Bitcoin quantum migration may take years, Ledger CTO says

cryptonews15:37

Bitcoin’s post-quantum migration debate has moved toward wallet security and dormant-coin handling after Ledger CTO Charles Guillemet argued that choosing a new signature scheme may prove easier than ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2668117952?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-09-17 15:37","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2668117952","market":"fut","top_or_hot":-1,"title":"Bitcoin quantum migration may take years, Ledger CTO says","media":"cryptonews","content":"<div>\n<p>Bitcoin’s post-quantum migration debate has moved toward wallet security and dormant-coin handling after Ledger CTO Charles Guillemet argued that choosing a new signature scheme may prove easier than ...</p>\n\n<a href=\"https://crypto.news/bitcoin-quantum-migration-may-take-years-ledger-cto-says/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Bitcoin quantum migration may take years, Ledger CTO says</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nBitcoin quantum migration may take years, Ledger CTO says\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-09-17 15:37 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/bitcoin-quantum-migration-may-take-years-ledger-cto-says/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Bitcoin’s post-quantum migration debate has moved toward wallet security and dormant-coin handling after Ledger CTO Charles Guillemet argued that choosing a new signature scheme may prove easier than ...</p>\n\n<a href=\"https://crypto.news/bitcoin-quantum-migration-may-take-years-ledger-cto-says/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"CBOO","symbol_name":"Calamos Bitcoin Structured Alt Protection ETF - October","start_time":0,"source_url":"https://crypto.news/bitcoin-quantum-migration-may-take-years-ledger-cto-says/","article_id":"2668117952","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/bitcoin-quantum-migration-may-take-years-ledger-cto-says/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2668117952","pubTimestamp":1789630656,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Bitcoin’s post-quantum migration debate has moved toward wallet security and dormant-coin handling after Ledger CTO Charles Guillemet argued that choosing a new signature scheme may prove easier than moving Bitcoin users and existing funds safely.Ledger CTO Charles Guillemet says Bitcoin faces a migration challenge, not an immediate quantum crisis.SHRINCS combines stateful signatures with a stateless fallback while relying on SHA-256 for security today.Current SHRINCS signatures range from 548 bytes to 5,777 bytes, depending on the signing path.Ledger CTO Charles Guillemet said in a technical analysis published by Ledger that “Bitcoin does not have a quantum computer problem today,” while warning that migration research, software implementation, hardware-wallet changes and user adoption could take years. He said no cryptographically relevant quantum computer capable of breaking Bitcoin’s current signatures is known to exist today, while the timing of such a machine remains uncertain.A ","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October","BTRN":"比特币期货ETF-Global X","BITB":"比特币ETF-Bitwise","BTCW":"比特币ETF-Wisdom Tree","YBTC":"比特币看涨期权ETF-Roundhill","DFII":"FT Cboe Vest Bitcoin Strategy & Target Income ETF","CBTY":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - July","BETE":"等权重比特币&以太币期货ETF-ProShares","SBIT":"2倍做空比特币期货ETF-Proshares","BFJL":"FT Vest Bitcoin Strategy Floor15 ETF - July","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","CBXA":"Calamos Bitcoin 90 Series Structured Alt Protection ETF – April","BETH":"比特币&以太币期货ETF-ProShares","CBOY":"Calamos Bitcoin Structured Alt Protection ETF - July","BITI":"1倍做空比特币期货ETF-Proshares","CBXJ":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - January","ARKB":"比特币ETF-21Shares","MNRS":"GRAYSCALE BITCOIN MINERS ETF","BTC":"Grayscale Bitcoin Mini Trust","BITO":"比特币期货ETF-ProShares","BRRR":"比特币ETF-CoinShares","BTCC":"Grayscale Bitcoin Covered Call ETF","BPI":"Grayscale Bitcoin Premium Income ETF","CBXO":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - October","MAXI":"比特币期货ETF-Simplify","BTCI":"NEOS