Hacking Bitcoin wallets with quantum computers could happen

https://www.cnbc.com/2021/06/10/long-term-crypto-threat-quantum-computers-hacking-bitcoin-wallets.html

by StevenSeagull • 5 years ago

64 82 5 years ago

Bitcoin would be least of our worries right? All current internet communication is effectively http not https with this. You don’t know if the server you are talking to is the real deal!

Thorrez3• 5 years ago

That requires a MITM. A typical cybercriminal isn't in a position to MITM me. But every cybercriminal on the internet is in a position to steal my bitcoins (if they can break bitcoin crypto).

nothasan• 5 years ago

It’s not just cybercriminals who want to MITM. There are nation states who have been tapping fiber optic cables for a long time.

adventured• 5 years ago

Yes, at present Bitcoin is a trinket in the global scheme of things, a small toy compared to most other major economic items. Facebook is worth more than Bitcoin.

One of the things frequently intentionally neglected in Bitcoin discussions, is that it will die. It is guaranteed to die. It's a human invented digital technology, there is no long-term scenario where we don't kill it off through replacement and or competition. We'll be constantly inventing new cryptos, that process will never stop. The odds of Bitcoin maintaining its crown long-term are not good, for all sorts of reasons (not least of which are vast dilution through competition and regulation; eg nations heavily restricting foreign/external cryptos and only allowing official national fake crypto currencies (digital currencies), as China is speeding toward). We can and will replace Bitcoin with something better. And then we'll replace that too.

People that are irrationally, emotionally bound up in Bitcoin will fight you to the death to deny that. Bitcoin is not a forever technology, it's transitory. But who gives a shit about Bitcoin per Bitcoin, click, click, no more Bitcoin, I just moved my Bitcoin over to X blah coin that is better. The coins don't matter unto themselves, they're merely vessels for holding or moving value, nothing more. A crypto investor should always be prepared to abandon ship for something superior and maintain a rational independence from becoming emotionally biased toward a given coin. It's no different than understanding to not fall in love, so to speak, with stocks (or commodities, and so on).

The tragedy of Bitcoin is that as it fades away and gets replaced, it'll leave a giant environmental blackhole in its wake. There will be a question as to whether it was a mistake (was there a better alternative beginning technology for cryptos), or whether it was absolutely necessary to learn from to spark the field (and if so, was it necessary to go so far with it before abandoning it).

Besides the replacement factor, there is no scenario where major world governments allow Bitcoin to replace central bank controlled fiat currencies. Give up a huge source of their power, give up the ability to free-spend, 'print,' steal & paper over fiscal mistakes via inflation? Ha, yeah right. It's hilariously trivial for major governments to dictate financial matters within their own borders. Outlaw Bitcoin and throw a bunch of people into prison for using it and they'll instantly see 99%+ compliance, that's how easy it is to relegate Bitcoin to the fringe. All the largest economies are already priming their moves to squeeze crypto via intensifying regulation, to make sure it stays in the corner where they're willing to tolerate it.

rawtxapp• 5 years ago

Bitcoin has been dead hundreds of times already, it can die one more time [1].

1: https://www.bitcoinisdead.org/

atweiden• 5 years ago

Cryptocurrencies have zero intrinsic value. If only one person owned all the bitcoins and refused to part with any of it, the world wouldn’t accept its use, and would just create another currency with similar properties. Ditto for every altcoin.

This is why altcoins haven’t displaced Bitcoin: touting technological advancements over and above the benchmark set by Bitcoin is more or less irrelevant, except to the extent the narrative underlying it produces a network effect to compete with Bitcoin’s. But there’s no logical reason why Bitcoin’s network effect should ever be exceeded — Bitcoin has the first-mover advantage, and is the most widely recognized cryptocurrency, with the safest and simplest technical implementation which is clearly capable of meeting the needs of cryptocurrency users. Speculative value storage is the only real world use case of cryptocurrency, and Bitcoin does it better.

wildmanx• 5 years ago

Sadly, this comment being downvoted illustrates the bias in the HN community. People don't like the message, so they shoot the messenger.

johnnyapol• 5 years ago

There's active research going on into "post-quantum" cryptography to protect the need for secure communications if/when quantum computers become powerful enough to pose a serious threat to the status quo.

https://blog.cloudflare.com/the-tls-post-quantum-experiment/ is a great read about a sample deployment of this by Cloudflare.

tiku• 5 years ago

Then we would get qhttps (quantum encrypted https)..

babyshake• 5 years ago

Serious question: If I have a proposal regarding a relatively simple quantum experiment where the successful result would be $20M or more (nothing illegal like stealing funds from someone), but not the technical expertise to carry out the experiment, who would be a good person to get in touch with?

iaw• 5 years ago

Serious answer: Come up with a concrete logical proposal and reach out to academics with expertise in the area you're trying to show results for. They'll either tear you to shreds or consider the experiment.

throw_exception• 5 years ago

intriguing... your profile bio is down fyi

6nf4• 5 years ago

relatively simple quantum experiment

You know that we can just barely (maybe) demonstrate quantum supremacy at this point right? Anything below this mark can be done on some rental AWS time and anything beyond that mark will be a serious challenge worthy of Google or Baidu's teams.

