The countdown to the imminent collapse of current cybersecurity technology is a small handful of years away. The clock is ticking down, and the attack, although expected, will be lethal unless a solution can be adopted against an impending quantum computer attack. Bitcoin, or one of the other cyber currencies, will probably be the first to fall from an attack by a quantum criminal enterprise.

In 2016, the internet equivalent of Paul Revere rode out from the University of Waterloo’s Institute for Quantum Computing, warning that the tools used to create public-key encryption could be broken by 2026. It’s critical that decisions be made today to meet this threat, said Michele Mosca, co-founder of the institute.

He placed the odds of cracking the public-key cryptography by 2026 at 1 in 7. The odds increase to 50-50 by 2031.

“Right now, our cyber immune system is not ready for the quantum threat,” Mosca said in CSO, a cyber-security website. “There is a pending lethal attack, and the clock is ticking to design and deploy the cure before the threat is realized.” And it’s likely that threat will target Bitcoin.

Canary in the Coal Mine

Bitcoin has rightfully earned the dubious title of “Canary in the Coal Mine” because numerous financial analysts expect that the first target of a quantum computer criminal will be mining the entire lode of Bitcoin; it’s a big, juicy target.

The present market capitalization of the world’s cryptocurrencies sits at slightly north of $250 billion, according to the website CoinMarketCap. Previously, cryptocurrencies hit a cap of $800 billion in early 2018 before falling off the cliff. That’s a lot of coin sitting in the field for easy picking, and the quantum computer is the internet cotton gin that can do the picking.

The existing math problems of mining Bitcoin became “instantly solvable” with a quantum computer, said Alex Beath, a physicist and pension fund analyst quoted in a Fortune magazine article.

Bitcoin, though, is merely the proverbial tip of the iceberg. Bitcoin’s vulnerability also reflects onto online merchants and banks. Both use similar cryptographic security schemes. Advanced encryption standard (AES) and secure hash algorithm (SHA256) encryption, for example, will likely become weaker once quantum computing enters the arena.

Quantum thieves could easily undermine market trust in Bitcoin by sneaking in and stealing Bitcoin funds without detection.

Cryptocurrencies now rely on algorithms that are used to move and store bitcoins. These algorithms allow users to generate cryptographic private and public keys. The public keys are created to receive cryptocurrencies, the private keys enable users to spend the cryptocurrencies. This public/private generation of encryption keys provides security.

Connecting the Dots

Quantum computers will have the power to unwind these digital signature algorithms as they pass through the internet, revealing the private keys. In theory, quantum computers would be powerful enough to find and link private and public keys. The task for crypto-security experts is to replace the digital algorithms with a more secure solution.

So the question becomes this: Will the sheriff’s posse arrive in time to stop the bad guys from riding over the hill with a trillion dollars of stolen loot?

Back in 2013, Bitcoin magazine published an article by Vitalik Buterin speculating on how to stop the bitcoin bad guys. In its simplest terms, the defense of bitcoins involved removing all bitcoins from an address that received them and moving them into a new and unused address. This movement resulted in stronger encryption guarantees. In the article, the writer asserts that the bitcoins are now safe from even quantum attacks. Now, what about the problem of spending the bitcoins stored in the unused address?

A bitcoin transaction is necessary before anyone can spend them. That means creating a signature and a public key to verify ownership of the Bitcoins from the private key. Unfortunately, doing so releases all the information needed for a quantum user to impersonate the bitcoin owner. Bye-bye Bitcoin.

The magazine suggests a possible solution to protect bitcoins by using Lamport signatures combined with the Merkle signature scheme. This scheme allows for signatures to be used perhaps thousands of times before retiring a private key.

Preparing for Attack

Now, pretend that, out of the blue, an evil Dr. Doom pulls a quantum computer from his broom closet and announces that he will drain all Bitcoin accounts within two weeks, years before an expected quantum attack.

Bitcoin magazine suggests that bitcoin holders move their coins between an address generated by the Lamport scheme and an unused Bitcoin address. Developers would get tasked with creating Lamport patches for bitcoin holders and issue a call to upgrade immediately. That will create a temporary safe harbor. Trusted companies can act as nodes by implementing a Merkle signature scheme to provide additional security to bitcoin transactions.

Another promising project is Quantum Resistant Ledger (QRL), who position themselves as being secure “not just against today’s computers, but tomorrow’s quantum-computers as well.”

Other Bitcoin security possibilities coming down the cyber-road might involve a scheme called ideal lattice cryptography. It would be resistant to quantum attacks and come with privacy features cooked in. Ideal lattice would feature stealth addresses and unlinkable ring signatures. This scheme is so elaborate, however, that new families of cryptocurrencies would need to be created.

What cryptocurrency researchers emphasize over and over again is for cryptocurrency traders to be ready and watch the tracks. Quantum computer attacks are chugging down that track, but nobody knows precisely when they will arrive.

Mosca laid out the warning with equal parts of brevity and emphasis:

“Right now, our cyber immune system is not ready for the quantum threat. There is a pending lethal attack, and the clock is ticking to design and deploy the cure before the threat is realized.’

---

This article was updated on June 11th 2019 to correct several inaccuracies and errors:

• The article incorrectly stated that quantum computing would make brute force attacks instant. In reality they will be made quicker, but not instant.
• The article was updated to reflect that AES and SHA256 may be weakened by quantum computing (not beaten, as previously implied).
• The article incorrectly stated that Quantum Resistant Ledger were collaborating with Hcash. No such collaboration exists and so this has been removed.