Changes to BIP-360 - Pay to Quantum Resistant Hash (P2QRH)

[EthanHeilman]

This is a cool idea, though I rather make as few changes in P2QRH as possible.

@conduition

If a quantum attacker learns our wallet descriptor, they cannot exploit EC pubkeys inside the endorsed script to steal money until the owner has published an OTS endorsement signature, even if the adversary knows and cracks the EC pubkey(s) inside the to-be-endorsed script.

If I understand you correctly this would prevent long exposure attacks on reused public keys, but not solve short exposure attacks.

You don’t need to change P2QRH to get this. Simply require a preimage and a signature (H(x) == y AND VER(pk, sig, m) == 1) to spend and have a different preimage per leaf. This prevents long exposure attacks even if the public key is reused since the attacker doesn’t know the preimage x. This seems like not reusing a public key but with extra steps.

In P2SH you can do slightly better using the techniques from Signing a Bitcoin Transaction with Lamport Signatures (no changes needed). Though as pointed out by Adam Borcany this scheme functions more like a speed bump since due to the 201 opcode limit in pre-tapscript the key space is small enough to be vulnerable to bruteforce.

@conduition

It’d mean fully defining an OTS scheme for script endorsement, so maybe that’d be best as a new script leaf version, in a new BIP. What do you think?

You should write this up more concretely. It is an interesting idea.