user92394: Other threads already answer very clearly that quantum comps could easily "break" /attack bitcoins chain. 
Now: Are there any ideas among the bitcoin devs circulating out there, how to save bitcoin from future quantum attacks? its only a couple years away right?
What could be viable options to change and make btc quantum proof, changing hashing algorithm to which new algorithm? 
Thanks!
__

user137501: It is currently understood that quantum computers could theoretically offer a quadratic speed-up in cracking hash function preimages using Grover's algorithm, and cubic speed-up in finding hash collisions using Brassard-Høyer-Tapp algorithm.
It is also understood that elliptic-curve cryptography would be the the first to go as it could be completely broken using Shor's algorithm.
We summarize this in the table below:




Primitive
Conventional Computing Security Level
Quantum Computing Security Level




ECC-256
128 bits
0 bits


SHA-256
256 bits (preimage) / 128 bits (collision)
128 bits (preimage) / 85 bits (collision)


HASH-256
256 bits (preimage) / 128 bits (collision)
128 bits (preimage) / 85 bits (collision)


RIPEMD-160
160 bits (preimage) / 80 bits (collision)
80 bits (preimage) / 53 bits (collision)


HASH-160
160 bits (preimage) / 80 bits (collision)
80 bits (preimage) / 53 bits (collision)




From that we can say it is not so much about the algorithm - it is more about the hash function output size. Quantum computing doesn't break the algorithm but offers a speed-up for ANY algorithm, so all we'd need to do is pick one and increase the hash output size to 384 bits so we can maintain the 128 bits of security against collision attacks. BLAKE2 or SHA-3 would be good candidates. Even the SHA-2 familiy SHA-384 would be OK.
Actually implementing this in Bitcoin protocol would not be trivial, because a change of hash function would break a lot of software out there.

92394: <p>Other threads already answer very clearly that quantum comps could easily "break" /attack bitcoins chain. </p>

<p>Now: Are there any ideas among the bitcoin devs circulating out there, how to save bitcoin from future quantum attacks? its only a couple years away right?</p>

<p>What could be viable options to change and make btc quantum proof, changing hashing algorithm to which new algorithm? </p>

<p>Thanks!</p>

<p>__</p>
 137501: <p>It is currently understood that quantum computers could theoretically offer a quadratic speed-up in cracking hash function preimages using <a href="https://en.wikipedia.org/wiki/Grover%27s_algorithm" rel="nofollow noreferrer">Grover's algorithm</a>, and cubic speed-up in finding hash collisions using <a href="https://en.wikipedia.org/wiki/BHT_algorithm" rel="nofollow noreferrer">Brassard-Høyer-Tapp algorithm</a>.
It is also <a href="https://www.researchgate.net/figure/Comparison-of-conventional-and-quantum-security-levels-of-typical-ciphers-12_tbl1_332863808" rel="nofollow noreferrer">understood</a> that elliptic-curve cryptography would be the the first to go as it could be completely broken using <a href="https://en.wikipedia.org/wiki/Shor%27s_algorithm" rel="nofollow noreferrer">Shor's algorithm</a>.
We summarize this in the table below:</p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>Primitive</th>
<th>Conventional Computing Security Level</th>
<th>Quantum Computing Security Level</th>
</tr>
</thead>
<tbody>
<tr>
<td>ECC-256</td>
<td>128 bits</td>
<td>0 bits</td>
</tr>
<tr>
<td>SHA-256</td>
<td>256 bits (preimage) / 128 bits (collision)</td>
<td>128 bits (preimage) / 85 bits (collision)</td>
</tr>
<tr>
<td>HASH-256</td>
<td>256 bits (preimage) / 128 bits (collision)</td>
<td>128 bits (preimage) / 85 bits (collision)</td>
</tr>
<tr>
<td>RIPEMD-160</td>
<td>160 bits (preimage) / 80 bits (collision)</td>
<td>80 bits (preimage) / 53 bits (collision)</td>
</tr>
<tr>
<td>HASH-160</td>
<td>160 bits (preimage) / 80 bits (collision)</td>
<td>80 bits (preimage) / 53 bits (collision)</td>
</tr>
</tbody>
</table>
</div>
<p>From that we can say it is not so much about the algorithm - it is more about the hash function output size. Quantum computing doesn't break the algorithm but offers a speed-up for ANY algorithm, so all we'd need to do is pick one and increase the hash output size to 384 bits so we can maintain the 128 bits of security against collision attacks. BLAKE2 or SHA-3 would be good candidates. Even the SHA-2 familiy SHA-384 would be OK.</p>
<p>Actually implementing this in Bitcoin protocol would not be trivial, because a change of hash function would break a lot of software out there.</p>
