Post-Quantum Migration
For July, the busiest post-quantum thread is migration mechanics: output format, EC-disabling triggers, wallet state, and who has an incentive to move.
OUTPUT TYPE
P2MR (BIP-360) vs P2TRv2, framed by Pieter Wuille as Never / Later / Now: when do we expect EC to be disabled, and what does the type assume?
GIVING IT TEETH
Tripwire (a NUMS-point spend proves ECDLP is broken and auto-disables EC) and Miner Lockdown, from Wuille, Tadge Dryja and Sjors Provoost.
BIP-360 UPDATE
PR #2198 merged: depth-zero Merkle trees made anyone-can-spend (a privacy fix). With Nagaev Boris's EC key-recovery trick, P2MR's overhead versus P2TRv2 falls to about 32 weight units (roughly 8 vbytes).
HASH-BASED SIGS
SHRINCS (Blockstream Research) and a production operator's account of why stateful signing is hard in practice.
ECONOMICS
The Quantum Sunset / PACT working paper: the largest dormant holders are the least likely to migrate voluntarily.
P2MR vs P2TRv2
The dispute is really about what the output type assumes about future EC disabling.
P2TRv2 / LATER
The low-friction camp wants something close to Taproot: cheap, familiar, and easy for wallets to adopt. It relies on a later soft fork disabling elliptic-curve paths inside the new output type at the right time, so the goal is to maximise the share of users migrated before Q-day.
P2MR / NOW
P2MR removes the key-path spend up front. Holders who choose it can avoid long-exposure EC risk without waiting for a perfectly timed disable fork. The cost is extra witness data and stricter wallet behaviour around script trees.
SELF-RELIANCE
conduition's argument: perfect timing is unlikely, consensus changes take years, and Bitcoin needs somewhere safe to rescue coins into even if Q-day arrives before broad migration.
SYSTEMIC RISK
Wuille's counter: if too many users remain vulnerable, a broad EC freeze or rescue fork is damaging either way. A lower-cost path that gets almost everyone migrated may improve Bitcoin's survival odds more than a safer niche path.
Tripwire And Miner Lockdown
How do you turn an expected future EC disable fork into something the output type can depend on?
TRIPWIRE
Pick a fixed nothing-up-my-sleeve point. If a mined transaction ever contains a successful
<NUMS> OP_CHECKSIG, that proves the discrete log was recovered and EC spending paths inside the new output type are disabled from the next block.MINER LOCKDOWN
Give miners a long or indefinite emergency signalling path. If a sufficiently high hashrate threshold signals a CRQC emergency, full nodes begin enforcing the EC disable rule quickly instead of waiting for a normal deployment cycle.
SCOPE QUESTION
Boris asked whether disabling means only the main key path or every EC opcode inside the new output type. Wuille's answer: all EC usage inside that type must be disabled, otherwise users cannot safely keep sharing public keys.
AJ'S VARIANT
Anthony Towns sketched a victim-triggered proof and suggested putting the trigger in the coinbase witness commitment. That would need relay, Stratum V2, or
getblocktemplate updates so pools can include the proof.RISK
False positives and misread incidents matter. Boris pointed at prior real-world key failures that could have been mistaken for Q-day. Miner Lockdown also hands miners an irreversible network-wide trigger.
BIP-360 Update
The current P2MR text removes a privacy and incentive footgun.
WHAT CHANGED
PR #2198 makes depth-zero P2MR script trees anyone-can-spend. That means a P2MR output must commit to at least two apparent spending paths if the owner wants the coins to be safe.
WHY
A single-leaf tree would tempt wallets to omit a PQ leaf just to save witness bytes when spending with Schnorr. Forcing depth one or more aligns P2MR's privacy profile with Taproot and nudges wallets toward an actual escape path.
WHAT P2MR IS
BIP-360 defines a SegWit v2
bc1z output that commits directly to a script-tree Merkle root. It keeps tapscript-style leaves, but removes Taproot's quantum-vulnerable key-path spend.LIMIT
P2MR only addresses long-exposure attacks, where a public key is visible for a long time. Short-exposure attacks against a transaction in the mempool still need post-quantum signature opcodes or another signature scheme.
P2TRH SIDE IDEA
conduition also floated P2TRH, a hidden-output-key alternative closer to the P2TRv2 family. The output-format space is still changing, not settled into a simple two-option vote.
SHRINCS And State
Small hash-based signatures are appealing, but stateful signing is a wallet UX problem.
THE APPEAL
SHRINCS is Blockstream Research's hash-based post-quantum signature construction. In the efficient stateful path it targets very compact signatures for blockchain use, with a stateless fallback if signing state is lost.
THE FOOTGUN
The signer must never reuse a one-time signing leaf. Lost counters, restored backups, cloned machines, duplicated seed material, or parallel signing requests can all create state confusion.
OPERATOR FEEDBACK
Patrick Cerri, who has operated SPHINCS-style state in production on Minima, adds the practical warning: users and services are worse at slot tracking than protocol designers want them to be.
WHY IT MATTERS
BIP-360 is only an output container. It still needs a signature scheme inside the script leaves. SHRINCS, SHRIMPS, SPHINCS, WOTS, and lattice schemes are competing answers to that separate question.
Quantum Sunset Economics
The migration bottleneck may be incentives, not cryptography.
EXPOSED SUPPLY
Ahmed Raza's working paper first estimated the exposed-key UTXO surface around 25% of circulating supply. After AdamISZ pushed on used P2SH and P2WSH scripts, the revised estimate moved to about 35.30%.
DORMANT WHALES
The largest dormant holders face the highest privacy cost from proving control or moving coins alone. Under a convex privacy-cost model, they are the least likely to voluntarily commit before a deadline.
PACTS
PACTs let holders prove address control before a sunset using BIP-322 signatures and timestamps, then redeem later if legacy EC spending is disabled. The paper treats PACTs as one policy option, not a complete migration by itself.
POOLING
The paper's highest-leverage recommendation is early standardisation plus a pooling service that spreads privacy cost across holder sizes. Without pooling, the biggest holders have the strongest reason to wait.
Discussion
The hard part is timing and incentives, not the maths.
QUESTION
How do you time an EC-disabling soft fork so it is not confiscatory and not too early?
QUESTION
Should Bitcoin optimise for the cheapest path that gets everyone migrated, or for an output type that lets cautious users self-protect immediately?
QUESTION
If voluntary migration misses the largest dormant holders, is a pooling mechanism enough to avoid a later theft-or-freeze choice?
OPEN ISSUE
This area moves weekly and attracts low-quality and AI-generated proposals; attribute carefully and check the primary thread.