S16 E35: Hunter Beast on Bitcoin's Quantum Resistance & BIP 360

0:46Vlad CosteaHello there and welcome to the Bitcoin Takeover Podcast. This is Season 16, Episode 35. Time flies, 35 already. This episode is sponsored by SideShift, Citrea, Bitcoin.com News, Edge Wallet, LayerTwo Labs, and NoOnes.com. And we are live with Hunter Beast, who is the author of BIP 360, an attempt to make Bitcoin quantum-resistant. And it's a very hot topic right now because there are some predictions that say or claim that quantum computing will get very advanced in the next couple of years. And there are also people who pretend that it's not really a threat, that it's just some general purpose qubits that are not efficient in cracking the cryptography behind Bitcoin, more specifically ECDSA signatures.

1:38And we got to talk about this and also about the approach presented by BIP 360, because there are lots of ways of adding quantum resistance to Bitcoin. You can do a soft fork, you can do a hard fork, you can have some conditions there. But it's really good to have you Hunter Beast. Let's talk about this. Sounds good. So how would you define the quantum threat to Bitcoin?

2:05Hunter BeastWell, it's not real yet, it's existential. There are certainly concerns that, so there's a couple things. One is, what's really difficult for Bitcoiners to appreciate, I think, is that quantum computing isn't sovereign computing. It's not something that you can just go ahead and verify and not trust. It's institutional, it's something that large businesses and corporations and institutions, organizations, very large institutions, it's only accessible to them, for them to experiment with.

3:04And so it really isn't like the kind of thing that an ordinary Bitcoiner would probably ever, or maybe not ever, but for a long time, for a long time, will ever have access to the capability to verify that a quantum computer can break Bitcoin.

3:25But that said, that doesn't mean it can't. And it also doesn't mean that we're not already there or close to it, we just don't know it yet. What we do see is that we're being repeatedly warned by the American government that there are, that there is a need to prepare. And as a result, the American government and all the institutions here have programs and processes that they're going through to achieve quantum resistance by 2030.

4:15It's the kind of thing where it's relatively trivial for centralized systems to hire experts and upgrade their systems and make sure they're hardened and audited and that sort of thing. Bitcoin, well, it kind of has similar experts, right? Like it has its maintainers, it has BIP editors, and it has, you know, all sorts of development activity and eyes on it. But that said, it's much more difficult to upgrade, for good reason, right? Like, it's just, if we, that said, if we have a relatively trivial, low touch, narrowly scoped, not even fully focused on quantum security upgrade for Bitcoin, then it should potentially be our best chance to, you know, mitigate against this concern.

5:27Vlad CosteaOkay. At the same time, it's very hard to agree on how to do it, even if there is consensus that this is dangerous for Bitcoin. Like, the most efficient way to do it would be to hard fork, because that's how you're certain that all the UTXOs have migrated to the system. And there is no value in the old chain. And therefore, if a quantum computer breaks that, we have already moved on. But that's not really how Bitcoin consensus works. So you're going to want to have a soft fork.

6:03But the question is, well, what if the coins don't move, right? Because you're going to need everyone to move their coins into addresses that have this quantum resistance.

6:17Hunter BeastWell, the four ways in which Bitcoin can, like a coin, can become vulnerable to quantum computers are by being in Taproot addresses, by being, well, essentially in any case, short, like Taproot addresses, reused addresses, and anything published to the mempool and pay-to-public-key coins. So any address that has a public key exposed, that is potentially quantum vulnerable.

7:05And so what's interesting is about 90%, maybe even more of reused address coins and reused addresses are active. So I'm not too worried about the reused addresses, really. That's something that we thought we might need to address in Hourglass v2.

7:27And then we looked into the data, and it didn't hold up.

7:31It's very likely that 90% of the coins from reused addresses will go into something more secure once that's available. And especially once there's a major concern. Another thing is, for pay-to-public-key coins, we could either burn them or do something like Hourglass, which would restrict the rate at which they're capable of being liquidated. But regardless, I'm not too worried about the threat posed by increased amounts of liquidity. At least before I went to Presidio Bitcoin, I was a little bit more concerned about it.

8:20But then after Presidio Bitcoin, I walked away and I was like, you know what? We may not even need to do anything about this. What we will need to do is a soft fork to prepare against the vulnerability of what are called short exposure attacks.

