Bitcoin’s post-quantum migration debate has moved toward wallet security and dormant-coin handling after Ledger CTO Charles Guillemet argued that choosing a new signature scheme may prove easier than moving Bitcoin users and existing funds safely.
Summary
- Ledger CTO Charles Guillemet says Bitcoin faces a migration challenge, not an immediate quantum crisis.
- SHRINCS combines stateful signatures with a stateless fallback while relying on SHA-256 for security today.
- Current SHRINCS signatures range from 548 bytes to 5,777 bytes, depending on the signing path.
- Reusing one stateful signing slot can enable forged signatures, creating serious wallet-level fund theft risks.
- Bitcoin BIPs 360 and 361 remain drafts, leaving post-quantum migration policy unresolved across the network.
Ledger CTO Charles Guillemet said in a technical analysis published by Ledger that “Bitcoin does not have a quantum computer problem today,” while warning that migration research, software implementation, hardware-wallet changes and user adoption could take years. He said no cryptographically relevant quantum computer capable of breaking Bitcoin’s current signatures is known to exist today, while the timing of such a machine remains uncertain.
His review focuses on SHRINCS, a draft Bitcoin-specific post-quantum signature proposal that combines a smaller stateful signing mechanism with a larger stateless recovery path. The specification remains unfinished, carries no assigned BIP number and states that its formal “security proof is TODO.”
Bitcoin migration involves more than choosing cryptography
Guillemet divided the transition into three problems: selecting a post-quantum signature scheme, adapting Bitcoin wallets and protocol infrastructure to that scheme, and deciding how existing BTC should move to quantum-resistant outputs. The final problem includes coins whose owners may have lost their keys or have not moved funds for many years.
Bitcoin’s current transaction authorization relies heavily on ECDSA and Schnorr signatures built on elliptic-curve cryptography. A sufficiently capable quantum computer running Shor’s algorithm could theoretically recover private keys from exposed public keys, but no publicly demonstrated machine can perform that attack against Bitcoin today.
Guillemet said migration cannot be judged solely by the cryptographic strength of a replacement scheme because wallets, hardware devices, backup systems and multi-device setups must implement it safely. He described reaching social agreement over vulnerable legacy coins as one of the harder unresolved questions.
A similar position has emerged from other cryptographers. Stanford cryptographer Dan Boneh has argued that Bitcoin should prepare for quantum risk while avoiding a rushed migration that could introduce severe software failures.
SHRINCS trades smaller signatures for wallet state
The current SHRINCS draft specification describes a hash-based system built around SHA-256, the same hash family already used extensively by Bitcoin. Its designers target approximately 128 bits of classical security and 64 bits of quantum security under their chosen parameters.
Its 48-byte public key commits to two signing paths. The compact route uses Flexible XMSS and WOTS+C, producing stateful signatures from 548 bytes up to 4,619 bytes. A stateless fallback based on SLH-DSA concepts produces a 5,777-byte signature.
NIST standardized SLH-DSA as FIPS 205 in August 2024. The standard itself is stateless and based on SPHINCS+, while the SHRINCS draft uses a custom parameter configuration alongside its separate stateful component.
The newer numbers are important because an earlier version of SHRINCS produced a frequently cited 324-byte stateful signature. Guillemet said that figure no longer describes the current Bitcoin draft. The September specification starts at 548 bytes for its stateful route.
Blockstream Research has argued that hash-based signatures offer conservative cryptographic assumptions and relatively cheap verification. Its May research noted that standardized post-quantum signatures are much larger than Bitcoin’s current 64-byte Schnorr signatures, creating pressure on block space and transaction throughput.
Blockstream has already demonstrated SHRINCS verification on the Liquid sidechain through Simplicity, but that experiment does not mean the scheme is active on Bitcoin mainnet. The Bitcoin specification remains research work requiring review and consensus before any network deployment.
Stateful signatures create a new wallet failure mode
The compact SHRINCS path requires every one-time signing key to be used only once. A wallet therefore maintains a counter identifying which signing slot should be used next, and that counter must move forward permanently before a signature leaves the device.
If a wallet uses the same signing slot for two different messages, information exposed by the signatures may let an observer forge a valid signature. Guillemet wrote that the attacker does not necessarily recover the entire private seed, but the affected user’s funds can still become stealable.
