Quantum-resistant Bitcoin signatures could add 10x more data

Coinbase CEO Brian Armstrong called for Bitcoin industry cooperation on quantum-computing threats on Oct. 20. His comments followed an Oct. 13 Coinbase article by Shashank Agrawal on how draft quantum-resistant signature systems could work with Bitcoin wallets, recovery processes and custody systems.

The article identified SHRINCS, a draft hash-based signature scheme, as a candidate for further assessment. Its current specification lists a 48-byte public key, stateful signatures ranging from 548 to 4,619 bytes, and a 5,777-byte stateless signature.

Stateful signing depends on a record of which one-time signing slots a key has used. Reusing a slot for different messages could allow an attacker to forge signatures. The smaller signatures therefore require the wallet to maintain an accurate record of its signing history.

A wallet can recover its long-term secret from an old backup without recovering a reliable record of signatures created afterward. In that situation, the implementation must reject stateful signing and use the larger stateless option. The current rules prohibit backing up or restoring the mutable counter that tracks used signing slots, because an older counter cannot prove which slots remain unused.

The same issue applies to exchanges and other custodians that operate signing servers in separate locations. Stateful signing requires exclusive access to a key and its current state while a signature is created. If a server produces a signature but the counter update fails or its result is uncertain, another server cannot safely use an older copy of the counter.

SHRINCS requires the counter update to be stored before a signature is returned. The counter cannot decrease, and its storage must resist unauthorized changes and rollback. The specification also prohibits concurrent signing with the same key state. An informational RFC published in September describes sectorization, in which signing capacity is divided into separate, nonoverlapping sections that different devices can use in parallel.

The larger fallback would increase the data and fees for transactions that use it. Under Bitcoin’s transaction-weight rules, each witness byte contributes one weight unit. Virtual size equals total transaction weight divided by four, rounded up.

In a hypothetical one-signature transaction with 400 weight units of other data and a fee rate of 10 satoshis per virtual byte, a 548-byte signature would produce 948 weight units, or 237 virtual bytes, costing 2,370 satoshis. A 4,619-byte signature would produce 5,019 weight units, or 1,255 virtual bytes, costing 12,550 satoshis. The 5,777-byte stateless signature would produce 6,177 weight units, or 1,545 virtual bytes, costing 15,450 satoshis.

The stateless option would therefore cost 13,080 satoshis more than the smallest stateful option in that example, or 2,900 satoshis more than the largest stateful option. Actual costs would vary with each transaction’s inputs, outputs and other data.

Coinbase has stated that its custody business holds about 12% of existing bitcoin. The company’s article described SHRINCS as a candidate for further evaluation. Its security proof and fully optimized implementation remain unfinished.