8:35Pay-to-witness-public-key-hash, pay-to-public-key-hash, 1 and 3 addresses, bc1q, those are all fine. And so any coins held in those kind of addresses are probably going to be fine so long as you haven't spent from that address yet. If you're reusing addresses, it's a different story. But because there's already quantum-resistant ways to use the chain, then I'm not terribly too concerned, certainly especially against long exposure attacks. However, Taproot is vulnerable to long exposure attack. And so we should upgrade Taproot if we want to continue using things that use Taproot, like RGB and like BitVM, right?

9:26And like, that's something I've been trying to talk to BitVM people about, like David Seroy, he was at the Presidio Bitcoin Summit as well.

9:44BitVM depends upon Taproot to work, but it would be really nice if we could have a quantum-resistant version of Taproot, which is what BIP 360 is about. And basically, at this point, we've scoped it down so narrowly that all it does really is just fix the quantum vulnerability of Taproot to long exposure attacks, and also enable, it basically allows wallets to commit to multiple scripts in the same address. So that way, you can choose at spend time which script you want to spend from. And if you have knowledge of all the other scripts, but you don't need to reveal them, you can just reveal them selectively.

10:30You can reveal scripts that commit to post-quantum opcodes and post-, you know, like quantum, like SLH-DSA type stuff, and public keys, and that sort of thing. And that's, I think that that's, that's like being really minimal, low touch, like, maybe adding one single post-quantum cryptography algorithm, I would be happy with. And it would solve a lot of, it would make BitVM people's lives easier. It would, it would, it would make RGB quantum fully quantum resistant, especially RGB 12. And so, yeah, there's, there's, there's a, there's a number of things that like BIP 360 helps move along the move the ball along.

11:22And so I hope that it's a pretty small and uncontroversial change. Of course, everything is controversial on Bitcoin. I shouldn't expect no controversy, but we've done our best to like reduce the, how would you say, me and my co-author Ethan Heilman, we've done our best to reduce the attack surface for criticism against the change.

11:51Vlad CosteaIs your co-author the same Ethan who also worked on OP_CAT, on rewriting it? Yeah. Oh, good luck with that. I hope Udi Wertheimer doesn't promote BIP 360.

12:05Hunter BeastI can't comment on that.

12:13Vlad CosteaYeah. Anyway, to get back on topic, it's been known for years that the biggest weakness to quantum computing that Bitcoin has is the elliptic curve digital signatures. And there were proposals to replace them with, I think the first ones that were being presented, and this goes back like five or six years ago, it was Lamport signatures, which are pretty large in size. And there's also Winternitz signatures, which I'm not sure if there are any better. And I was going to ask you, which ones do you think are optimal for Bitcoin and which ones does BIP 360 propose?

12:53Hunter BeastSo the big problem with both of those signature schemes is that they're one-time signatures. So they, if you ever were to reuse an address that committed to a Lamport signature public key, then you would, you would have like a, the risk of revealing your secret key after every repeated spend. And so, to fix that, there's this algorithm that came out in 2015, called SPHINCS+, also known, now known as SLH-DSA. And it essentially uses what's called a hypertree of deterministically generated Winternitz one-time signatures.

13:45And so it's like this like massive tree of Winternitz signatures, that, is then like, you'll, you'll deterministically select which public key to use at any given time. And, there's like, there's, that's, that's why you can even provide entropy at signing time, which is an interesting feature of, I guess you can do that with ECDSA as well. But, the, yeah, it's just not, it's not often like, it's funny. Oftentimes like APIs will not give you the capability to provide entropy at signature time, which is annoying because you want to make that deterministic.

14:30But regardless of that, there's, yeah, there's, that's a common problem in cryptography, crypto systems, and pretty much. Like we always think of the entropy required to generate the key, but we never think of the entropy required to sign a signature. Anyway, that's such a nerdy point anyway. But yeah, Winternitz signatures. Yeah, they're, they're, they're definitely relevant. And, it's just that they're, they're kind of like hidden in this hypertree of, like signature, possibilities.

15:09And that helps you, like they create like 20 million, something like that. Maybe even more, probably more, a lot more, I think 20 million is the minimum, number of like public keys needed to like, you can always set the minimum. You can set these, variables in the, in the algorithm, but, it depends on like, do you ever intend to reuse your addresses? If not, then you can, you know, generate a lot fewer keys and then you can, you know, commit to smaller public keys and signatures, or you, if you intend to reuse the heck out of it, or you want it to be very, resistant to address reuse, then you can set the figure higher.

