WEBVTT Automatically timed original source text; AI narration; timing not manually listen-through verified. 00:00:00.000 --> 00:00:02.520 Output Type Design Considerations. 00:00:02.520 --> 00:00:16.940 Notes from a panel with Pieter Wuille and conduition, moderated by Justin of Localhost Research, at the Post-Quantum Bitcoin Workshop at Stanford, 28 August 2026, written by Mike Schmidt. 00:00:17.360 --> 00:00:19.220 This is an AI recording. 00:00:19.850 --> 00:00:24.910 Find the original text and more information on btctranscripts.com. 00:00:25.050 --> 00:00:30.170 Reference: delvingbitcoin.org — PQC output type discussion 00:00:31.150 --> 00:00:31.690 Framing 00:00:32.410 --> 00:00:38.310 Topic: how do PQ schemes hook into Bitcoin consensus — output types and their design? 00:00:38.630 --> 00:00:49.350 This isn't Bitcoin's first output-type transition (BIP11, BIP16, SegWit, Taproot) — but this time we're more informed, with real usage and migration data. 00:00:50.600 --> 00:00:52.060 The Two Main Proposals 00:00:52.060 --> 00:00:54.520 P2TRv2 (Pieter) 00:00:54.520 --> 00:01:08.700 Background: Taproot's key path / script path design, with unused paths hidden. Taproot hasn't seen the adoption hoped for — partly because the low-feerate environment blunts its space savings. 00:01:10.030 --> 00:01:16.690 P2TRv2 = P2TR with PQC opcodes / leaf types added. 00:01:17.420 --> 00:01:27.280 Crucially, with the explicit agreement and clear expectation that a user opting into this output type accepts that EC spending can and will be disabled. 00:01:28.180 --> 00:01:30.260 P2MR (Conduition) 00:01:30.620 --> 00:01:35.160 P2TR with EC key tweaking removed (~360 origins). 00:01:36.360 --> 00:01:42.260 No depth-zero trees — removes the mal-incentive toward a single spending condition, which degraded privacy. 00:01:42.820 --> 00:01:51.860 Possible combinations with other ideas: CISA, key recovery — since P2MR is less efficient to use pre-Q-Day. 00:01:53.030 --> 00:01:53.930 The Tripwire 00:01:53.930 --> 00:02:07.620 Codifies the expectation of disabling EC spending: if secp DLP is demonstrably broken (example triggers were listed), EC spending in P2TRv2 is disabled. 00:02:08.840 --> 00:02:20.080 Disabling applies only to P2TRv2 — not P2TR or other types. Because it's explicit in the output type, it avoids being seen as confiscation. 00:02:20.840 --> 00:02:40.240 Pieter doesn't actually expect EC disabling to happen via the tripwire — its purpose is an upper bound that forces users to take EC-disabling seriously, removes doubt, and removes the risk of EC disabling in it being considered confiscatory among users and potential migrators. 00:02:41.250 --> 00:02:43.490 Criticisms and alternatives discussed: 00:02:44.300 --> 00:02:47.720 Some see it as "at best a psychological thing." 00:02:48.340 --> 00:03:02.720 Similar proposals use toy curves — a ladder of increasing curve sizes — but there's no way to know whether attack progress will be fast or slow, and individuals can run such demonstrations independent of consensus rules. 00:03:03.830 --> 00:03:12.130 Tripwires could serve other purposes too (e.g., triggering rescue protocols), not just EC disabling. 00:03:13.590 --> 00:03:23.070 Incentivization: tripping the wire is a public good (cf. Google's demonstrations) — people could donate to the tripwire address to form a bounty. 00:03:24.660 --> 00:03:27.960 Steal vs. Freeze — "The Existential Threat" 00:03:28.990 --> 00:03:36.190 "The biggest threat, the hardest problem, is the steal-vs-freeze discussion" over Satoshi-era coins: 00:03:37.330 --> 00:03:44.300 Letting quantum computers steal violates the expectations people have of cryptocurrency — what's the point? 00:03:45.700 --> 00:03:51.600 Freezing coins — then what distinguishes Bitcoin from anything else, if coins can be frozen? 00:03:52.840 --> 00:03:57.220 Taking coins out of this equation — via migration — is the priority. 00:03:58.920 --> 00:04:02.530 Witness Structure & Costing PQ Signatures 00:04:03.460 --> 00:04:14.070 Pieter: introducing a new witness is a big step (but slightly less than segwit was), especially for hash-based signatures, given the bytes-vs-cost distinction. 00:04:15.290 --> 00:04:23.030 Effectively a block size increase available only to PQ signatures — justified because those bytes are easier to process. 