All right, let's get controversial .
So, I've had a number of people ask me if you've got any interest in this quantum thing.
Is it because you're afraid that the computer is right around the corner and everything is going to fall apart?
It's not so much that. It's more that this is a potential really, really long-term issue.
And I've been talking about Bitcoin ossification, my concerns around that, for several years.
And I think this is just one of those intersections where the fact that Bitcoin moves very slowly
and we have this potential looming threat that there's a lot of uncertainty around.
And if we're not at least trying to be proactive in discussing it,
then I think it's a lot more likely that some issue could creep up off.
So, you know, I'm not going to go through all of the issues because we've already had an entire warning of that.
So, what are the scenarios?
The best case scenario is that for some reason, quantum computing progress stalls out
and everything that we're doing here, thankfully, is a waste of time.
And we can just laugh about this in the future and hopefully nobody gets hurt.
But another possibility is that a cryptographically irrelevant quantum computer materializes suddenly
and we haven't done anything to prepare for it.
And I think that is a potential existential crisis, disaster scenario in which we're all screwed
and Bitcoin may not be able to actually react fast enough and we'll lose significant amounts of value and trust in the ecosystem.
And the third thing, which I think is what we're hoping for as a sort of middle ground,
is that we continue to watch the progress of the quantum computing space
and that we can hopefully come to some sort of rough idea in agreement upon what the best force of action is for us to do about this looming threat.
So, there's a number of different dilemmas and trade-offs and controversies that make this a very interesting topic to talk about.
One of the biggest ones, the unknowns, is how long do we actually have before quantum computers become a threat to the elliptic curve cryptography
that we're all reliant upon in Bitcoin?
And then the concern that I, as many other people have, is how long would it take for Bitcoin to actually do something about that,
to come to a consensus to determine what changes are necessary in order to be proactive and get people into a secure position?
And then the question that I don't think any of us can answer is, can we do this where we're actually able to take action and secure Bitcoin before quantum relevant computer comes along?
But that's, I think, what our goal should be.
And one of the reasons why this is such a controversial topic is, I believe that if a quantum computer comes along that could attack Bitcoin,
that one way or another, some inviolate properties of Bitcoin will be violated, whether we do something or do nothing.
So, that's why we have dilemmas, we have conundrums, and ultimately, somebody is going to be upset.
So, I don't think that there's any happy path where everybody loves whatever does or does not happen.
Unless you get that situation zero where a quantum cryptographic computer does never become a threat in the first place.
But, of course, the big ones that we're, I think, going to spend a lot of time talking about are censorship resistance
and should anyone be able to have power preventing other people from accessing using their Bitcoin.
And, of course, there's compatibility rules about changing consensus of what transactions are valid,
what transactions are not valid, and, of course, the underlying property of conservatism.
And this is something that we see very often in the space now, somewhat, you know, towards the ossification side,
that oftentimes, whenever you bring up any sort of issue in the space, there's a lot of pushback of, like,
why are you making it so urgent?
And it's like, some people seem to be of the mind that we can't discuss anything without being urgent.
Now, I think most of us in this room, according to the polls that happened before this conference started,
is that, you know, we don't think this is a drop everything and break glass scenario yet.
We probably have 5, 10, maybe 20 years before something needs to happen.
And so I think this is about as conservative as we could possibly be.
So hopefully nobody's running around saying that, you know, we're propagating FUD.
This is just a lot of uncertainties and a significant number of overlapping uncertainties that we think that it's better to get started discussing earlier rather than later.
Now, especially in the context of what some are calling, you know, the confiscation argument.
What I talked about a number of months ago in an essay that I published was, I think we all agreed on the principle of not your keys, not your coins.
And I think this is one of those inviolable properties that is going to make people upset.
Is that if the corollary is your keys, only your coins, what happens in a scenario in which Bitcoin can be taken by a quantum attacker or a scenario where people decide they don't want Bitcoin to be taken by quantum attackers.
So this slide is really meant to try to get a grasp of why I consider this entire problem space to essentially be a giant cluster fund.
There are at least half a dozen, maybe more issues going on simultaneously that I think consensus needs to be found about.
