Subject: Re: [bitcoindev] P2QRH / BIP-360 Update

From: Jose Storopoli <[email-masked]>
Date: Wed, 12 Mar 2025 04:14:06 -0700 (PDT)

I think that ECDSA was a mistake in Bitcoin (Schnorr patent expired in 
2008; but I do understand its motives).
My fear is that this BIP will become a mistake in Bitcoin in 15 years or 
less.

It adds orders of magnitude to public keys sizes and/or signature sizes; 
and verification computation cost.
About the whole QR cryptography hype:
one thing is to do have key encapsulation QR schemes in symmetric-key 
cryptography where we don't have tight constrains around storage,
like with TLS, or E2EE messaging apps.
Another thing is to add these huge public key and signature schemes to a 
storage-restricted blockchain like Bitcoin.
QR lattice-based asymmetric-key cryptography is still in its infancy both 
in standards and research; and we should wait.

If we are worried about quantum menaces, a much better approach would be 
the P2TRH (Pay To Taproot Hash),
even with the loss of batch verification, combined with advising users to 
not re-use address.
Address reuse should be treated the same as nonce reuse: you get pwned!
Or Matt Corallo's emergency disable of key path spends in P2TR;

Jose Storopoli

On Monday, March 3, 2025 at 6:55:19 PM UTC-3 Hunter Beast wrote:

> Hi, Jonas
>
> In order to spend the coins, a valid signature will need to be present in 
> the attestation. Even if it's a 1/1024 multisig, a valid public key 
> signature pair will need to be provided. The merkle path would then be how 
> the arbitrary data could be encoded. In my mind this is a highly 
> impractical scenario that gets exponentially more complex, and only works 
> 32 bytes at a time.
>
> Does that make sense?
>
> Hunter
>
> On Wednesday, February 26, 2025 at 3:00:36 AM UTC-7 Jonas Nick wrote:
>
>> > it would require an extraordinary amount of computation to wind up with 
>> enough 
>> > to store arbitrary data. 
>>
>> I have no idea why this would require extraordinary amount of 
>> computation. In 
>> the example I provided, arbitrary data can be included in the attestation 
>> structure with zero additional computational cost, no elliptic curve 
>> grinding or 
>> hash collisions required. 
>>
>

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email-masked].
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/77dbf51a-93aa-4d4a-87c0-b1303d83d5ccn%40googlegroups.com.