00:04:24.290 --> 00:04:35.940 On costing: you could price PQ sigs per-byte like Schnorr, but that doesn't make sense — instead I argue for something based on both bandwidth and computation costs. 00:04:36.690 --> 00:04:42.470 Audience member comment: keep throughput the same and adjust the costs, alternatively 00:04:43.420 --> 00:04:51.200 Response to the above: Keeping the throughput the same is a technical possibility, not a goal on itself.. 00:04:52.450 --> 00:05:10.260 PQ data blob / new witness lessons learned: DoS concerns exist just at the P2P layer, plus data structures get duplicated everywhere. You can introduce a new witness and nest the old hash inside it — somewhat less painful to upgrade than the original SegWit witness. 00:05:11.440 --> 00:05:13.800 Should We Wait for Better Cryptography? 00:05:14.410 --> 00:05:23.830 Today's cryptography doesn't let Bitcoin migrate fully to PQ (no HD keys, limited confidence in schemes, etc.). 00:05:24.400 --> 00:05:37.750 To avoid the freeze/steal dilemma, migration should start sooner — especially for the long tail. The scheme should be reasonably adoptable by everyone (industry, Lightning, etc.). 00:05:38.950 --> 00:05:51.200 Having "something" people can adopt is enough to establish Bitcoin as quantum-ready ("street cred"). Throwing more features in risks delaying implementation and activation. 00:05:52.170 --> 00:05:53.970 Real-world adoption constraints: 00:05:54.750 --> 00:06:01.670 Engineering cost for the ecosystem (wallets — including multicoin wallets that rarely ship Bitcoin updates) 00:06:02.290 --> 00:06:06.920 Users must want to adopt it; fee considerations matter 00:06:07.720 --> 00:06:10.760 Witness changes are more invasive and more political 00:06:12.260 --> 00:06:13.720 Recommendations & Comparison 00:06:14.810 --> 00:06:26.980 Pieter's short-term recommendation: P2TRv2 with tripwire, using the simplest PQ signature scheme. P2MR later, or with a more advanced scheme. 00:06:28.510 --> 00:06:46.770 User/usage types influence the approach: assuming perfect usage (no address reuse or key disclosure), P2MR is PQ-secure — but assuming perfection isn't great. Thus the tripwire applies equally to both proposals. 00:06:47.110 --> 00:06:55.710 P2TRH was covered at a high level — summarized as "a weird middle ground" and not an easy-to-roll-out solution. 00:06:56.950 --> 00:07:05.090 A hash-based first step is the conservative option and can migrate the long tail of users without further action on their part. 00:07:06.220 --> 00:07:09.080 CISA / Signature Aggregation Impact 00:07:09.080 --> 00:07:18.360 Brief overview of cross-input signature aggregation (DahLIAS, etc.): more efficient blockspace use, lower fees. 00:07:18.860 --> 00:07:33.770 More beneficial to P2TRv2 than P2MR (P2MR needs the pubkey among other fields; 64-byte lower bound; half-agg gives ~96 bytes with P2MR). 00:07:34.470 --> 00:07:41.870 Note: these benefits exist only pre-Q-Day. Audience comment: this incentive muddies the waters. 00:07:43.380 --> 00:07:44.440 Audience Q&A 00:07:45.070 --> 00:08:15.010 Should the output type discussion be tied to a new PQ opcode? Runs into confiscation risks; P2TRv2 already carries both EC and PQ options. There's no realistic enforcement mechanism — that's what the tripwire is for — and people could just add a dummy key if forced. Since P2TRv2 has no other advantages, the whole point of using it is PQ. 00:08:15.670 --> 00:08:33.850 Spending from PQ back to quantum-vulnerable outputs defeats confidence — can it be made one-way? Idea floated: a standardness rule refusing to relay PQ→quantum-vulnerable spends. Pieter sees this as unrealistic — you couldn't pay "anyone" anymore. 00:08:35.020 --> 00:08:46.280 Special key-path key signaling the key path is disabled? No benefit vs. P2MR; feels hacked-in. (Debate about whether it eases deployment.) 00:08:47.370 --> 00:09:11.850 NUMS point generation for the tripwire? Options discussed for a BIP-specified generation process; also an OP_RETURN-with-private-key option; also: a Taproot script-only key put on chain — if it's ever spent via key path, that's proof DLP is broken. Counterpoint: a rational attacker will simply avoid the tripwire. 00:09:12.320 --> 00:09:19.400 Is the tripwire immediate, or does it take effect next targeting period? (Raised; discussion not captured.)