Commit-Delay-Reveal (CDR) Protocol (Part 3)

This is Part 3 of our visual series on quantum threats to Bitcoin and how we can defend against them.

📚 In case you missed the earlier posts:

🧠 The Threat: Quantum Computers

Quantum computers can break ECDSA.
Once your public key is exposed, your funds can be stolen.

🎯 The Goal

We want to move coins from vulnerable UTXOs (e.g., P2PKH) to a quantum-safe address without revealing the old key.

🛡️ The Solution: Commit-Delay-Reveal

A protocol with 3 phases:
Commit ➝ Delay ➝ Reveal

🧩 CDR Phases Overview

Commit (C): You commit to your keys
Delay (D): You wait for a security window
Reveal (R): You prove ownership and migrate safely

🔶 1. Commit Phase

Bob creates a commitment of two keys:

pk: old (ECDSA)
pkQR: new (quantum-safe)

➡️ H(pk || pkQR)

Bob includes this hash in a transaction T_commit using OP_RETURN.
This hides the keys, while anchoring the commitment on-chain.

🟡 2. Delay Phase

Bob waits a period t_sec without touching the UTXO.
This pause prevents attackers from reorg-ing the chain.

⏳ Suggested delay: 6 months
Makes even quantum-powered reorgs too costly.

🟢 3. Reveal Phase

After the delay, Bob creates T_reveal to move the funds using his quantum-safe key skQR.

T_reveal must include:

pk — old key
pkQR — new key
H(pk || pkQR) — prove it was in T_commit
Signature with skQR

🧾 Detailed Breakdown

✅ Step 1: Reveal Old Key

This proves you control the originally locked UTXO.

✅ Step 3: Prove the Commitment

Show that H(pk || pkQR) was committed earlier in T_commit.

✅ Step 4: Sign with Quantum Key

Only someone with the secret key of pkQR can authorize the spend.

🎯 Final Result

The network is convinced:
The person who controls pkQR also controlled pk.
The migration is secure.

🚨 Limitation

To begin the process, users need access to some quantum-safe UTXOs.

✅ Solution

FawkesCoin protocol solves this by helping bootstrap quantum-safe UTXOs.

🤖 Follow for more

Follow @Bitcoin_Devs for more visual explainers on Bitcoin's quantum future.

100 sats \ 0 replies \ @Scoresby 9 Jun

One question I have about CDR is how we would distinguish between a quantum vulnerable address whose public key is still hidden and those addresses with public keys that have been revealed?

Could an attacker who knows your public key "race" you to get their commitment tx in a block, commuting your coins to their QR address?

Perhaps we say p2pk and p2tr are not eligible for CDR, but what about reused addresses or leaked xpubs? How do we know the CDR commitment transaction is actually being made by the true owner of the coins rather than someone who managed to gain access to their pubkey?

Wouldn't this kind of turn public keys into private keys? (I feel like I must be getting something wrong here).

0 sats \ 0 replies \ @hasherstacker 10 Jun

May this be fruitful!