Bitcoin High Income ETF","GBTC":"比特币ETF-Grayscale","BTF":"比特币&以太币期货ETF-CoinShares","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","HODL":"比特币ETF-VanEck","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","BITU":"2倍做多比特币期货ETF-Proshares","BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","FBTC":"比特币ETF-Fidelity","BCCC":"Global X Bitcoin Covered Call ETF","CBOJ":"Calamos Bitcoin Structured Alt Protection ETF - January","DEFI":"比特币期货ETF-Hashdex","BTCL":"T-REX 2X LONG BITCOIN DAILY TARGET ETF","CBTA":"Calamos Bitcoin 80 Series Structured Alt Protection ETF – April","EZBC":"比特币ETF-Franklin","QBF":"Innovator Uncapped Bitcoin 20 Floor ETF - Quarterly","BITX":"2倍比特币期货ETF-Volatility Shares","CBTJ":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - January","BTCO":"比特币ETF-Invesco Galaxy","BITY":"Amplify Bitcoin 2% Monthly Option Income ETF","BAGY":"Amplify Bitcoin Max Income Covered Call ETF"},"translate_title":"Ledger 首席技术官表示，比特币量子迁移可能需要数年时间","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"QBF":0.6,"CBXO":0.6,"BRRR":0.6,"CBOO":0.6,"CBXY":0.6,"HODL":0.6,"BITY":0.6,"BTCW":0.6,"CBXA":0.6,"BITX":0.6,"BITU":0.6,"BPI":0.6,"BTCC":0.6,"BFAP":0.6,"CBXJ":0.6,"MAXI":0.6,"CBTO":0.6,"YBTC":0.6,"BFJL":0.6,"EZBC":0.6,"BTCI":0.6,"BETH":0.6,"XBTY":0.6,"BTRN":0.6,"CBTJ":0.6,"CBTY":0.6,"BCCC":0.6,"BTC":0.6,"BTCO":0.6,"ARKB":0.6,"BITB":0.6,"BTF":0.6,"GBTC":0.6,"BAGY":0.6,"BTCZ":0.6,"FBTC":0.6,"BITO":0.6,"BTCL":0.6,"CBOJ":0.6,"CBTA":0.6,"CBOA":0.6,"DFII":0.6,"BETE":0.6,"SBIT":0.6,"CBOY":0.6,"BITI":0.6,"MNRS":0.6,"DEFI":0.6},"content_text":"Bitcoin’s post-quantum migration debate has moved toward wallet security and dormant-coin handling after Ledger CTO Charles Guillemet argued that choosing a new signature scheme may prove easier than moving Bitcoin users and existing funds safely.\n\n\nSummary\n\n\n\nLedger CTO Charles Guillemet says Bitcoin faces a migration challenge, not an immediate quantum crisis.\nSHRINCS combines stateful signatures with a stateless fallback while relying on SHA-256 for security today.\nCurrent SHRINCS signatures range from 548 bytes to 5,777 bytes, depending on the signing path.\nReusing one stateful signing slot can enable forged signatures, creating serious wallet-level fund theft risks.\nBitcoin BIPs 360 and 361 remain drafts, leaving post-quantum migration policy unresolved across the network.\n\n\n\nLedger CTO Charles Guillemet said in a technical analysis published by Ledger that “Bitcoin does not have a quantum computer problem today,” while warning that migration research, software implementation, hardware-wallet changes and user adoption could take years. He said no cryptographically relevant quantum computer capable of breaking Bitcoin’s current signatures is known to exist today, while the timing of such a machine remains uncertain.\nHis review focuses on SHRINCS, a draft Bitcoin-specific post-quantum signature proposal that combines a smaller stateful signing mechanism with a larger stateless recovery path. The specification remains unfinished, carries no assigned BIP number and states that its formal “security proof is TODO.”\n\n⚛️ Bitcoin does not have a quantum computer problem today. It has a migration problem, and migrations could take years to get right.SHRINCS is the first Bitcoin-specific post-quantum proposal I have seen that makes a serious end-to-end trade-off, and it deserves to be read…— Charles Guillemet (@P3b7_) September 16, 2026\n\nBitcoin migration involves more than choosing cryptography\nGuillemet divided the transition into three problems: selecting a post-quantum signature scheme, adapting Bitcoin wallets and protocol infrastructure to that scheme, and deciding how existing BTC should move to quantum-resistant outputs. The final problem includes coins whose owners may have lost their keys or have not moved funds for many years.\nBitcoin’s current transaction authorization relies heavily on ECDSA and Schnorr signatures built on elliptic-curve cryptography. A sufficiently capable quantum computer running Shor’s algorithm could theoretically recover private keys from exposed public keys, but no publicly demonstrated machine can perform that attack against Bitcoin today.