How Can Bitcoin Resist Quantum Computers? A Comparison of Three Lattice-Based Signature Schemes
- Blockstream Research released a comprehensive report analyzing lattice-based signatures as post-quantum alternatives to Bitcoin's current Schnorr and ECDSA signatures, which could be broken by sufficiently powerful quantum computers.
- The report evaluates three lattice-based schemes—Dilithium, Falcon, and Hawk—across four dimensions: on-chain cost, implementation complexity, deployment risk, and development potential.
- Bitcoin should adopt at least NIST security level 3 for post-quantum signatures due to the long-term nature of blockchain assets and the need to account for future cryptanalysis advances.
- Dilithium (standardized as ML-DSA by NIST) features simple integer-only operations without floating-point arithmetic, making secure implementation easier, and is already integrated into OpenSSL, BoringSSL, AWS-LC, and Apple CryptoKit.
- Lattice-based signatures can achieve total public key and signature sizes under 1.6 kilobytes and support advanced features like multisignatures, threshold signatures, and succinct proofs.
Blockstream Research has published a detailed analysis of lattice-based cryptographic signatures as potential post-quantum replacements for Bitcoin's current digital signature schemes. The research addresses the theoretical threat posed by quantum computers, which could break existing Schnorr and ECDSA signatures according to Shor's 1994 algorithm, though debate continues regarding when such machines will become practical.
The report evaluates three candidate schemes—Dilithium, Falcon, and Hawk—against criteria specific to Bitcoin's needs: on-chain transaction costs (public key and signature size), computational verification efficiency, implementation security complexity, deployment practicality, and compatibility with existing wallet infrastructure like BIP-32 hierarchical deterministic key derivation. Lattice-based cryptography offers advantages including compact signatures under 1.6 kilobytes and potential support for advanced features such as multisignatures and threshold signatures.
A key recommendation is that Bitcoin should adopt at least NIST security level 3 for post-quantum signatures, rather than the lower level 1, to account for the decades-long security horizon of blockchain assets and potential future cryptanalysis breakthroughs. Dilithium, already standardized by NIST as ML-DSA and integrated into major cryptographic libraries, is highlighted as having the simplest design with integer-only operations, making secure implementation more straightforward than alternatives requiring floating-point arithmetic or complex sampling procedures.
比特币如何抵御量子计算机?三种格密码签名方案的比较
Blockstream研究团队发布了关于格密码签名的详细分析,将其作为比特币当前数字签名方案的潜在后量子替代品。研究针对量子计算机的理论威胁,根据1994年Shor算法,量子计算机可能破解现有的Schnorr和ECDSA签名,尽管关于此类机器何时具有实用性仍存在争议。
报告针对比特币特定需求评估了三种候选方案——Dilithium、Falcon和Hawk,标准包括:链上交易成本(公钥和签名大小)、计算验证效率、实现安全复杂性、部署实用性,以及与BIP-32分层确定性密钥推导等现有钱包基础设施的兼容性。格密码提供的优势包括签名大小低于1.6千字节,以及对多签名和阈值签名等高级功能的潜在支持。
一项关键建议是比特币应采用至少NIST安全等级3的后量子签名,而非较低的等级1,以应对区块链资产数十年的安全时间跨度和潜在的未来密码分析突破。Dilithium已被NIST标准化为ML-DSA并集成到主要密码库中,因其采用纯整数运算的最简设计而受关注,相比需要浮点算术或复杂采样程序的替代方案,更易实现安全的实现。