And as we know, it is difficult enough to get consensus on one very specific thing in Bitcoin, but to do so for a wide variety of different issues, I think only makes this problem space and coming to a solution exponentially more difficult.
So all the more reason to start talking about it earlier rather than later.
One of those, of course, is what post-quantum scheme are we going to use?
And since I'm neither a cryptographer nor really a protocol level developer, I don't really even want to put my hat in the ring towards that stuff.
This is why I'm focusing more on the next phase and a lot of the game theory incentives around what do we do if we become a consensus about post-quantum cryptography.
Along with that, and really related to the first part, is really all of these schemes suck in terms of Bitcoin, because Bitcoin has incredibly constrained block space.
And all the schemes that I've seen proposed thus far tend to have at least an order of magnitude, if not several orders of magnitude, high requirements for data size of signatures and keys on the blockchain.
So I suspect that if any of those that are currently discussed end up being settled upon, then we're going to reignite the block size debate all over again.
As I said already, there's multiple invaluable properties of Bitcoin that are kind of up at stake here.
And then, of course, there is the concept of migration.
And if we come to an agreement that we don't want a ton of quantum vulnerable coins sitting out there and potentially being dumped on the market,
essentially to create large amounts of economic turmoil, how is this going to be framed?
You know, some people are going to frame it as an aggressive forced migration to push people to move their coins,
which violates one of the Israeli principles of telling people what to do with their Bitcoin.
Whereas the more defensive perspective is that, well, while no one can tell anyone else what they can do with their Bitcoin,
neither can anyone say I have to operate on a network where I am accepting quantum vulnerable spins that may be detrimental to my belief of what the value of my Bitcoin bullies are.
So this is proactive versus reactive sort of perspective.
And, you know, I think both camps are going to continue to push their views with that in order.
And then there is the question of taking any action whatsoever around a migration versus just allowing quantum computers to be able to scoop up these coins.
And, you know, some have posed that as well.
This is the strength of Bitcoin is that you don't have to force anyone to do anything that will survive.
And that's probably true for different definitions of survival or is being able to project to the world that Bitcoin can come together and be proactive about improving its security posture.
Actually, a better show of strength is all debatable.
Therefore, there is the economic volatility and value destruction arguments.
Some will be firmly in the camp that one Bitcoin is one Bitcoin.
And even talking about fiat value is ridiculous.
Others will say, well, realistically, Bitcoin is not a unit of account.
And most businesses and individuals still denominate their wealth and their spending power in fiat.
That's just a way to measure it.
So I think that's just going to be another set of camps that are in conflict.
Then there's the game theory, I think, between what you might call the whales versus the guppies.
From an incentives perspective, I think someone who has the vast majority of their net worth in Bitcoin, whether they're OGs, whether they're institutions, whatever,
they're going to be highly incentivized to do whatever they can not to allow the value of that to crash to whatever extent that they can.
Versus the newcomers, the people who are still accumulating, those people, I think, would love to see a crash in price of Bitcoin.
They would love to buy cheap coins.
They would love the opportunity to become whole coiners and so on and so forth.
This is just yet another set of groups that I think will be perpetually in conflict here.
And then there's wealth distribution, dilemmas that I'll get to in a bit.
And finally, there is the actual game theory around forking.
Because pretty much everything that's being proposed is a soft fork.
And so if you are proposing a controversial soft fork and there's some large majority of the community, the hash rate, whatever,
that is in favor of that, but there is a very strong and determined minority that wants to resist it.
Of course, there are ways to do so, which have never been done before.
And it's an interesting new set of game theory to go down.
But what is our motivation for this actual improvement proposal?
It's mostly about incentives.
We want to incentivize individuals, actors, institutions, basically to take action for their own security.
Generally, I'm not trying to frame this whole thing as like, this is what is good for other people.
Rather, everything that I'm looking at is from an individual actor perspective.
I think the individual actors will generally agree that this is good for me.
But of course, some of those aforementioned groups will hold conflicting views for the reasons I already established.
And of course, we want to disincentivize quantum capable adversaries from targeting Bitcoin.
Both from the economic and non-economic perspectives.
We had some very good talks earlier about threat models and various actors that may try to attack Bitcoin.
