Ledger CTO Warns Bitcoin’s Quantum Migration Could Take Years as Wallet Risks Come Into Focus

Bitcoin does not face a near-term quantum-computing threat, according to Ledger chief technology officer Charles Guillemet, though it may take years to prepare the network for a post-quantum world.

Guillemet analyzed SHRINCS, an unfinished Bitcoin-specific hash-based scheme consisting of a short stateful signing path based on Flexible XMSS and WOTS+C signatures. It also contains a long stateless recovery path based on ideas from the SLH-DSA signature algorithm.

The target security level for this specification is about 128 bits of classical security and 64 bits of quantum security, but it is still in draft form without a full security proof.

Bitcoin wallets today use ECDSA and Schnorr signatures, which could be broken by a quantum computer running Shor’s algorithm, should such a cryptographically relevant quantum computer be practical and built — no such quantum computer is publicly known to exist.

Illustrating the difficulty of the problem, SHRINCS stateful signatures vary between 548 and 4,619 bytes, and the stateless fallback is 5,777 bytes, compared to Schnorr signatures, which are 64 bytes.

The compact path means that no one-time signing key can be reused, which implies that restoring from an old backup or from cloned devices may result in loss of funds.