How Can Bitcoin Resist Quantum Computers? A Comparison of Three Lattice-Based Signature Schemes
- Blockstream Research released a comprehensive report analyzing lattice-based signatures as post-quantum alternatives to Bitcoin's current Schnorr and ECDSA signatures, which could be broken by sufficiently powerful quantum computers.
- The report evaluates three lattice-based schemes—Dilithium, Falcon, and Hawk—across four criteria: on-chain cost, implementation complexity, deployment risk, and development potential.
- Bitcoin should adopt at least NIST security level 3 for post-quantum signatures to protect assets that may remain unspent for decades against future cryptanalysis advances.
- Dilithium (standardized as ML-DSA) features simple integer-only operations without floating-point arithmetic, making secure implementation easier, and is already integrated into major cryptographic libraries like OpenSSL and Apple CryptoKit.
- None of the currently standardized post-quantum signature schemes natively support Bitcoin's BIP-32 hierarchical deterministic key derivation mechanism, requiring additional development work for wallet compatibility.
Blockstream Research has published a detailed analysis of lattice-based signature schemes as potential post-quantum replacements for Bitcoin's current digital signature mechanisms. The research addresses the theoretical threat posed by quantum computers, which could break existing Schnorr and ECDSA signatures according to Shor's 1994 algorithm, though the timeline for such capabilities remains uncertain. The report emphasizes the need for a viable deployment plan before quantum threats materialize.
The analysis compares three candidate schemes—Dilithium, Falcon, and Hawk—using four key evaluation criteria tailored to Bitcoin's constraints. On-chain cost is critical since both public keys and signatures must be stored on the blockchain; verification efficiency matters because every node must validate signatures. Implementation complexity is essential to avoid security flaws and side-channel attacks, while deployment risk encompasses practical challenges like hash function compatibility and hardware wallet memory constraints. The report also examines how these schemes could support Bitcoin's widely-used BIP-32 hierarchical deterministic key derivation, which none currently support natively.
The researchers recommend Bitcoin adopt at least NIST security level 3 rather than level 1, citing Bitcoin's decades-long asset holding horizon and the need to maintain security margins against future cryptanalysis. This conservative approach aligns with decisions by Apple and Cloudflare in their post-quantum deployments. Dilithium emerges as the most implementable candidate due to its integer-only operations and existing integration into major cryptographic libraries, though it comes with larger signature sizes compared to alternatives.
比特币如何抵御量子计算机？三种格基签名方案对比
Blockstream研究团队发布了关于格基签名方案的详细分析，探讨其作为比特币现有数字签名机制的后量子替代方案的可行性。该研究针对量子计算机的理论威胁，根据1994年Shor算法，量子计算机可能破解现有的Schnorr和ECDSA签名，尽管这类能力出现的时间表仍不确定。报告强调需要在量子威胁真正出现前制定可行的部署计划。
该分析对比了三种候选方案——Dilithium、Falcon和Hawk，使用了四个针对比特币约束条件的关键评估维度。链上成本至关重要，因为公钥和签名都必须存储在区块链上；验证效率很重要，因为每个节点都必须验证签名。实现复杂性对于避免安全漏洞和侧信道攻击至关重要，而部署风险涵盖哈希函数兼容性和硬件钱包内存约束等实际挑战。报告还研究了这些方案如何支持比特币广泛使用的BIP-32分层确定性密钥推导，目前没有方案原生支持此功能。
研究人员建议比特币采用至少NIST安全等级3而非等级1，理由是比特币的数十年资产持有周期和需要对未来密码分析进展保持安全边际。这一保守方法与Apple和Cloudflare在后量子部署中的决策一致。Dilithium因其纯整数运算和已集成到主要密码库中而成为最可实现的候选方案，尽管其签名大小相比其他方案更大。