And one thing that I want to point out is that I think it's almost a waste of time to think about these actors and their particular motives, be them economic or otherwise.
And we spent a lot of time talking about specific nation states and why they may or may not try to attack Bitcoin.
But if you go into even a layer deeper than that, you don't necessarily know what any individual actor that may be able to get their hands on that technology will do.
We don't necessarily need China to decide to destroy Bitcoin in order for either some rogue individual or some other black hat attacker to get through the security measures of their infrastructure and basically use that hardware to attack Bitcoin for their own personal incentives.
And one of the big things here in this course comes into the sort of one BTC, one BTC argument is that I think doing this in an opt in fashion where we have a post quantum scheme out there that people can move into while that does protect those people that opt in from losing their Bitcoin denominated value.
It doesn't protect them from all the other potential economic ramifications if a large part of the ecosystem procrastinates, doesn't do this and is basically losing their coins, having them dumped on the market and so on and so forth.
And then finally, like I said, what do we want to project to the world that Bitcoin as an ecosystem is really deciding?
How are we going to respond to new threats?
Are we just going to stand there and take the punch and say, you know, we know that we're going to survive it or are we going to be more proactive?
So the actual specification is pretty straightforward.
This is basically saying we've already decided that we've settled on some scheme that is going to protect people from quantum attacks.
What do we do after that?
And the general idea here is that some set point in time, I think several years minimum, I was suggesting three years after this scheme is activated, then we do a soft fork and all that soft fork does is that it no longer allows you to send funds to quantum vulnerable outputs.
Why is this important?
One of the main reasons I think it's important is that there's no way for us to actually go out and email every Bitcoin user.
There's no way for us to contact everyone in Bitcoin.
This would be, I think, the most straightforward way to let people know something is wrong and you need to take action.
is if you're trying to send money and all of a sudden the Bitcoin network is rejecting it, then I expect you to start building into it and hopefully come up to speed as to what is going on within the ecosystem.
Then sometime after that, we still want to get people in years to migrate because the very complex ecosystem needs to have all these changes matriculated down through software libraries and then eventually, you know, hardware manufacturers.
It's a very complex ecosystem.
And so some period after that, eventually, we no longer allow the vulnerable spend pass to be used.
And this is the point of which you could say we're essentially freezing, confiscating, burning, whatever it's called.
And of course, this is one of the really more controversial aspects of this.
And this, of course, is to say that this is the point at which we are no longer allowing Bitcoin to be vulnerable to quantum attacks.
Now, in order to mitigate a lot of the problems that people will have with most arbitrarily freezing people's money is that I think that it seems quite possible that we come up with quantum safe recovery schemes.
Probably won't apply to every possible wallet out there, but at least to hierarchical deterministic wallets as soon as possible is that we can then have a way for people to recover those funds.
And this is the part that I think needs a lot more research because there's going to be a variety of different ways to do this.
Some more complex than others, some with a variety of different trade offs.
And I think a best case scenario is if we could have phase C actually happen in conjunction with phase D.
And if we have enough time and get all of our research together, then we may actually be able to soft fork that phase as well.
So that essentially you would still provide the same evidence to the network that you would normally to spend those funds.
But you would have to provide additional proof in a quantum safe manner that you are the owner of those funds and you're not just some quantum attacker that managed to reverse engineer the private key.
So what's some of the rationale here?
Like I said, I don't think it makes a lot of sense to spend too much time thinking about motivations of different attackers.
There is simply the existence of such a machine out there.
It means that someone for some reason or no reason whatsoever may decide to attack Bitcoin, which is already a multi-sharing dollar network.
And it may or may not be economically motivated.
There are certainly plenty of people and organizations out there that hate Bitcoin and just love for it to be destroyed, even if it doesn't personally benefit them.
And ultimately it's because I think one of the controversies is around confiscation, but that redistribution may in fact be even more controversial.
And so what are we talking about here with wealth redistribution?
Well, one possibility is the do nothing stoicism crowd.
It is basically we say, okay, if you've got a powerful enough computer, then you can take the coins.
So that's basically saying we are fine with redistributing wealth to whoever wins the quantum computing technologies.
Another option is that we allow for the throttled spending of these coins.
