pull down to refresh

The article is saying that the quantum threat to classical cryptographic schemes is overstated.

This misunderstanding stems from a short-hand calculation people use for quantum speed up. The short-hand calculation is to simply take the square-root of the keyspace to get how long it takes a quantum computer to find the key. So for example, if a classical computer would take at most N operations, a quantum computer would take at most √N operations.

So, if your original keyspace is 2^128, Grover's algorithm sees it as a 2^64 keyspace, and 2^64 seems pretty crackable by classical machines.

The article is saying that this claim, "pretty crackable by classical machines", hides an assumption, which is the parallelizability of the search strategy. Our classical techniques for searching over a 2^64 keyspace relies a lot on parallelization, but quantum computers can't be parallelized in a similar way. Thus, saying 2^64 is crackable by classical techniques relying on parallelization doesn't mean 2^64 is crackable by non-parallelizable quantum methods.

Big caveatBig caveat

As to how it applies to Bitcoin, here's my understanding.

  1. It doesn't for addresses with an exposed public key. Bitcoin's ECC can be cracked by Shor's algorithm, which is different from what they're talking about in this article (Grover's algorithm). Shor's algorithm is actually very efficient for ECC, so Bitcoin addresses with an exposed public key are super vulnerable still (assuming a large enough quantum computer).
  2. It does apply for addresses without an exposed public key, Grover's algorithm is needed to go from the hash of the public key to the public key itself. So that part of the cracking is still relatively hard for a quantum computer, due to what was discussed in the article.