15:55And ideally we'll have like an op code that gives you these like security parameters to tweak. So that, whenever you go to like generate, you can generate keys of varying, security, and that would help dial in your costs and help users just, arrive at similar, or whatever the needs meet. May require, but the, of course there would be need for more, more involved security review of that. So yeah, Winternitz and Lamport signatures are, they're relevant, but they're also, flawed.

16:41And so that's what SLH-DSA resolves is the capability to use those public keys.

16:48Vlad CosteaI want to ask you this, if we do have quantum resistance signatures and the different type of addresses that provide the quantum resistance. Does it change the user experience of Bitcoin and the way that we have it today? Like the average user, does he require any kind of extra education on how he should be using Bitcoin?

17:10Hunter BeastWell, we might need that if we use something like, Tadge Dryja's commit-reveal scheme that he proposed, and in the Presidio Bitcoin quantum summit, which I highly recommend. Watching it was, I think that was on the first day. Yeah. It was later on later the first day. And it was, it would basically require you to commit in advance to, like funds in an output. And then like basically commit to spending before actually spending.

17:55And so, that's, like an additional step, I think, to the whole process of using Bitcoin, which, you know, might make sense if it's actively under quantum attack, because, I mean, because, commit-reveal type schemes, commit-reveal scheme does protect against short exposure attacks, which would be like, kind of like the big, the big problem if there were sufficiently advanced quantum computers, but, like very, very advanced quantum computers, I should say like, not even like bare minimum bare minimum would be long exposure attacks.

18:40Right. And so, as far as like other things, there might be like, for BIP 360, there might be a switch in the wallet that says like dial your security, you know, like how much do you want? How secure you want this to be versus like how much value it has and how much it'll cost to spend in the future. And it turns out, they're, they're even discussing making Bitcoin transactions 10, 10 times cheaper than the bare minimum. Right. So, like it's gotten that bad that the mempool is like that empty.

19:19We're like, we're seeing like, you know, maybe 10 blocks of 0.1 sat per vbyte transactions. And then like, maybe one, you know, that's one, one sat per vbyte, but that's a cool update by the mempool team. Kudos to them. But yeah, it just shows like where the fee, the fee market is and like, you know, so if that's where it is now, then it certainly makes sense to like allow people to, commit to it in advance. Like kind of like price in advance, their spends.

19:54Generating an address is actually quite minimal though. Like addresses are like when you commit to an address and you spend to that, you put that in your output script, then, your scriptPubKey. They, I think that's what it's called. Then, you'll, you won't need to spend much to do that. It's only about like 30, 34 bytes of data. Whereas like, an actual post-quantum signature will be something like four to 8,000 bytes, actually post-quantum signature pair, post public key and signature pair.

20:46So, that's, that's everything you need to spend. So it's not just this, like some people say, like, it's, it's, it's, it's like, you look at the signature size and they look at that and it's like, ah, you know, but then they also forget to look at the public key size. Public key size in SLH-DSA is actually not quite large either. It's just a commitment to the, to the root of the hypertree, right? The Merkle root of the hypertree. And so, there's like a lot that you can do with that, but, that's only like for SLH-DSA-128s.

21:17It would be a 32-byte commitment. And so, yeah, there's, yeah, there's, there's like a couple like changes that you would need to make, but it's, like if we went with BIP 360, it wouldn't, it wouldn't be a huge, like you could run with defaults. You could have defaults that are reasonable. It wouldn't be a significant departure from the way wallets currently work.

21:50Vlad CosteaRight. It sounds to me as if a block size increase would be pretty helpful to get more people to use quantum signatures, quantum resistant signatures. But before I let you answer that, let me plug a couple of sponsors. SideShift.ai is the place where if someone wants to pay you in stablecoins, and you don't want to hold onto that because we're in the middle of a bull market, you can basically put your Bitcoin address in there and send the receiving address to the person. Are you stuck or are you in pain? I'm not sure.

22:24Hunter BeastI'm just, I'm just listening.

22:26Vlad CosteaOkay. And you're going to receive your BTC to your address and the sender is just gonna dump their stablecoins to SideShift and they know what to do with it next. Or if you have a bag of shitcoins, like I hear Ripple is up and maybe you don't want to hold onto that because usually it's under $1 and now it's like three something. You can also swap that on SideShift. So check it out. They have a lot of liquidity.

22:52And the fees are pretty low. And LayerTwo Labs. What do you think about drivechains, Hunter Beast?

23:00Hunter BeastOh, they're actually pretty cool.

