Coinbase, custodian to roughly 5% of all Bitcoin in existence, is actively preparing for the advent of cryptographically resistant quantum computing. For over 13 years, the company has safeguarded digital assets at scale, and now applies that experience to address this emerging threat to the Bitcoin network, Coinbase says.
Coinbase is contributing engineering resources and participating in the Bitcoin Security Consortium, believing that “making Bitcoin secure against this emerging threat involves more than choosing a quantum-resistant digital signature scheme.” This proactive, collaborative approach signals a commitment to the broader Bitcoin ecosystem as the community begins a complex, multi-year migration process.
Coinbase Advocates Proactive Bitcoin Quantum-Resistance Preparation
Coinbase emphasizes the need for deterministic, cross-platform verification when evaluating potential post-quantum signature schemes for Bitcoin, a critical factor for ensuring widespread usability and security. The company believes that robust verification processes are paramount, extending beyond simply selecting a quantum-resistant algorithm; they must function consistently across diverse computing environments. The firm’s preparations extend beyond internal system upgrades to include active participation in the Bitcoin Security Consortium, contributing engineering resources to collaborative efforts, according to Coinbase.
This long-term perspective is informed by their institutional customer base, which demands robust and forward-looking security measures. Compatibility with multi-party computation (MPC) signing is a key consideration for Coinbase and its customers when assessing potential post-quantum signature schemes. MPC provides an additional layer of defense against key theft, particularly valuable for large organizations constantly targeted by cyberattacks.
The company notes that certain lattice-based approaches may be more easily integrated with MPC than others, and advocates for including at least one MPC-compatible scheme among Bitcoin’s post-quantum options. This is not a request for new MPC protocol development, but a preference for schemes that readily integrate with existing MPC infrastructure. Coinbase is also prompting discussion around a potential path for wallets that delay migrating to post-quantum outputs, recognizing that some users may not move their funds before ECDSA/Schnorr spending is limited or discontinued.
The company believes it is useful to consider how these users could migrate their funds afterward, while acknowledging the complexities and tradeoffs involved. They emphasize that this discussion can, and should, proceed concurrently with the technical work of adding post-quantum signature support, avoiding unnecessary delays in the overall process.
The company further suggests that proposals for post-quantum signature schemes should explicitly address scenarios involving lost or inaccessible private keys, or failures in proof systems, the company says. Specifically, they ask for clarity on what happens when a user has no recoverable secret, the proof system fails to scale, or a rescue deadline expires.
These considerations, Coinbase argues, are important for ensuring a practical and resilient implementation of post-quantum security for Bitcoin. “We want to contribute to the community’s efforts and help create the conditions for careful, sustained progress,” the company stated, highlighting their commitment to a collaborative and thorough approach to safeguarding Bitcoin’s future.
Flexible Output Designs Support Future PQ Signature Systems
Coinbase advocates for Bitcoin output designs that accommodate multiple post-quantum (PQ) signature systems without requiring complete overhauls, a strategy that prioritizes long-term adaptability. The company believes a flexible approach, such as those offered by P2MR (BIP-360) and P2TRv2, would allow for the introduction, replacement, or supplementation of PQ schemes as the field evolves. This contrasts with designs that lock Bitcoin into a single PQ algorithm, potentially creating vulnerabilities if that algorithm is compromised or superseded.
The firm’s analysis centers on the need to decouple the “container”, the transaction output structure, from the signature scheme itself. This separation, they argue, would enable a smoother transition to PQ cryptography and avoid the substantial disruption of redesigning the entire output format with each new algorithm. Coinbase envisions a system where wallets can adopt PQ-capable or hybrid constructions even before a final policy regarding legacy signatures is established, accelerating the overall migration process.
Such a design would also support multiple PQ schemes simultaneously, offering redundancy and resilience against unforeseen weaknesses in any single algorithm. Acknowledging that some wallets may lag in adopting PQ-safe outputs if Bitcoin eventually limits or ends ECDSA/Schnorr spending, Coinbase proposes considering migration pathways for those users. The company suggests exploring options for these late adopters to move their funds, recognizing that this presents complex tradeoffs, Coinbase reports.
This proactive approach aims to minimize disruption and ensure the continued accessibility of funds for all Bitcoin users. Coinbase outlines specific characteristics for an ideal PQ-capable Bitcoin path, including a commitment structure that obscures public keys until needed, thereby mitigating quantum-vulnerable key paths. They also emphasize the importance of versioning and algorithm identifiers, advocating for a distinct, unambiguous identifier for every supported PQ scheme and parameter set.
