thanks for the detailed response. 

Several of the people in the mailing list thread I quoted above expressed similar sentiments, I believe. Their response seems to be something like, "Don't mess with it until we are much closer to having a real problem."

I can get behind such an attitude.

Scoresby

cryptographic algorithm (this could be the wrong word, but I can't find the better term to refer to it: eg. curve only applies to elliptic curve cryptography. what if I also want to reference sha-256?)

It's not the wrong word. Cryptographic algorithms are e.g.: ECDSA, Schnorr, SHA256, RIPEMD-160

I'm curious if you think we will still be happily and safely relying on secp256k1 in the year 2085?

Hard to tell what will be in 59 years, but let's speculate.

Right now the best known practicable algorithm to find private keys from exposed public keys without knowing a single bit of the private key is Pollard's Rho. This algorithm has a time complexity of 

. So it effectively cuts the number of bits of security in half. A 256-bit private key can be found with about 

If computers ever become fast enough to be a threat, we could simply switch to an elliptic curve over a larger prime field with let's say 512 bits. Therefore Pollard's Rho would require 

But the likelihood of that becoming necessary any time soon seems very low. Looking at the 

 over time we can see a growth rate of roughly 1 bit of security in 4 years:

Unless some more efficient algorithm for solving the ECDLP is found, we are probably going to be fine.

Now just for fun, I projected this very rough estimate out even further into the future. According to this growth rate, we would be able break 128 bit security in the year 2294.

bitcoin

Are quantum procrastinators dangerous even if Bitcoin has a quantum fix?

> cryptographic algorithm (this could be the wrong word, but I can't find the better term to refer to it: eg. curve only applies to elliptic curve cryptography. what if I also want to reference sha-256?)

It's not the wrong word. Cryptographic algorithms are e.g.: ECDSA, Schnorr, SHA256, RIPEMD-160

> I'm curious if you think we will still be happily and safely relying on secp256k1 in the year 2085?

Hard to tell what will be in 59 years, but let's speculate.

Right now the best known practicable algorithm to find private keys from exposed public keys without knowing a single bit of the private key is Pollard's Rho. This algorithm has a time complexity of $$O(\sqrt{n})$$. So it effectively cuts the number of bits of security in half. A 256-bit private key can be found with about $$2^{128}$$ iterations.

If computers ever become fast enough to be a threat, we could simply switch to an elliptic curve over a larger prime field with let's say 512 bits. Therefore Pollard's Rho would require $$2^{256}$$ iterations.

But the likelihood of that becoming necessary any time soon seems very low. Looking at the [records of breaking the Elliptic Curve Dircrete Logarithm Problem (ECDLP)](https://en.wikipedia.org/wiki/Discrete_logarithm_records#Elliptic_curves) over time we can see a growth rate of roughly 1 bit of security in 4 years:

| Year | Bits of security |
|-------|-------|
| 2000 | 54 |
| 2002 | 54.5 |
| 2009 | 56 |
| 2014 | 56.5 |
| 2016 | 58.675 |

If we project this out to 2085 we get:
$$58.675 + (2085-2016)/4 = 75.925$$ bits of security

Unless some more efficient algorithm for solving the ECDLP is found, we are probably going to be fine.

Now just for fun, I projected this very rough estimate out even further into the future. According to this growth rate, we would be able break 128 bit security in the year 2294.