I think that ECDSA was a mistake in Bitcoin (Schnorr patent expired in 2008; but I do understand its motives).

My fear is that this BIP will become a mistake in Bitcoin in 15 years or less.

It adds orders of magnitude to public keys sizes and/or signature sizes; and verification computation cost.

About the whole QR cryptography hype:

one thing is to do have key encapsulation QR schemes in symmetric-key cryptography where we don't have tight constrains around storage,

like with TLS, or E2EE messaging apps.

Another thing is to add these huge public key and signature schemes to a storage-restricted blockchain like Bitcoin.

QR lattice-based asymmetric-key cryptography is still in its infancy both in standards and research; and we should wait.

If we are worried about quantum menaces, a much better approach would be the P2TRH (Pay To Taproot Hash),

even with the loss of batch verification, combined with advising users to not re-use address.

Address reuse should be treated the same as nonce reuse: you get pwned!

Or Matt Corallo's emergency disable of key path spends in P2TR;

Jose Storopoli

On Monday, March 3, 2025 at 6:55:19 PM UTC-3 Hunter Beast wrote:

Hi, Jonas

In order to spend the coins, a valid signature will need to be present in the attestation. Even if it's a 1/1024 multisig, a valid public key signature pair will need to be provided. The merkle path would then be how the arbitrary data could be encoded. In my mind this is a highly impractical scenario that gets exponentially more complex, and only works 32 bytes at a time.

Does that make sense?

Hunter

On Wednesday, February 26, 2025 at 3:00:36 AM UTC-7 Jonas Nick wrote:

> it would require an extraordinary amount of computation to wind up with enough
> to store arbitrary data.

I have no idea why this would require extraordinary amount of computation. In
the example I provided, arbitrary data can be included in the attestation
structure with zero additional computational cost, no elliptic curve grinding or
hash collisions required.