Today, Google Quantum AI published a research paper that might boost the post-quantum migration. Their team has tailored Shorâs algorithm to solve the 256-bit Elliptic Curve Discrete Logarithm Problem. ECDLP is the hard mathematical problem that secures ECDSA: the signature scheme underpinning most blockchains, TLS certificates, and countless authentication systems, using fewer than 1,200 logical qubits and 90 million Toffoli gates. Translated to hardware: fewer than 500,000 physical qubits, executing in a few minutes.
A few minutes. Less than a Bitcoin block time. Less than two Ethereum epochs.
The long-standing argument that public keys can simply remain hidden is now moot (In fact, it has always been
x.com/P3b7_/status/198854349âŠ).
What exactly changed
Shor's algorithm has been known since 1994 as a generic quantum approach to factoring integers and computing discrete logarithms. But "known" and "practical" are very different things. The real progress is in the engineering: how many qubits and gates you actually need once you compile the algorithm into a fault-tolerant quantum circuit.
The last breakthrough by the INRIA Rennes team required ~2,100 logical qubit count for ECDLP. Google's engineers optimized the full circuit stack to ~1,200 logical Qubits.
The recent algorithmic trendline is clear: every 12-18 months, the resource estimates drop significantly. And these are pure algorithmic gains: they compound on top of hardware improvements, which remain a major challenge.
However, as of today, we're still far from having such a quantum computer. This didn't change.
Zero Knowledge Proof
Here's where it gets interesting. Google chose not to publish their optimized circuits. Instead, they released a zero-knowledge proof that their circuits achieve the claimed resource counts. We have no doubt they know how to do it, but no clue how (sounds magic ;-))
The reasons are likely multiple: competitive advantage, national security implications, or simply not wanting to hand a blueprint to adversaries. Regardless, it establishes a powerful (and elegant) precedent.
Whatâs ironic: Google's ZK proof is not itself post-quantum secure.
Whatâs next?
The good news is that we already have the tools: Post Quantum Cryptography, now we need to migrate.
A few days ago, Google announced it is targeting 2029 for full post-quantum readiness. NIST plans to deprecate RSA signatures by 2030 and disallow all legacy algorithms by 2035.
Most organizations haven't started their cryptographic inventory. Major blockchain protocols are currently discussing the path forward.
Cryptography exists to create mathematical trust in the security of systems. That trust is now being eroded, not by a working attack, but by the increasingly credible prospect of one. In security, the moment you start doubting the foundation is the moment you should be rebuilding it.
What this means for blockchains
For blockchain ecosystems specifically, the threat is central. ECDSA on secp256k1 (Bitcoin) and P-256 curves (broadly used elsewhere) is the cornerstone of security. Unlike traditional systems where you can rotate certificates behind a corporate firewall, blockchain migration requires coordination across decentralized, permissionless networks. This process will likely take time.
I'll be diving deeper into the concrete challenges and strategies for PQC migration on blockchains and secure systems at my keynote this Thursday at EthCC conference.
The ongoing debate on quantum-safe Bitcoin address formats misses the point!
A quantum computer capable of breaking modern cryptography could compute private keys from public keys. Some therefore argue that hiding public keys (by hashing them) would keep users safe. Technically, thatâs true, if an attacker doesnât know the public key, they canât compute the private key.
However, this argument is fundamentally flawed for several reasons:
1. Public keys are meant to be public.
Every cryptographic protocol, including Bitcoin, treats public keys as public information. No wallet or protocol is designed to keep them secret. Bitcoinâs security cannot depend on the assumption that public keys should remain hidden.
2. Public keys are revealed when spending.
When you spend Bitcoin, your public key becomes visible on-chain, creating an attack window. This risk is even greater if you reuse the same address, a poor practice, but one thatâs still fairly common.
3. Many coins already expose their public keys.
A large portion of on-chain BTC, including Satoshiâs coins, already have public keys visible. If a quantum computer capable of breaking modern cryptography suddenly appeared, attackers could start draining these coins. That would cause massive panic, undermining trust in the protocol and collapsing Bitcoinâs perceived value, even if your coins are behind SegWit.
In short: if a quantum computer powerful enough to break current cryptography appeared tomorrow, SegWit wouldnât protect your Bitcoinâs value.
While such an event seems unlikely to me in the near term, itâs not impossible, and the risk isnât worth ignoring.
The prudent move would be to proactively upgrade the Bitcoin protocol to make it quantum-resistant and define a migration path, including a strategy for âlostâ coins (like Satoshiâs).
Of course, such a migration comes with trade-offs. Lattice-based post-quantum cryptography hasnât yet stood the test of time, and hash-based schemes feel archaic. Weâd also need to rethink BIP32 and would lose Schnorrâs additive signature benefits for multisig setups.
Still, Bitcoinâs value depends on trust, trust that the protocol is robust, secure, and technologically sound. If that trust erodes, so does Bitcoinâs value.