This would allow for smooth integration of new algorithms without requiring new output types. The company highlights the need for clear semantics regarding key revelation, control blocks and transaction identification, alongside consensus limits for witness size, script size, verification work and block cost. A low-friction address format and descriptor representation are also deemed important, facilitating adoption by wallets, exchanges, hardware wallets, and payment flows. Coinbase suggests evaluating options such as PQ-only outputs for early adopters and 1-of-2 (classical-plus-PQ hybrid) constructions, where classical signing can be used initially and PQ signing becomes available when needed.
Commit/reveal mechanisms, designed to reduce public-key exposure during migration, are also considered valuable. The company proposes a staged policy governing new outputs, sends to legacy outputs, and spends from legacy outputs, potentially including a legacy-signature sunset, freeze, rate-limiting, or rescue alternatives.
They recognize that no single solution will satisfy all constraints, and aim to make their concerns visible for consideration alongside those of other stakeholders. “Our goal is to make our needs and concerns visible so they can be weighed alongside everyone else’s,” Coinbase concludes, reinforcing their dedication to a collaborative and well-informed approach to securing Bitcoin against the quantum threat.
Key Criteria for Evaluating Post-Quantum Signature Candidates
Coinbase prioritizes signature, public-key, secret-key and total-spend sizes when evaluating potential post-quantum signature candidates, recognizing that minimizing these parameters is critical for efficient on-chain storage and transaction processing. The company’s analysis extends beyond simple size comparisons to include verification time, tail latency and batch-verification behavior, all of which directly impact scalability and user experience within the Bitcoin network. These metrics are not merely academic exercises; they represent real-world constraints imposed by the finite block size and transaction throughput of the blockchain.
A commitment structure capable of hiding public keys until needed is considered ideal by Coinbase, a design choice intended to mitigate quantum-vulnerable key paths and provide flexibility for future script leaves or signature algorithms. This approach acknowledges that the transition to post-quantum cryptography will likely be protracted, requiring mechanisms to protect existing funds while simultaneously enabling the adoption of new, more secure methods.
The company specifically highlighted SHRINCS as a candidate worthy of evaluation, noting its combination of a compact stateful FXMSS path with a stateless SLH-DSA-derived fallback, which offers a potentially attractive balance between size and verification costs. However, Coinbase emphasizes that the adoption of SHRINCS, or any stateful signature scheme, necessitates careful consideration of signer state, recovery mechanisms and implementation assurance to prevent forgery. The company believes a stateless option should also be available alongside stateful signatures, providing a more robust and user-friendly experience.
This stance reflects a pragmatic approach to risk management, acknowledging the inherent complexities of stateful cryptography and the potential for errors in implementation. This focus on practical failure modes highlights the company’s custodial responsibilities and its need to protect customer funds even in the face of unforeseen circumstances.
MPC-Friendliness and Migration Paths for Late-Adopting Wallets
The company emphasizes that a viable transition must account for wallets that may not immediately adopt the new standards, requiring a pathway for funds to be moved even after a potential shift away from ECDSA/Schnorr signatures. This consideration stems from the recognition that Bitcoin ecosystem migrations can span years, necessitating proactive planning well in advance of any definitive timeline for quantum-resistant cryptographic (CRQC) adoption.
Proposals like P2MR (BIP-360) and P2TRv2 are viewed favorably for offering this kind of flexibility, potentially enabling active wallets to use post-quantum or hybrid constructions before a final decision on legacy signature policies is made. This approach acknowledges the protracted nature of the transition and the need for incremental progress. The company believes that evaluating candidate post-quantum schemes through the lens of MPC-friendliness is essential, particularly given its institutional client base.
Lattice-based approaches, the company notes, may be more amenable to MPC than others, and a focus on this compatibility is important during the selection process. “MPC-friendliness is an important consideration in the choice of PQ schemes,” the company stated, emphasizing the need for a robust and adaptable cryptographic foundation. A key concern centers on the fate of funds held by wallets that do not migrate to post-quantum solutions.
Coinbase proposes considering a mechanism for these users to move their funds even after ECDSA/Schnorr spending is potentially limited or discontinued. The company highlights several specific scenarios requiring attention, including outputs with permanently exposed public keys, reused keys in hashed output types, dormant but legitimately controlled funds, and lost keys or inaccessible seeds. These represent potential vulnerabilities that must be addressed to protect a broad range of Bitcoin holders.
The evaluation process, Coinbase suggests, should prioritize deterministic, cross-platform verification, constant-time implementations, clear parameterization and resistance to signing random number generator failures. These criteria are deemed essential for ensuring the reliability and security of any adopted post-quantum scheme. Coinbase envisions a Bitcoin design that balances long-exposure protection, short-exposure protection, migration usability, privacy, fee cost, script flexibility and implementation complexity.
The company advocates for a Bitcoin-specific and reproducible evaluation process to guide signature scheme selection, ensuring that the chosen solution meets the unique demands of the network. The company stated, outlining its expectations for a collaborative and comprehensive approach to post-quantum readiness.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