I guess what I'm saying is that I don't think you have what you think you have.

MrStonedOne3• 5 years ago

quantum supremacy doesn't matter if what your interested in testing in QC is related to the behavior of the processor or other curiosities.

I would encourage you to seek to be more open minded.

reidjs• 5 years ago

Sure, quantum computing may break BTC encryption. Accepting that premise, it will also break every other secure form of encryption we currently have. In that scenario, there are much, much more important things to worry about than your little Bitcoin wallet.

postalrat3• 5 years ago

Other things can adapt but how does bitcoin adapt? Or are people willing to just give up all the old coins as if nothing happened?

kleer001• 5 years ago

The same way those things adapted. There will be whitepapers and code and the changes will be adopted quickly.

Just like every other existential threat to bitcoin QC will threaten other more important things, like infrastructure, first.

It's a non-threat.

MrStonedOne3• 5 years ago

Somebody only read the title.

retrac3• 5 years ago

Yes, quite possibly. As the article notes though, it's more of an engineering and social challenge than a fatal flaw. As soon as it is clear it will be actually practical in the near future to attack ECDSA, then the protocol will move to a quantum-resistant cryptosystem and you'll have to sign a transaction with your old ECDSA key to transfer it to the new one. Your paper wallet might become a rather thick paper listing, though.

As long as most of us do this before the attacks are practical and widespread, no problem. But when do we stop accepting transactions with ECDSA keys? I suppose at some point someone will try move 500,000 BTC from addresses that have been dead since 2010. Hopefully we'll have a consensus by then.

As to the surprise attack scenario, I find it uncompelling. The only ones who could fund that in the near future are nations, and one thinks they'd have better things to do with a top secret trump card like that, than to attempt to very publicly steal money with it.

Thorrez3• 5 years ago

Your paper wallet might become a rather thick paper listing, though.

Why? Are you saying you'll need a bunch of new addresses? I think you'll only need 1 new address. Are you saying the addresses or stored private keys will be gigantic? I don't think that needs to be the case. Current addresses are just hashes, they can stay hashes and thus be small. Private keys don't need to be stored, only a seed needed to generate a private key needs to be stored.

retrac3• 5 years ago

Keys for some quantum-secure crypto systems are pretty big - the Wikipedia article has a chart of proposed ones: https://en.wikipedia.org/wiki/Post-quantum_cryptography#Comp... They range from about 10 to 100x as large as the EDCSA keys used in Bitcoin. This poses its own problems with transaction sizes and the block size cap and total throughput, though it's not a fatal flaw to the protocol.

gruez2• 5 years ago

But when do we stop accepting transactions with ECDSA keys? I suppose at some point someone will try move 500,000 BTC from addresses that have been dead since 2010. Hopefully we'll have a consensus by then.

It shouldn't be too hard to come up with a consensus right? All the stakeholders would benefit old coins being lost forever (because the value of their holdings would go up), and there's no point in opposing it when you can just shuffle your old coins to using post-quantum signatures.

retrac3• 5 years ago

There would be a period when both systems are active. It will likely require more bytes to log a quantum-secure transaction. With no other protocol changes, this would incentivize people to keep using ECDSA keys. And the increase in transaction size, would cause reduced transactions per second.

No inherent problem. The protocol could have a built-in discount. Maybe the block cap should be increased to compensate. Questions like that are not so easy to get consensus on.

MrStonedOne3• 5 years ago

But when do we stop accepting transactions with ECDSA keys? I suppose at some point someone will try move 500,000 BTC from addresses that have been dead since 2010. Hopefully we'll have a consensus by then.

Why would you bother?

The outcome is the same, either the user gets locked out of their coin or hackers gain access to the coin, meaning the user is locked out of the coin. There isn't a solution that doesn't resolve in one of those and if you aren't able to protect the user by doing it, why spend the effort?

matthewdgreen• 5 years ago

Because if someone gains the ability to resurrect lost coins, it will massively increase the circulating supply of bitcoin overnight, causing the value of everyone’s bitcoin to crash. This effect will get worse the farther we go in the future. Some people might not be happy about this.

Canada3• 5 years ago

QC would break secp256k1, but you don't get the public key to target on chain, you get the hash of it. QC doesn't help there. You could attack TX in the mempool as the spender reveals his public key(s), but you have very limited time to crack them.

If QC are ever built - and that is a big if, not a foregone conclusion - then these networks will react long before the quantum computers are powerful enough to attack.

