The DropKick user experience in a post-quantum wallet would look roughly like this:
- Click "Import a legacy wallet"
- Enter your legacy seed phrase
- Wait 1000 blocks and your legacy coins will be available to spend securely! š
I'm very relieved to finally wrap this article up. It's been in the pipeline for a long time and I'm very glad I found some time recently to finish it, with a proper game-theoretical security argument, optimal parameters, and a side-by-side comparison to its sibling protocol, LifeBoat. Whether DropKick gains support or not (it's understandably controversial), I hope this document can serve as a source for further discussions about commit/reveal and rescue protocols in general :)
Posting to ~math as well, because i'd love to hear reviews of my game theory analysis.
Hmm. This is cool.... let me check if I understand it correctly. Also, this might help others understand in more laymens terms (if I got it right)
The ProblemThe Problem
You have coins sitting in a quantum-vulnerable address A, and you failed to move into a quantum-secure address before Q-day
The SolutionThe Solution
A soft fork that still allows people to spend from quantum-vulnerable addresses, but only with additional proof of ownership. The protocol relies on the existence of "knowledge asymmetries"... information that is hard for a quantum attacker to crack, but the true owner of the coins would have. We'll assume that such a knowledge asymmetry exists, and we'll call that secret S, which proves that you own A.
How it worksHow it works
Reason for the timestamp and the delayReason for the timestamp and the delay
Advantages of the approachAdvantages of the approach
Allows people who failed to migrate to post-quantum addresses a chance to recover their funds, while at the same time not letting vulnerable coins become exposed to a quantum free-for-all.
Does that about catch it?
I think your article has a lot more details about miner incentives and other implementation details, but I just tried to capture the high level gist of the idea.
Thanks. Yes, that's mostly correct. A few minor notes:
hehe sorry, the miner incentives game-theory appendix at the end was rather long-winded, but necessary if i wanted to argue security. Otherwise one could claim the scheme is broken by just saying "Miners will collude"
Thanks for explaining commit/reveal. It's a powerful scheme.
Generic comment, not personal (I know that this is what you meant with "controversial" and that you acknowledge this in your bottom "drawbacks" item.):
Any wallet created with Bitcoin Core version < 0.13.0 (2016) will have a random() sourced keypool. Can still be p2pkh, single use, and secure against everything but in-mempool / reorg-driven replacement by a quantum attacker. Any proposal that asks for additional proof post Q-day, no matter which flavor, will always confiscate every coin in such a wallet.
What is needed to make people come to their senses and not propose confiscation, ever? If there is insufficient disincentive to proposing it, then maybe this disincentive must be created, but it would be much better to for once not walk the same path of toxicity and just collaborate to enable decision making, rather than making them for people as if Bitcoin is a nanny state.
That's not correct. If a rescue protocol were deployed to allow rescue via only decidable knowledge asymmetries (hashed addresses, taproot) then none of those coins you cite would be confiscated. As Tadge said recently at Bitcoin++, "who doesn't know their public keys?".
Confiscation only occurs if we encumber coins with undecidable KA's, such as BIP32 derivation, where it's impossible to tell at-a-glance which addresses were generated via BIP32 and which weren't.
DropKick generalizes to any KA, so it can be deployed with or without confiscatory side-effects, depending on whether the future community puts more value on (1) rescuing the most coins from the QC, in which case use all the KAs, or (2) preventing all confiscation, in which case use only decidable KAs.
Right, so you're saying that, when doing a re-hashed commitment to a pubkey in a "hashed addresses" commitment, and then a reveal, and you make sure you give a quarter of your stash to a miner so that it is not worth reverse-engineering the signature come reveal time and wait another 1440 or so blocks for the full stash, then p2(w)pkh and taproot are potentially clean as well as anything that has a hash in a key derivation path, and then the only question is: whether or not to confiscate p2pk?
If we're willing to make users wait 1440 blocks between commit and reveal, they'd only need to sacrifice (a bit more than) one 1440th (i.e. ~0.07%) of their rescued coins to incentivize miners. One quarter would be drastic overkill. See the "Parameters" section of the article for the math.
To clarify, the miners aren't "reverse-engineering" anything in a censorship attack - they're just blocking the authentic reveal TX from being mined, for long enough that their own malicious commitment can mature, allowing them to mine their own (malicious) reveal TX.
The happy path would look roughly like this:
In theory yes. I have never heard of any knowledge asymmetries for P2PK wallets, so DropKick deployment has no utility or impact on those coins.
Interesting approach. One thing I'm curious about is the tradeoff between stronger security and user experience. Do you think average Bitcoin users would actually migrate funds before a potential Q-day, or would wallets need to automate most of this process?