23:02Vlad CosteaI'm a big fan. I think it's an idea that deserves to be tried.

23:07Hunter BeastOh yeah. I mean, like, I think they solve a lot of problems, right? Like, like, I mean, as somebody who's building a sidechain, one of the big problems is like, what do you do with the treasury? What do you do with the funds that are pegged to the sidechain? How do you peg in and peg out, right? Like drivechains comes up with like really good, secure solutions to that, sort of like decentralize the, how would you say the custody responsibilities.

23:38So it basically makes like unruggable sidechains in a way, right? Like, so long as you trust in the fact that protocol is implemented correctly, that it's like the drivechain protocol won't just like, you know, have a bug in it or some kind of flaw introduced and then just like rug all the people who are in the sidechain. But regardless of that possibility, if you, if you, if you have an audited, you know, dependable sidechain, protocol, then you could, scale Bitcoin and get Bitcoin miners fees to like for that scale.

24:19And so that, in many ways, like kind of puts to bed, like, do we need a scale Bitcoin problem for a long time, at least. And, it's a pretty, like, you know, like I would say elegant solution to that problem, for post-quantum cryptography. I don't think we need to increase the block size necessarily, ever really, just because like, for one, I mean, you see that where the current fee market is, of course, it's not going to be that way forever.

25:04And hopefully it isn't because then, you know, the, the sustainability of Bitcoin is in concern if that is the case. But that's, and that's, and that's why, you know, like drivechains makes a lot of sense because that then allows you to scale Bitcoin and then drive fees to miners to help secure it. And, that it's, there's also the other possibility is to just implement, something called BitZip, which is, a way to do like kind of like a block wide cross transaction compression algorithm that, is post-quantum resistant and, or uses post-quantum cryptography, scales post-quantum cryptography.

25:54And, BitZip would essentially use ZK-STARKs. And, that would be done at a miner, at like a block level by the miner to aggregate those signatures into the block and squeeze some extra fees out, while packing more transactions in. And I could scale Bitcoin by a good 10x, at least, which is I think pretty good. And would, we'd be pretty set for a long time.

26:31After that, you know, like drivechains certainly becomes like more of an appealing solution, but, you know, I think they're already pretty appealing. I think that, but that said, the other thing with sidechains is as with everything with Bitcoin, you can always demonstrate the need for solutions that could be built on drivechains, just without necessarily implementing them. Just because you can do a merge, just a regular merge-mined sidechain, and, not with blind merge mining or hashrate escrow, but any of those fancy features, but just like ordinary, just like merge mining, then you still drive fees to the miners, but you don't.

27:21And you get to like scale Bitcoin on that sidechain, but you don't necessarily get the, like kind of like you usually have to solve for that with a federation and a federated multisig is kind of like, you know, like putting all the funds in one place. And then, you know, hoping that everybody stays secure and follows the protocol rules and doesn't, nobody gets rugged. Like that's, you can do your best to put the work into making sure that won't happen, but there's still no guarantee in the way that you would have against that with, that you would have with drivechains. Drivechains, I think, make a lot of sense and would be really nice.

28:07I just don't know if we can have nice things on Bitcoin.

28:11Vlad CosteaI'm going to send this to Paul, I guess he will like your review, but the reason why I mentioned that is that basically the advertisement is for people to go to layertwolabs.com in the download section and try the software, which runs on the signet right now, because it looks pretty good. And it's ready for testing for anyone who just believes that this is only a theoretical proposal. It's there. You can use it. I think Litecoin is gonna implement it. Seems like it.

28:43Hunter BeastWow. Like drivechains and Litecoin. Wow. Well, they did, they do a lot of interesting stuff, right? They did the Lightning stuff. They did Mimblewimble, like, you know, so like there's, there's, there's some cool stuff happening there. I guess I wouldn't put my money in it, but that said, it's cool that they're willing to experiment with it.

29:04Vlad CosteaWell, there is money to be made if you're capable of breaking it in ways that some people are FUDing, right? Just like OP_CAT on Bitcoin Cash. You're like, okay, I think OP_CAT is going to destroy Bitcoin because you can do this. Okay, do it on Bitcoin Cash if you think that's what's going to happen.

29:24Hunter BeastWell, Bitcoin Cash hasn't been destroyed yet since, even though it has an OP_CAT, right? Like, yeah, it's, it's funny. Yeah. That's one, that's one argument, I guess. I mean, OP_CAT like it's, it would be nice. It would, it would like, it would, a lot of, a lot more things would be possible, but I don't know if people want more things possible on Bitcoin. Like there's, there's, there's demand on either side, right. I would say there's demand on the people on the side of people who want more things to be possible.

