Coinbase Post-Quantum Bitcoin Upgrade Proposal

On October 21, Brian Armstrong shared Coinbase's latest approach to defending against quantum computer attacks and strengthening Bitcoin security.

Preparations began earlier this year in January when Coinbase established an independent quantum advisory committee, comprising cryptography researchers such as Scott Aaronson, Dan Boneh, and Justin Drake. In July of the same year, Coinbase joined forces with institutions like BlackRock, Fidelity, and Strategy to co-found the Bitcoin Security Alliance, committing $15 million over the next three years for research in the field of Bitcoin security. Today, Coinbase has fully outlined its comprehensive blueprint for building quantum-resistant Bitcoin, covering new address types, signature schemes, and strategies for migrating existing assets.

Designing an Iteratively Upgradeable Underlying Protocol

Coinbase's core philosophy: decouple the address container that stores Bitcoin from the signature mechanism that unlocks assets. The address container holds the Bitcoin, while the signature mechanism serves as the means to unlock the funds.

Currently, no one can predict which quantum-resistant signature scheme will ultimately offer the highest security and practicality in the long run. Therefore, Coinbase aims to design an address type compatible with multiple signature algorithms, eliminating the need to overhaul the entire address system when upgrading cryptographic protocols later on.

Coinbase proposes two alternative technical routes: BIP-360 (P2MR), which introduces a new type of Bitcoin address to reduce the exposure risk of quantum attacks; and P2TRv2, an address architecture capable of supporting quantum-resistant signatures.

While both approaches satisfy the flexibility Coinbase seeks, neither constitutes a complete standalone solution. BIP-360, in particular, still requires supplementary upgrades to support quantum-resistant signatures.

Coinbase also proposes a hybrid address concept: users can either use existing signatures or employ quantum-resistant signatures to spend the same funds. However, this approach has a drawback: as long as legacy signing methods remain valid, the funds remain vulnerable to quantum attacks. Hybrid addresses serve only as a transitional measure, not a long-term solution.

Selecting Suitable Signature Algorithms

After establishing the core principle that address designs must be flexible, the next critical question is: which quantum-resistant signature algorithm should Bitcoin adopt?

Coinbase has listed four candidate options:

• ML-DSA: Lattice-based cryptography, fully standardized, with well-rounded performance; downside is relatively large signature size.
• SLH-DSA: Also standardized, built upon mature hash functions; features a larger signature size than ML-DSA.
• FN-DSA (Falcon): Offers smaller signature sizes, but faces high implementation complexity for secure deployment and has yet to be standardized.
• SHRINCS: An experimental scheme designed specifically for Bitcoin, featuring small signature sizes but imposing extremely strict requirements on key management.

Coinbase proposes evaluating these four quantum-resistant signature candidates for Bitcoin: lattice-based ML-DSA and FN-DSA (Falcon), alongside hash-based SLH-DSA and SHRINCS, each with its own trade-offs regarding signature size, implementation difficulty, and NIST standardization status.

The primary conflict in choosing a scheme stems from signature size. Quantum-resistant signatures generate significantly larger data volumes compared to Bitcoin's current signatures, consuming more block space, potentially reducing network transaction throughput, and driving up transaction fees.

Therefore, Coinbase recommends evaluating different options across multiple dimensions, including security, cost, processing speed, hardware wallet compatibility, and the migration timeline for high-value Bitcoin assets.

Another factor requiring consideration is the key management model.

Stateful signatures: Require users to track the usage history of every signing key. If a key is accidentally reused after restoring from an old wallet backup, attackers could forge signatures and steal assets. Given the risks, why consider them? The advantage lies in efficiency. Stateful signatures can achieve smaller sizes, potentially maintaining lower fees, but at the cost of increased risk. Thus, Coinbase recommends that Bitcoin also support stateless signatures, which eliminate the need to track key usage states.

Additionally, Coinbase wants the signature scheme to accommodate institutional custodians. Many institutional custody services utilize multi-signature architectures where private keys are split across multiple servers. Some lattice-based schemes integrate better with this architecture, making compatibility another key evaluation metric.

Naturally, Coinbase itself has commercial considerations. As one of the largest Bitcoin custody providers, it hopes the upgrade will align with its own security infrastructure. However, given that institutions hold vast amounts of Bitcoin, their requirements are equally significant and cannot be overlooked for the broader Bitcoin ecosystem.

Phased Implementation of Asset Migration

Beyond selecting a signature scheme, Coinbase's objective is to establish a clear roadmap to gradually migrate Bitcoin assets to quantum-resistant addresses.

The proposal outlines five potential implementation phases:

1. Early Pilot Phase: Allows users to voluntarily transfer assets to quantum-resistant addresses.
2. Hybrid Address Phase: Enables hybrid addresses that support both traditional and quantum-resistant signatures, ensuring a smooth, gradual transition.
3. Secure Migration Phase: Explores techniques to hide public keys during transfers, minimizing the attack surface for quantum threats.
4. New Rules Implementation Phase: Gradually restricts transfers to vulnerable legacy addresses, ultimately prohibiting spending initiated from them.
5. Final Wrapping-Up Phase: Establishes disposal rules for remaining assets in legacy addresses, with options including setting migration deadlines, freezing assets, imposing transaction limits, or building asset recovery mechanisms.

Coinbase's proposed five-phase roadmap for migrating Bitcoin to quantum-resistant addresses: transitioning from voluntary user upgrades and hybrid address bridges, to hiding public keys to mitigate risk, gradually restricting legacy addresses, and finally determining how to handle stranded assets.

Coinbase has not finalized any definitive solutions. The immediate priority is to evaluate the feasibility of various options, including the compatibility of unupgraded wallets and nodes, before locking in the final approach.

Handling Dormant and Lost Bitcoins Separately

Next comes the most contentious issue: how should long-idle Bitcoins be handled?

Millions of Bitcoins reside in legacy addresses whose public keys have already been exposed, including Satoshi Nakamoto's early mining rewards. Some belong to long-term holders, while others may have been permanently lost.

These assets are prime targets for quantum attacks. If someone secretly develops a high-performance quantum computer, they could steal these Bitcoins before the rest of the industry realizes the risk.

Coinbase advocates neither outright freezing nor forced recovery, nor does it suggest doing nothing. Instead, it proposes treating the dormant coin controversy and signature upgrades as separate discussions, preventing disagreements over dormant Bitcoin from hindering the broader ecosystem's quantum security upgrade.

To build an asset recovery mechanism, Coinbase sets forth two non-negotiable prerequisites:

• The mechanism itself must be quantum-resistant: attackers must be unable to steal assets using only the compromised public key.
• It must cover all extreme scenarios: contingency plans must exist for cases where holders lose recovery credentials, systems face high load, or users miss deadlines.

In summary, Coinbase treats this proposal as a reference document for open discussion rather than a final implementation blueprint. No single company or developer can unilaterally dictate Bitcoin's future direction; reaching consensus across the entire ecosystem is arguably even more challenging than developing the cryptographic technology itself.

Join the official Coincamps community:

X: https://x.com/coincamps

Telegram: https://t.me/coin_camps