\nGuillemet said migration cannot be judged solely by the cryptographic strength of a replacement scheme because wallets, hardware devices, backup systems and multi-device setups must implement it safely. He described reaching social agreement over vulnerable legacy coins as one of the harder unresolved questions.\nA similar position has emerged from other cryptographers. Stanford cryptographer Dan Boneh has argued that Bitcoin should prepare for quantum risk while avoiding a rushed migration that could introduce severe software failures.\nSHRINCS trades smaller signatures for wallet state\nThe current SHRINCS draft specification describes a hash-based system built around SHA-256, the same hash family already used extensively by Bitcoin. Its designers target approximately 128 bits of classical security and 64 bits of quantum security under their chosen parameters.\nIts 48-byte public key commits to two signing paths. The compact route uses Flexible XMSS and WOTS+C, producing stateful signatures from 548 bytes up to 4,619 bytes. A stateless fallback based on SLH-DSA concepts produces a 5,777-byte signature.\nNIST standardized SLH-DSA as FIPS 205 in August 2024. The standard itself is stateless and based on SPHINCS+, while the SHRINCS draft uses a custom parameter configuration alongside its separate stateful component.\nThe newer numbers are important because an earlier version of SHRINCS produced a frequently cited 324-byte stateful signature. Guillemet said that figure no longer describes the current Bitcoin draft. The September specification starts at 548 bytes for its stateful route.\nBlockstream Research has argued that hash-based signatures offer conservative cryptographic assumptions and relatively cheap verification. Its May research noted that standardized post-quantum signatures are much larger than Bitcoin’s current 64-byte Schnorr signatures, creating pressure on block space and transaction throughput.\nBlockstream has already demonstrated SHRINCS verification on the Liquid sidechain through Simplicity, but that experiment does not mean the scheme is active on Bitcoin mainnet. The Bitcoin specification remains research work requiring review and consensus before any network deployment.\nStateful signatures create a new wallet failure mode\nThe compact SHRINCS path requires every one-time signing key to be used only once. A wallet therefore maintains a counter identifying which signing slot should be used next, and that counter must move forward permanently before a signature leaves the device.\nIf a wallet uses the same signing slot for two different messages, information exposed by the signatures may let an observer forge a valid signature. Guillemet wrote that the attacker does not necessarily recover the entire private seed, but the affected user’s funds can still become stealable.\nBackups create another problem. Restoring a wallet from an older copy could restore an outdated counter. Two hardware devices initialized from the same seed could face the same risk if they independently use the stateful path without coordinating which one-time keys have already been consumed.\nAn independentProject Eleven review of SHRINCS reached a similar conclusion. Researchers Alex Pruden and Conor Deegan said the scheme transfers a security-critical state requirement into wallets and custodial systems, where backup restoration or state rollback could lead to reuse of a one-time key.\nSHRINCS provides a fallback when the state is lost or uncertain. The original seed can still derive the stateless signing key, allowing funds to move using the 5,777-byte signature. The wallet must permanently stop using the compact stateful route for that key once its counter can no longer be trusted.\nGuillemet described this property as one of SHRINCS’ stronger design choices because losing state affects efficiency without automatically making the coins unspendable.\nCurrent wallet features would not transfer cleanly\nThe move from elliptic-curve signatures to hash-based signatures would change several wallet tools Bitcoin users rely on today. Non-hardened BIP32 derivation lets an extended public key generate child public keys without exposing private keys, supporting common watch-only wallet designs. Guillemet said an efficient equivalent does not naturally carry over to hash-based signatures.