30:00And then there's also the people on the other side who are just like grumpy curmudgeons or like kind of comfortable with the status quo, you know? Right. Like and maybe I shouldn't be so insulting to the ossifiers. There's very good, you know, Giacomo Zucco level reasoning behind ossification. Right. Like, he's a very smart guy. And I yeah, I mean, like, I don't disagree with most arguments for ossification. There's just like, but we do know that like, we do need to fix certain things in Bitcoin at certain times.

30:42And hopefully we do that at certain times, like at the times needed, they might be decades from now, but you know, like we'll need to change Bitcoin eventually. It's just, you know, like, and the hard-, the more, also another thing to note is, the more value it secures, the harder it becomes to change, which is also unfortunate. But another problem is like the more people using it, the more you'll have actors who will try to coerce and, you know, force changes because due to their own personal economic interests.

31:25And that's something to always be vigilant about. And like one of those concerns could be economic node runners that are then like trying to mitigate against quantum threats. And like, especially if their investors are, you know, pushing them to be like, you know, like my bank just upgraded Apple just upgraded, like, you know, my school was just upgraded. The government just upgraded what the heck is Bitcoin doing? We need to upgrade. And like, if you don't upgrade, I'll sue you. At which point, like, then that gets, that gets weird.

32:09Right. And so ideally we avoid this whole situation just by like being proactive, but I don't know if that's possible. We'll see. We'll see. I might be pleasantly surprised. Like I, there are definitely like some loud detractors in the community that I've heard from, but like, and I hear your voices. I just think that it's retarded to not like do anything that would like, if you see somebody pointing a gun at you will, and they're saying, dude, and somebody's saying like, dude, you're going to get shot.

32:56You should move, then you should move. Right. You should get out of the way. You should do something different. You should change your position. Right. And so that's, that's, I don't know. That's just my opinion as somebody who is highly invested in Bitcoin, I invest in nothing else. I don't have, look, I mean, I lost all my Bitcoin in a boating accident, so I'm just starting over, but that said, I would never put my anything other than Bitcoin. And so like, I don't want that to be broken.

33:34Like, I think a lot of people would prefer that not to be broken. I'll, I know it sounds like a fear-based argument and that's like super unconvincing to a lot of people. And I'm sorry, but like like the government really only has like a few tools to like warn us about this. Right. Like what, if they have the capability and they're trying to warn us, like what else are they going to do than just like, tell you like, Hey, this is a warning. You need to be afraid.

34:01They're like, fear is like people put a bad, a bad word of fear. Like people think it's like a bad thing to like to reason about it, think about it, listen to, but like, it's, it's like an evolutionary instinct. It's gotten us pretty far, you know, this far. And so I don't know. I just think it's, it's a frustrating state of in Bitcoin discourse as usual, as always. Right. But, and, you know, we haven't even gotten a solution ready yet.

34:34Like we're hoping to have one by the end of the year, but I hope I'm, I'm not this frustrated by then because like, it's only going to get worse, you know, the more, the more it becomes, how would you say, like sooner, like the more it becomes like closer to the process of activation, it's only going to get more stressful. But I signed up for this as a BIP author. And so, you know, I'll try to weather through it and try to address all the, any, how would you say, critique of good faith.

35:24I just, it's also, you know, like there's, there's a lot of like paranoia in Bitcoin as there should be, right. Like only the paranoid survive and I'm paranoid about quantum computers. I don't know. Like, I don't know what the counter-paranoia is to that really. I haven't really quite understood like, okay. Like, okay. So they're, they're trying to force a change. The spooks are trying to force a change, right? Like, I don't buy that. I don't think that makes any sense. I think that's like, that's, I don't know.

36:02I would encourage people who have that thought process to like, think more critically about that thought process, before just rejecting a change that would like make Bitcoin more secure. Anyway, that's, that's all I got to say to that.

36:18Vlad CosteaWell, I can come up with my own conspiracy theory based on what you just said, you're trying to make Bitcoin transactions harder and more expensive at the expense of basically preventing an attack, which is super hypothetical because the US government tells you about quantum computing. That's becoming a menace while at the same time, Satoshi's coins haven't moved. And for as long as they haven't moved, it's basically a proof to us that Bitcoin is secure. And the point of the US government or the purpose is just to keep the price down and keep investors scared so that they can buy more time to come up with their CBDC.

