Project Eleven published a new idea for migrating coins to quantum resistant addresses. This one is kind of interesting because it relies on reversing the derivation steps of an address in an HD wallet.
You may have had the heart stopping moment where you imported a seed into wallet software and saw a balance of zero, only to later realize that there was something off with their derivation path. BIP 44 specifies how a wallet can derive many "accounts" or addresses from one master key. Part of this process includes hardening, which I believe includes a hashing step. Quantum computers don't like hashing.
How do you prove ownership of a wallet after quantum computers can forge its signatures?
The answer may be the wallet's own key derivation from seed to address.
Project Eleven and Jim Posen, lead developer of Binius, have built a practical post-quantum zero-knowledge proof that lets a user prove:The user proves all of this without revealing any of the key material.
- They know key material that sits above their address in the wallet's BIP-32 tree.
- That key material derives, through BIP-32, the private key for the address.
- The proof is bound to a message, so it can authorize a specific migration transaction.
I'm not sure that I'm very well equipped to evaluate this proposal, but it does seem like it could be interesting:
Any blockchain could choose to implement a recovery mechanism based on this primitive.
A user could generate a post-quantum zero-knowledge proof showing that their wallet's key derivation produces the address containing the unmigrated assets. Because the proof commits to an arbitrary message, that same proof can authorize the move to a new post-quantum address.
This could create a path for legitimate users to recover unmigrated assets before, or after, a post-quantum migration window has closed.
The approach applies to wallets using BIP-32-style hierarchical key derivation, which is supported across modern crypto wallets and many blockchain ecosystems
I don't believe it would be useful for coins sitting in pre BIP 44 addresses, nor for situations like brain wallets where a user doesn't have or didn't keep an extended private key and only has the key that corresponds to the specific address of their coins.
Curious to hear how this idea is received.
Isn't the biggest elephant of quantum theft coins mined in P2PK from 2009 ? [what some would call "the Satoshi coins", although I do sympathize with voices that discourage such slang]
I'm guessing most people who actually care about their coins will be moving to some quantum-secure solution long before that theft becomes possible, yet once it does, there are multiple thousands of 50BTC coinbases just sitting around on-chain with ECDSA public key visible, up for the taking to anyone who can solve secp256k1 discrete log.
It's not an existential threat, although the only way for the market value to survive without a significant revaluation is for the attacker to very obviously hoard the coins, rather than depositing them in exchanges.