How Can Bitcoin Resist Quantum Computers? A Comparison of Three Lattice-Based Signature Schemes
- Blockstream Research released a comprehensive report analyzing lattice-based signatures as post-quantum alternatives to Bitcoin's current Schnorr and ECDSA signatures, which could be broken by sufficiently powerful quantum computers.
- The report evaluates three lattice-based signature schemes—Dilithium, Falcon, and Hawk—across four criteria: on-chain cost, implementation complexity, deployment risk, and development potential.
- Bitcoin should adopt at least NIST security level 3 for post-quantum signatures due to the long-term nature of cryptocurrency holdings and the need to account for future cryptanalysis advances.
- Dilithium, standardized by NIST as ML-DSA, features simple integer-only operations without floating-point arithmetic, making it easier to implement securely and is already integrated into major cryptographic libraries.
- None of the currently standardized post-quantum signature schemes natively support Bitcoin's BIP-32 hierarchical deterministic key derivation mechanism, requiring additional development work for wallet compatibility.
Blockstream Research has published a detailed analysis of lattice-based cryptographic signatures as potential post-quantum solutions for Bitcoin. The research addresses the long-standing concern that quantum computers could eventually break Bitcoin's current digital signature schemes—Schnorr and ECDSA—which were proven vulnerable to quantum attacks in 1994. The report examines three candidate schemes: Dilithium, Falcon, and Hawk, evaluating their feasibility for blockchain deployment.
The evaluation framework focuses on four critical dimensions specific to Bitcoin's constraints. On-chain cost is paramount, as both public keys and signatures must be stored on the blockchain and verified by all network nodes; lattice-based signatures can achieve total sizes under 1.6 kilobytes. Implementation complexity is equally important, as schemes requiring floating-point arithmetic or complex sampling procedures pose security risks through side-channel attacks. Deployment risk considers practical integration challenges such as hash function compatibility and hardware wallet memory constraints. Development potential examines whether schemes can support Bitcoin's widely-used BIP-32 hierarchical deterministic key derivation, which none of the current post-quantum standards natively support.
The report recommends that Bitcoin adopt at least NIST security level 3 for post-quantum signatures, rejecting lower security levels despite their smaller size. This conservative approach reflects Bitcoin's exceptionally long security horizon—assets may remain unspent for decades—and accounts for potential future cryptanalysis breakthroughs. Dilithium emerges as the most practical candidate, having been standardized as ML-DSA by NIST and already integrated into major cryptographic libraries including OpenSSL and Apple CryptoKit. Its primary advantage is operational simplicity, relying entirely on integer arithmetic without floating-point operations or Gaussian sampling, making secure implementation more straightforward.
比特币如何抵御量子计算机？三种基于格的签名方案对比
Blockstream Research发布了一份详细分析，研究基于格的密码签名作为比特币的潜在后量子解决方案。该研究针对一个长期存在的担忧：量子计算机最终可能破解比特币当前的数字签名方案——Schnorr和ECDSA，这两种方案在1994年被证明容易受到量子攻击。报告审视了三个候选方案：Dilithium、Falcon和Hawk，评估它们在区块链部署中的可行性。
评估框架围绕比特币约束条件下的四个关键维度展开。链上成本至关重要，因为公钥和签名都必须存储在区块链上并由所有网络节点验证；基于格的签名可以实现总大小低于1.6KB。实现复杂性同样重要，因为需要浮点运算或复杂采样的方案会通过侧信道攻击造成安全风险。部署风险考虑实际集成挑战，如哈希函数兼容性和硬件钱包内存限制。发展潜力审视方案是否能支持比特币广泛使用的BIP-32分层确定性密钥推导，而当前所有后量子标准都不原生支持此功能。
报告建议比特币采用至少NIST安全等级3的后量子签名，拒绝接受更低的安全等级尽管它们体积更小。这种保守做法反映了比特币异常长的安全时间跨度——资产可能数十年保持未花费状态——并为未来密码分析突破预留余地。Dilithium成为最实用的候选方案，已被NIST标准化为ML-DSA并已集成到包括OpenSSL和Apple CryptoKit在内的主要密码库中。其主要优势是操作简洁性，完全依赖整数运算，无需浮点运算或高斯采样，使安全实现更加直接。