3) For certain kinds of problems, QC can provide quadratic speedup, which is a massive speedup. For symmetric ciphers, this probably just means you double your key size - where 128 bits of security used to be sufficient, now you need 256. No big deal. The real problem is with public-key encryption. But lay-people often forget that the quantum speedup blade cuts both ways. We can build
encryption systems which take advantage of quantum speedup and make quantum cryptanalysis of PKE quadratically more difficult, mooting the theoretical advantage that cryptanalysts get from quantum speedup.
In fact, this is why Bitcoin uses the public-key hash instead of the public-key itself and recommends against address-reuse; in the event of working, at-scale QC, your coins are still secured behind 128-bit-equivalent security as long as you don't reuse addresses or publish the public-keys for your addresses.
...
I'm sorry to short your message but I would know at the underlined sentence if I have good understood the point.
The fact that Public Key and Bitcoin Address are different is not a safeguard against Quantum computing, because when you sign a transaction you are revealing on the blockchain your Publickey, so that Adress can be exposed to QC attack, is that correct?
My doubt is when you speak about "address-reuse": what do you mean with that? I have a cold storage paper wallet ecrypted via BIP0038 where I periodically put some cash into that. I've never spent BTC on that but there is not a single but multiple input transactions, so there are multiple utxo transactions on the blockchain.
Until I don't spend bitcoin is it still secured or not? Should I use a cold storage paper wallet for every transaction? Thanks in advance
In this particular context (but see below), “address reuse” means reuse of an address from which you have
spent. Transactions
to your address contain the public keys of whoever sent you the money—not your public key. But the only information revealed in the blockchain when you
receive money is the Hash160 (RIPEMD160 of SHA256) of your public key. That is what haltingprobability referred to as the “public-key
hash” in the portion you underlined.
(For the sake of simplicity, I here assume only P2PKH and P2WPKH addresses. What do these stand for? “Pay To (Witness)
Public Key Hash”.)
But this discussion misses the point that
the security of public keys is just fine. It seems that you missed this upthread:
There are excellent reasons to avoid address reuse; but this is not one of them. I say this as a paranoid security nut: The security of publicly disclosed public keys is just fine. That is why they are called public keys. The only exception I would here make is if you have coins which you intend to potentially leave in cold storage for decades. Then, yes, you will want the extra security margin of the key being unpublished.
Bingo.
Do you intend to leave the coins in cold storage for
decades? If so, then I recommend that you do what you said you’re doing: Use the addresses for receiving only. Not that I expect for secp256k1 to be broken: If storing something for
decades (or longer), I prefer some extra security margin “just in case”.
Otherwise, there is no reason to worry about revealing the public key. secp256k1 is secure. You may rely on it.
But there is another, very different reason to avoid reuse of addresses for both sending and receiving: Privacy. Blockchain analysis is already easy enough for experts. Address reuse of all kinds makes it trivial.
To start with, for a bare modicum of privacy, use
one HD wallet with the seed and keys generated (and backed up!) on an airgapped computer; and from that wallet, use a different address every time you receive money.
This recommendation has nothing to do with the security of your money against attacks on public keys.
, maybe for you guys could be a ridiculous sum).