Some of this spending would be presumably by an attacker.
some would be by people who were just slow to move their funds to the new scheme.
And, you know, this gets really tricky because it basically creates a whole new set of game theory.
Now, on one side, I can certainly appreciate game theory that may help with the minor subsidy problem.
The issue of the lack of demand for block spaces has been one of my other long term concerns.
But this is just another set, I think, of issues that we're going to be grappling with is what does that game theory result in in terms of wealth redistribution?
And especially if you try to look out of what would the landscape be several decades in the future if you assume quantum computers become cheaper and cheaper and cheaper to the point that basically anybody can have a quantum computer.
Who ends up benefiting from a scheme where we're really throttling what those spends can do?
And then the final one is allow no one to spend coins in a vulnerable manner.
If there's no recovery scheme here, then you could argue this is kind of a tacit wealth redistribution to all the people who do migrate first.
But as I've said, I think the preferable outcome is that you do have some sort of recovery scheme.
So that you're sufficiently happy that these coins are only going to actually get moved by the people who own them.
So what are various incentives?
I'm sure there's even more players here.
But one thing with the miners, like we said, all of the different schemes that are being proposed currently are going to be a lot heavier with regard to block space.
That can also be a good thing in terms of the sustainability of the thermodynamic security.
So that's something else that we can argue about.
Like I said, the block size and the data may very well be reignited.
And also miners tend to have a lot of big coins.
So you should consider them to be large holders that probably don't want to see the value of the treasury
and of course the value of their hardware massively depreciate.
And of course there is the institutional holders who are having, as we've said before, for pretty much the first time in history now,
we have people in this space who have a fiduciary responsibility to a lot of people that they are essentially customing their coin on behalf of.
And from an institutional perspective, we also heard earlier that nation states and institutions and so on and so forth are somewhat concerned about this.
And that this could be a way to project a show of strength and confidence that Bitcoin is in fact an investment-grade asset that can respond to existential threats.
Then there's exchanges and custodians, of course, as we heard earlier.
Several of the largest ones in this space currently have really their entire pull-balled stash for this moment.
So they are obviously incentivized to migrate that to a quantum-safe scheme.
And then there's the individual holders where this gets a lot more complicated.
But do you want to have strong peace of mind that you're not going to have this massive devaluation event?
And I think really it's more about incentives.
Because as someone who's been building software for nearly 20 years now, I know that the average person is quite lazy, quite naive, and procrastinates,
doesn't read the manual.
And I suspect that only having these vague threats and vague incentives that are kind of hanging out there is not going to be sufficient to get a lot of people to actually take action.
And as we've said, the people who opt in, if they themselves are safe, if everyone else hasn't taken the same precautions,
they're still going to suffer pretty significant economic turmoil.
So from a backwards compatibility perspective, I think all of this stuff should be soft-sportable.
The biggest open question is some sort of quantum-safe fund recovery process for people who either procrastinate too long or were unavailable for whatever reason for many years,
weren't paying attention.
This, I think, is where a lot of research should be going.
So, I think we got through everything there, and I am looking forward to your highly charged questions.
Because this is a very large amount of coins in the ecosystem, we're expecting huge economic volatility.
Like I said, I think that claiming to do this for the benefit of others is, of course, very gnarly.
And that gets into the whole, oh, we're trying to be good dictators type of argument.
And this is why I've focused more on the game theory behind it.
Like what do the large holders do?
If you are of the agreement that ultimately the way Bitcoin governments works is through some rough economically powered consensus,
then I think that it makes sense to look at what are the incentives and the desires for the whales and the institutions and so on.
And so forth.
Regardless of what happens, there's going to be moral and philosophical debates.
And I think as some people were talking about earlier, it very may well be that the landscape of morality and philosophy in Bitcoin today is no wonder what it was 10 years ago.
So the game theory, I think will play out kind of regardless of that.
I mean, I think there are economic counterpoints like actually forking to free certain points could itself shape a lot of people's confidence in Bitcoin's security of their property rights.
And second argument like one economic argument would be like maybe there are a lot of people who want to buy cheap points and want to traffic those.
Yes.
A lot of people would think like, well, Bitcoin will get through it and my stack will double or triple or even more in size.
