Grover’s algorithm cuts hash strength in half. As I understand it, the whole point of 256 bit crypto is to survive the advent of quantum computers, when it degrades to 128 bits. Yes, a quantum computer shouldn’t break SHA256, but quantum computers would almost immediately account for the vast majority of the hashing power, centralizing control of the currency.* Once everyone has quantum computers, it would work again (with a replacement public key system), but given such a disruption, I don’t see much point to salvaging the old currency, rather than starting over.
* I think a gigahertz quantum computer would have the hashing power of the current bitcoin network.
Some relevant numbers: Based on the current target, I estimate that miners compute 5*10^18 hashes per block, 8*10^15 hashes per second. To match that, quantum computers working in mining need to compute 9*10^7 hashes per second.
I think a gigahertz quantum computer would have the hashing power of the current bitcoin network.
My math agrees with you. Looks like I was underestimating the effect of quantum computers.
Difficulty is currently growing at 30-40% per month. That won’t last forever, obviously, but we can expect it to keep going up for a while, at least. (https://blockchain.info/charts/hash-rate) Still, it looks like you’d need an unrealistic amount of ASICs to match the output of just 1000 quantum computers.
Given that, there’ll probably be a large financial incentive to mine bitcoins with the first quantum computers. The incentive goes away if you destroy the network in the process, though. It seems difficult to predict what will happen. Single pools have controlled > 50% of the mining briefly in the past.
...given such a disruption, I don’t see much point to salvaging the old currency, rather than starting over.
A lot of unhappy btc holders may see a point, though. :)
That’s true, but there’s some precedent for picking a block that everyone agrees upon (that exists before quantum computers) and changing the rules at that block to prevent someone from rewriting the blockchain. A lot depends on how much warning we have.
It looks like making a cryptocoin that can survive quantum computers might be a high value activity.
Grover’s algorithm cuts hash strength in half. As I understand it, the whole point of 256 bit crypto is to survive the advent of quantum computers, when it degrades to 128 bits. Yes, a quantum computer shouldn’t break SHA256, but quantum computers would almost immediately account for the vast majority of the hashing power, centralizing control of the currency.* Once everyone has quantum computers, it would work again (with a replacement public key system), but given such a disruption, I don’t see much point to salvaging the old currency, rather than starting over.
* I think a gigahertz quantum computer would have the hashing power of the current bitcoin network.
Some relevant numbers: Based on the current target, I estimate that miners compute 5*10^18 hashes per block, 8*10^15 hashes per second. To match that, quantum computers working in mining need to compute 9*10^7 hashes per second.
My math agrees with you. Looks like I was underestimating the effect of quantum computers.
Difficulty is currently growing at 30-40% per month. That won’t last forever, obviously, but we can expect it to keep going up for a while, at least. (https://blockchain.info/charts/hash-rate) Still, it looks like you’d need an unrealistic amount of ASICs to match the output of just 1000 quantum computers.
Given that, there’ll probably be a large financial incentive to mine bitcoins with the first quantum computers. The incentive goes away if you destroy the network in the process, though. It seems difficult to predict what will happen. Single pools have controlled > 50% of the mining briefly in the past.
A lot of unhappy btc holders may see a point, though. :)
In particular, the ability to roll back the blockchain breaks the patches you’ve mentioned for the fact that QC also breaks elliptic curve crypto.
That’s true, but there’s some precedent for picking a block that everyone agrees upon (that exists before quantum computers) and changing the rules at that block to prevent someone from rewriting the blockchain. A lot depends on how much warning we have.
It looks like making a cryptocoin that can survive quantum computers might be a high value activity.