Coinbase sets out seven requirements for Bitcoin's post-quantum signatures

[Pixel Jay]

Coinbase has weighed in on how Bitcoin should prepare for quantum computers. PostQuantum's Marin Ivezic reports that the exchange's protocol security lead, Shashank Agrawal, has published seven requirements for any post quantum signature scheme Bitcoin adopts. As a custodian, Coinbase says it holds about 12 percent of all bitcoin, so its view carries weight

The requirements are practical rather than theoretical. Coinbase wants the community to prepare early, and to keep the output type separate from the signature scheme so one can change without the other. It also wants staged spending where either a classical or a post quantum signature can be used during a transition period

The list continues with a stateless signature option, deterministic and constant time verification, and compatibility with multi party computation, which large custodians use to protect keys. Finally, it asks for a path for users who have not migrated their coins in time

Ivezic calls multi party computation compatibility the hardest requirement. Post quantum signatures are also much larger than today's. A Schnorr signature is 96 bytes, while ML-DSA-44 is 3,732 bytes and the stateless SHRINCS scheme is 5,825 bytes, which has big implications for block space and fees

The article also cites an estimate of around 1.7 million bitcoin held in old pay to public key outputs, where the public key is already visible on chain. Those coins would be the first at risk. The author discloses links to Project Eleven and Applied Quantum, which both work in this area

Should Bitcoin start its post quantum migration now? And what should happen to coins whose owners never move them?

Coinbasepostquantum.com