Vitalik’s new article: If a quantum attack comes tomorrow, how will Ethereum respond?

Original title: How to hard-fork to save most users' funds in a quantum emergency

Original author: Vitalik Buterin

Original compilation: Azuma, Odaily Planet Daily

On March 9, Ethereum co-founder Vitalik Buterin spoke on the Ethereum Research Forum (ethresear.ch) about "How to avoid sudden quantum attacks through hard forks." Published a short article titled "Rescuing User Funds from China".

In the article, Vitalik outlines how Ethereum can minimize the loss of user funds in an emergency and what procedures it should use to redirect if a quantum attack comes tomorrow. Anti-quantum form, and then resume normal operation.  

The following is Vitalik The full text is compiled by Odaily Planet Daily.

Suppose a quantum computer is available tomorrow and criminals have somehow gained access to it and want to use it to steal user funds. what should we do?

Quantum-resistant technologies such as Winternitz signatures and STARKs were developed precisely to prevent this from happening. Once the account abstraction is ready, any Users can randomly switch to a quantum-resistant signature scheme. But if we don’t have that much time, what should we do if a quantum attack arrives more suddenly than everyone thinks?

I think,In fact, we currently have the ability to solve this problem through a relatively simple recovery fork. sufficient conditions for the problem. With this solution, the Ethereum network will have to undergo a hard fork and users will have to download new wallet software, but only a small number of users may lose their funds.  

The main threats of quantum attacks are as follows. The Ethereum address is obtained by operating the keccak(priv_to_pub(k))[ 12:] function, where k corresponds to the private key and priv_to_pub corresponds to an elliptic curve multiplication used to convert the private key into a public key.

When quantum computing is realized, the above elliptic curve multiplication will become reversible (because this is actually the solution to the discrete logarithm problem), but the hash operation is still safe. If the user has not made any transactions, then only the address information is disclosed, in which case they will still be safe; but as long as the user has made even one transaction, the transaction signature will expose the public key, which is impossible in quantum computers. There is the possibility of exposing the private key. So in this case, most users will be at risk.

But we actually have ways to mitigate this threat. The key point is that in practice, most users’ private keys are processed through a series of hash operations. produced. For example, many private keys are generated using the BIP-32 specification, which is generated through a series of hash operations based on a set of mnemonic words; many non-BIP-32 private key generation methods are almost similar, for example, if the user uses It is a brain wallet, which is usually generated by a series of hash operations (or a moderately difficult key derivation function) of a password.  

This means that the solution to sudden quantum attacks through restorative forks would take the following steps:

First, roll back all blocks after the large-scale attack;

Second, disable EOA address-based Traditional transaction model;

Third, (if it has not been implemented by then) add a new transaction type to allow through smart contract wallets (such as RIP- 7560) for transactions;

Fourth, add a new transaction type or operation code, through which users can provide STARK proof. If the proof passes, The code of the user's address will be switched to the new verified code, and then the user can use the new code address as a smart contract wallet.

Fifth, in order to save Gas, due to the large amount of data in the STARK proof, we will support batch STARK proofs to conduct multiple transactions of the above types at the same time. STARK proof.

In principle, tomorrow we could begin work on the infrastructure needed to implement this restorative fork, allowing the Ethereum ecosystem to survive emergencies Be prepared for a quantum attack.

Original link