scenario as if Bitcoin hasn't migrated yet. And this would be what would happen and you wouldn't be able to spend cuz potentially a quantum adversary could be running an on spent attack and take your Bitcoin. The other thing that this effectively closes off is if you haven't migrated to a post-quantum address type, say, then after real-time attacks become possible,

you can no longer do it in a permissionless way. Because because what what is like what would this what would a migra Let's just imagine what a migration would look like. Let's imagine there was a UTXO type that was post-quantum secure and I have my funds in an existing UTXO that's secured under P2PKH or P2PKWH. The the migration would look like me sending those funds on the network to this new thing, right? And so you're you're stuck kind of cuz if you if it's like you know, you can imagine like worst case scenario, the quantum adversaries are over there and they're just waiting for someone to come up out and just like expose themselves and then they got you. And so this is again, this is like one of the original reasons why I started really getting really

interested in this problem is because again, at the point you have these real-time attacks possible, it's kind of it's over. Like you're not The assets at that point go back to Satoshi's coins. Like all of those coins at that point might as well be Satoshi's coins because you're not getting them back, really. And you know, and look, of course, that you can that that's a little bit hand-wavy. Like there are ways you can do it. Maybe you can come up with a zero-knowledge proof system. Maybe you could use a private mempool, but none of them give you the same it's not the same guarantees that you would get with a typical Bitcoin network. I I hope that was helpful.

Wow, okay, that is frightening. Um so the way that I wrote my questions, I actually wrote crypto, but when I verbally asked it to you, I asked you to use the example of Bitcoin. I'm just trying to remember in the paper, I think they they didn't say this on spent attack was only possible in Bitcoin. They said it was like generally possible on public blockchains. Is that correct? Yes and no. I I think so again, the the fact that Bitcoin's block times are so slow means that that's kind of like makes it especially vulnerable. There are other block like Bitcoin Cash, other variants of Bitcoin, like it's you know, have similar block times or similar parameters. Dogecoin I think is a fork

of Litecoin, there's a fork of Litecoin Bitcoin. So it's technically they would be possible in some of these other contexts. You but it kind of just depends on the block time. Notably, if you look at some of these blockchains that have come out since Bitcoin that have faster block times, it kind of like accidentally is a defense against uh real-time attacks on quantum, right? Because you just the quantum computer I mean it's possible they optimize even more in 9 minutes is only the beginning not the end where quantum computers get but for now like 15 seconds is what to use the Ethereum block time. I think it's still 15 seconds.

It's 12 there you go. So 12 seconds it's like much you know, much too fast for a quantum computer to do an unspent time.