\nThreshold signing presents a related problem. Schnorr-based systems can combine participants efficiently, while known hash-based alternatives tend to require larger signatures, more storage or communication, or different trust assumptions. Guillemet said SHRINCS should not be expected to provide a compact drop-in replacement for current Schnorr threshold systems.\nHardware performance remains another constraint. Ledger’s analysis says post-quantum key generation and the stateless SHRINCS path can take minutes on some secure hardware because the process performs many SHA-256 operations and requires more memory than Schnorr signing.\nBlockstream’s research frames the tradeoff differently, arguing that SHRINCS verification is dominated by SHA-256 calculations and can therefore remain computationally manageable even when signatures consume more bytes. The current draft claims its worst-case verification cost per signature byte is below that of BIP340 Schnorr.\nBitcoin has no adopted post-quantum migration yet\nSHRINCS is only one part of the current Bitcoin quantum-security discussion. BIP 360, called Pay-to-Merkle-Root, is a separate Draft proposal designed to remove Taproot’s quantum-vulnerable key-path spend and protect users against long-exposure attacks.\nBIP 360 does not itself introduce a post-quantum signature algorithm. Its authors state that short-exposure attacks, where an attacker derives a private key after a transaction reveals its public key but before confirmation, may require a future post-quantum signature scheme.\nBIP 361 addresses the migration problem more directly. The Draft proposal describes a phased sunset of legacy ECDSA and Schnorr spending after a post-quantum output mechanism becomes available. Its proposed schedule includes an initial migration period followed later by tighter restrictions on legacy signatures.\nAs crypto.news reported in its BIP 360 and BIP 361 review, one unresolved issue is what should happen to vulnerable BTC that never migrates. Possible approaches can affect coins believed lost, abandoned or controlled by owners who cannot participate in a future upgrade.\nCoinbase’s independent cryptography advisory board has separately called for migration planning to begin before a quantum attacker exists.The board supported preparation while leaving questions over freezing or handling legacy coins to the Bitcoin community.\nThe official Bitcoin BIP repository still lists both BIP 360 and BIP 361 as Draft as of Sept. 17. SHRINCS itself remains an unnumbered draft specification, with its authors warning that the cryptography is prototype work requiring further peer review and a completed security proof.\nFAQs\n\n\n\nIs Bitcoin vulnerable to quantum computers today?\n\nNo publicly demonstrated quantum computer can currently recover Bitcoin private keys from its elliptic-curve public keys. Guillemet describes the immediate challenge as preparing a migration before such hardware becomes practical.\n\n\n\nHas Bitcoin adopted SHRINCS?\n\nNo. SHRINCS is an experimental draft specification without an assigned BIP number. It is not activated in Bitcoin Core or Bitcoin consensus rules.\n\n\n\nWhat happens if a SHRINCS wallet loses its signing state?\n\nThe current design allows the seed to recover a stateless signing path, producing a larger 5,777-byte signature. The wallet should not resume compact stateful signing when its previous counter cannot be trusted.\n\n\n\nWhy is reused SHRINCS state dangerous?\n\nIts compact route relies on one-time signing keys. Reusing the same slot for different messages can expose enough information to permit forged signatures and possible fund theft.\n\n\n\nAre BIP 360 and BIP 361 active?\n\nNo. The canonical Bitcoin BIP repository currently lists both proposals as Draft. Neither has been activated as a Bitcoin consensus change.\n\n\n\n\n\n\n\n\n\n                Read more:\n            \n\n                Ethereum EIP-8411 tests sub-1s payload propagation","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.50.0","shortVersion":"4.50.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2668117952","isCrawlerRequest":true}