Vecr• 5 years ago

I think that changes with Taproot though, otherwise native mutisig would not work. I suppose the mitigation would be to keep high value wallets on hashed public key addresses.

gruez2• 5 years ago

I think that changes with Taproot though, otherwise native mutisig would not work

Can you elaborate on this? AFAIK taproot only makes it so you don't have to divulge the non-executed branches of code, but everything still uses hashes/ecdsa signatures so the threat model stays the same.

edgyquant2• 5 years ago

Aren’t there already (computationally small) quantum computers right now?

bdamm• 5 years ago

Similar to how a fire cracker is exactly like ICBM, yes.

Canada3• 5 years ago

Yes, but none of them have been able to do anything faster than a classical computer can so far. It is not clear it will ever be possible to build a QC that is.

nextaccountic• 5 years ago

Without quantum error correction it isn't practical to use them for real world problems.

Scott Aarson wrote a piece that touches on this https://www.quantamagazine.org/why-is-quantum-computing-so-h...

FounderBurr• 5 years ago

Isn’t quantum computing nonsense though?

rax0m• 5 years ago

Using Shor's algorithm at this scale requires entanglement of so many qubits that it will never be feasible, and definitely not on this earth which is vibrating so much!

tudorw• 5 years ago

careful, you're entangling with a tough crowd :)

3np3• 5 years ago

By the time we realize that this is about to be reality, it will already be too late. I really do hope that Bitcoin Core devs and the community make a collective effort to approach this while it's still not necessary any time soon, than be caught with our pants down and leaving users too little time to react. Negotiation for a solution will be years, rollout on the mainnet should also be a year or two, and there should be a gap of several years after activation of whatever new signature scheme until it becomes necessary.

So if we're being risk-averse and having the worst-case in mind, it's time to get the ball rolling now.

6nf4• 5 years ago

Bitcoin addresses are not public keys, they are the hash of the public key. Therefore you can not use a QC to derive the private key from the address alone (since the hash function is QC safe)

The public key is only written to the blockchain when you spend coin from that address, so at that point a QC can attack the key. Thus it's important to never re-use an address once you've spent from it and always spend the entire amount by using a newly generated change address.

greyface-2• 5 years ago

The public key is only written to the blockchain when you spend coin from that address

As Canada points out[1], there is a window when it's revealed to the mempool but not yet committed to the blockchain. During that time, even a single-use address is not QC safe.

[1] https://news.ycombinator.com/item?id=27498750

6nf4• 5 years ago

Yup that is correct but that window is reduced to a minimum. Your adversary will need to crack your PK in 10 mins and submit a replacement transaction which may or may not be accepted.

tracedddd3• 5 years ago

It’s possible to skip the mempool, by including it directly in a block, giving no time to a QC attacker. Not worth it right now, but if QC was known to exist it could be done.

escalt• 5 years ago

Also worth noting that good bitcoin wallets automatically use a new address for every transaction, so you never end up reusing an address.

haakon• 5 years ago

In the early days of Bitcoin, P2PK was used, where the public key is exposed instead of a hash of it. At least a million coins are covered by that. I would expect someone yielding a theoretical QC to attack those first.

HWR_142• 5 years ago

Thus it's important to never re-use an address once you've spent from it and always spend the entire amount by using a newly generated change address.

How does that work? Anytime you spend coins from an address you hope you spend the exact correct amount that was already there? You pay 2x transaction fees to have to transfers - payment as one and remainder as the other and hope they both pop in the same block?

x4e2• 5 years ago

Bitcoin transactions always spend 100% of your coins, however they can have multiple outputs. So to pay for something while still retaining the change, you can have one output going towards the merchant with the required amount and one output going straight back to your own wallet with the remaining coins. Only one fee is needed and everything is within one transaction.

You can also send the change to a new address instead, which is how single use wallets work. You generate a new wallet, send the change to the new wallet and replace usage of the old wallet with the new one.

postalrat3• 5 years ago

If you figured out a way to move bitcoins from any address would it even be considered stealing?

You wouldn't need to break in and take anything. Just create some transactions in an open ledger.

nlitened• 5 years ago

Would there be people considering it stealing? Yes. Will there be a lot of them? Very likely.

cable26002• 5 years ago

Mike Crawford invested $6000USD in Bitcoin and then died. I assume his wallet was on his Macbook and nobody knew his password. It was supposed to be a life insurance policy like investment because he could not get life insurance because of his mental illness. Someone got the Macbook for sure, but I'm not sure if anyone got the wallet and password to work.

system2• 5 years ago

Who is Mike Crawford?

cable26002• 5 years ago

https://news.ycombinator.com/item?id=19488164

sometimesshit• 5 years ago

Likewise ancient people thought about a F-16 before ever inventing a one.

me_me_me• 5 years ago

Along with any encrypted online transactions, including banking sessions.

ie a global internet disaster.

Hacking Bitcoin wallets with quantum computers could happen

Related Stories