Backups create another problem. Restoring a wallet from an older copy could restore an outdated counter. Two hardware devices initialized from the same seed could face the same risk if they independently use the stateful path without coordinating which one-time keys have already been consumed.
An independentProject Eleven review of SHRINCS reached a similar conclusion. Researchers Alex Pruden and Conor Deegan said the scheme transfers a security-critical state requirement into wallets and custodial systems, where backup restoration or state rollback could lead to reuse of a one-time key.
SHRINCS provides a fallback when the state is lost or uncertain. The original seed can still derive the stateless signing key, allowing funds to move using the 5,777-byte signature. The wallet must permanently stop using the compact stateful route for that key once its counter can no longer be trusted.
Guillemet described this property as one of SHRINCS’ stronger design choices because losing state affects efficiency without automatically making the coins unspendable.
Current wallet features would not transfer cleanly
The move from elliptic-curve signatures to hash-based signatures would change several wallet tools Bitcoin users rely on today. Non-hardened BIP32 derivation lets an extended public key generate child public keys without exposing private keys, supporting common watch-only wallet designs. Guillemet said an efficient equivalent does not naturally carry over to hash-based signatures.
Threshold signing presents a related problem. Schnorr-based systems can combine participants efficiently, while known hash-based alternatives tend to require larger signatures, more storage or communication, or different trust assumptions. Guillemet said SHRINCS should not be expected to provide a compact drop-in replacement for current Schnorr threshold systems.
Hardware performance remains another constraint. Ledger’s analysis says post-quantum key generation and the stateless SHRINCS path can take minutes on some secure hardware because the process performs many SHA-256 operations and requires more memory than Schnorr signing.
Blockstream’s research frames the tradeoff differently, arguing that SHRINCS verification is dominated by SHA-256 calculations and can therefore remain computationally manageable even when signatures consume more bytes. The current draft claims its worst-case verification cost per signature byte is below that of BIP340 Schnorr.
Bitcoin has no adopted post-quantum migration yet
SHRINCS is only one part of the current Bitcoin quantum-security discussion. BIP 360, called Pay-to-Merkle-Root, is a separate Draft proposal designed to remove Taproot’s quantum-vulnerable key-path spend and protect users against long-exposure attacks.
BIP 360 does not itself introduce a post-quantum signature algorithm. Its authors state that short-exposure attacks, where an attacker derives a private key after a transaction reveals its public key but before confirmation, may require a future post-quantum signature scheme.
BIP 361 addresses the migration problem more directly. The Draft proposal describes a phased sunset of legacy ECDSA and Schnorr spending after a post-quantum output mechanism becomes available. Its proposed schedule includes an initial migration period followed later by tighter restrictions on legacy signatures.
As crypto.news reported in its BIP 360 and BIP 361 review, one unresolved issue is what should happen to vulnerable BTC that never migrates. Possible approaches can affect coins believed lost, abandoned or controlled by owners who cannot participate in a future upgrade.
Coinbase’s independent cryptography advisory board has separately called for migration planning to begin before a quantum attacker exists.The board supported preparation while leaving questions over freezing or handling legacy coins to the Bitcoin community.
The official Bitcoin BIP repository still lists both BIP 360 and BIP 361 as Draft as of Sept. 17. SHRINCS itself remains an unnumbered draft specification, with its authors warning that the cryptography is prototype work requiring further peer review and a completed security proof.
FAQs
Is Bitcoin vulnerable to quantum computers today?
No publicly demonstrated quantum computer can currently recover Bitcoin private keys from its elliptic-curve public keys. Guillemet describes the immediate challenge as preparing a migration before such hardware becomes practical.
Has Bitcoin adopted SHRINCS?
No. SHRINCS is an experimental draft specification without an assigned BIP number. It is not activated in Bitcoin Core or Bitcoin consensus rules.
What happens if a SHRINCS wallet loses its signing state?
The current design allows the seed to recover a stateless signing path, producing a larger 5,777-byte signature. The wallet should not resume compact stateful signing when its previous counter cannot be trusted.
Why is reused SHRINCS state dangerous?
Its compact route relies on one-time signing keys. Reusing the same slot for different messages can expose enough information to permit forged signatures and possible fund theft.
Are BIP 360 and BIP 361 active?
No. The canonical Bitcoin BIP repository currently lists both proposals as Draft. Neither has been activated as a Bitcoin consensus change.
Be the first to comment