Subject: Re: [bitcoindev] OP_CAT Enables Winternitz Signatures

From: Jonas Nick <[email-masked]>
Date: Tue, 8 Jul 2025 08:07:08 +0000

> Agreed. AFAICT, the only reason we'd use WOTS+ over stock
 > WOTS (w/o randomizers) would be if we wanted to use a less
 > collision-resistant hash algo (RMD160) as the primary hash
 > function.

When using RMD160 in WOTS+ instead of SHA256, you reduce the security level to
80 bits. Roughly speaking, while WOTS+ relies only on preimage resistance,
quantum computers get a quadratic speedup finding preimages due to Grover's
algorithm. A more detailed analysis of this is in [0] (see Theorem 2 and Table
1).

 > Would OP_HASH160 (aka rmd160(sha256(...))) be a
 > possible contender for the hash function here, to shrink
 > the witness size further while still retaining some of the
 > collision resistance of SHA256?

I'm probably missing something, but I don't see how this would work because you
can find a collision with about 2^80 queries.

[0] https://eprint.iacr.org/2015/1256.pdf (This should have been link [5] in the
     previous email, sorry)

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email-masked].
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/f7f72e13-eaa1-4837-9ba0-4b8d1eddf160%40gmail.com.