And like, yeah, that's like right or tiger.
Yeah, I mean, those are all completely valid viewpoints and I think we're going to have to try to do our best to quantify how those viewpoints are being held.
And, you know, that's going to be a long road for, I think, many years in the future.
But then I touched on it a little bit, but at its core, since everything that we're talking about is soft forkable.
Technically the freezing, burning, whatever of coins doesn't even have to be done at a protocol or node level.
It very well could be just a consortium of miners, especially if some emergency happens.
Like if all of a sudden we start seeing coins move and we have a reason to believe that there isn't a cryptographically relevant quantum computer out there.
It could be as little as, you know, a dozen major mining pools coming together and saying, you know, we need to slow down stim leaving right now and stop allowing for vulnerable coins to be spent.
That's just purely from a technical perspective.
Whether or not that would happen from like an actual game theory perspective remains to be seen, but I think that's one of the many potential eventualities that we should be talking about.
The last question.
It's actually more of an opinion, but the, um, the, um, I mean, just actually picking up things to think about, you know, your alphabet list of, of, you know, different issues to solve and sort of stage your program.
One of the things that sort of, um, I've been thinking, and I'm John Beffer, you know, I'm an investor, so you can put me in that, in that bucket, but, um, the, um,
We need to resist, I think, as a community, to design, and we're sort of in front of this big problem, and we need to resist the desire to kind of come up with a comprehensive, um, full consistent solution to kind of just all the way through.
In the same way, you know, kind of classically, if you want to eat an elephant, you do it one bite at a time.
And, and I think that, that what I would be feeling philosophically would be, um, to do the easy things first.
By easy things, I mean the things that we actually all are going to kind of fairly agree on.
Just do that, right?
And, because we're, we're, we're confronting this gradient.
We're, we're confronting with a gradient of this, you know, if we take everybody in this room, there's a gradient of, probably our, our views as to this, you know, the certainty of this ever really actually being issued.
And we have also a gradient as far as our, our beliefs on timeframes.
And as each day, week, month passes, that gradient is going to, is going to, is going to clarify itself, right?
We're going to, you know, we're going to kind of collapse on, you know, more and more on a view of certainty and a view of timeframes.
So, what today are hard problems will become easy problems.
Both technically, because we'll probably have made progress from research, but also politically, because we'll have, you know, we'll be in front of something where there's just less controversy, less, less uncertainty, less debate.
So, confronted with gradient problems, right, the best thing to do is approach it with gradient solutions.
You know, let's do, let's, let's first do the things that we agree on, right?
You know, like, just make sure that all future spins to be your face, you know, all future spins are to quantum saving.
So, clearly, you know, does anyone really have a strong reason to object to that problem?
Yeah, it's like, why do we still allow people to consent?
Yeah.
To pay the public key?
Why not?
Why not just, you know, I think we could all probably agree to that.
No one's really wrong.
You know, similarly with, without reducing addresses.
And then, you know, as we, as time passes, I think we're all going to start converging through new information that we're going to receive.
And then, you know, we could even, on the political front, say, well, you know what, right now, the expedient answer is X.
Whatever, whatever X is, the expedient view.
And I suspect that, as time passes, when we're confronted with reality, whatever that reality is, the community will very quickly agree on, you know, whether or not X needs to be now admitted to X prime.
And, and, and, and we just don't need to keep fun on that today.
And so, what I think would be the biggest mistake these communities could make would be to sort of be, you know, paralyzed in action by worrying about the hardest problems that don't, you know, today, as opposed to just getting started with, you know, with the relatively easy ones.
And, and just have faith, the harder problems are going to become easier as we get more clear to know what's happening.
I think we're all here because we have faith in each other.
Right?
It's like, all we can...
Are you kidding me?
I don't trust it.
I don't trust Bitcoin.
But, I mean, this is, this is ultimately, this is about the, the anti-fragility and the resilience of the system.
And, you know, while Bitcoin is composed of millions of individual actors, it is up to us to be coming together, discussing all of these difficult things, and trying to find consensus.
And, ultimately, that's, I think that's all that we can really do, is just keep talking about it, and trying to have, eat the elephant one bite at a time.
All right.
Thanks.