37:01There you go. Okay.

37:03Hunter BeastOkay.

37:04There's a couple of holes I can poke in that conspiracy theory. One is, BIP 360 transactions commit to an address that, you can, you get to choose whether you spend classically or you spend, with a post-quantum signature. So like you would only spend with post-quantum signature if you were worried about your funds being taken, right? Like if there was like an actively used quantum computer, this is like a further out commitment, right? Like, like something that protects you from much further out, but it gives you the choice because it's a Tapscript.

37:37Right. And so, it's, you can, you can commit to a script that a script path that, you know, goes to a Schnorr signature or requires a Schnorr signature at least, or you can do a script path that commits to a hash of a public key that then, gets, presented in the signature. And so, either way, like in the witness, I mean, and, either way like that, you have the option it's always optional, right? Like that's, I keep telling people like, this is just, this is an opt-in thing.

38:17You'll, you'll only use it if you need it. Right. Like you don't take the gun with like guns to guns with you to the grocery store. Right. Like, at least certainly not you, Vlad. Right. But like, I shouldn't say everyone there's some Americans here would definitely do that. But, regardless, there's, there's also another thing, which is, we just passed the CBDC, like, we just passed a law and it was for, making stablecoins, like Tether, like, you know, like legal here in the U.S. Like fully legal, like fully, like there are laws around it and, we'll see, we'll see how that goes.

39:06You know, like how Tether responds to that. And if that's good, I think it's probably good. You know, like, I mean, to be fair, I prefer stablecoins that don't strengthen the dollar, like Tether actually strengthens the dollar because they buy US treasuries and they back it with US treasuries and they make a ton of money doing that, which is a very lucrative thing. Another thing you could do is, create what they call a, it's something that Ducat Protocol is working on.

39:37Have you heard of Ducat Protocol? It's a collateralized debt position. And, like you could just like have an MPC cluster that has, goes over like a FROST multisig and it just like. Yeah. FROST is actually kind of, we're going to, we're going to need to get rid of FROST if we're going to be quantum resistant, but that's another thing. I was just thinking that, but, regardless, if you have a multisig in an MPC cluster and you put some Bitcoin in it and you issue like a stablecoin against that Bitcoin, and you have like a price Oracle and you have a DLCs discrete log contracts, you could, you could, that's basically the recipe for, like a Bitcoin-backed stablecoin and a Bitcoin-backed stablecoin, weakens the dollar and strengthens it.

40:28It's like, it's shorting the dollar for, by backing it with Bitcoin. I like those a lot. I like that concept a lot because you're, you're basically betting against the dollar, which given enough collateral is a sure enough bet. And you just never have to sell at which point you're just riding out the, you know, hyperinflation of the US dollar, which is a scary thing to say. But as any Bitcoiner will appreciate, like, that is like the, that is, that is, it seems like an inevitability at this point.

40:59I mean, along with the, the GENIUS Act, they also had the One Big Beautiful Bill that winds up spending $2 trillion deficits, every year. And that's just like new money that the government's good for it, that they will pay, that will enter the system that they never got in advance. And they're just essentially printing it. Right. And so, it's, without a balanced budget, we're, we're kind of fucked, without, like fractional lending or what do they call it?

41:33Like when you, when you take broad money, base money and turn to broad money, right? Like that's that process, like private lending, like that, we're also, that's also monetary expansion, but it's not as bad. It's like the private money lending is monetary expansion is not as bad as government spending in my opinion, but like maybe Lyn Alden has some thoughts on that, but, you know, anyway, that's, yeah, that's, I'm, I'm, I'm not too worried about a CBDC from the US government.

42:02I'm a little bit more, I'm a lot more worried about, like, I mean, CBDCs from the US government is basically dead, like with the, with the GENIUS Act, like we've replaced those with stablecoins, stablecoins are going to be the CBDC equivalent. And that's actually not terrible. If you understand that, like, you know, like you can have some, you know, like depends which stablecoins and what you're doing, but like you can have some privacy and some permissionlessness. And so it's, they're like, there are infamous cases where, like people have taken Tether from people and then Paolo Ardoino posts on Twitter is like, oh yeah, we set that back.

42:46But that's only really possible in EVM contracts. Like if you're doing that on, like, anything that's more Bitcoiny, like Liquid, then you might not, we probably don't have a problem. You might have other problems, but not that one. So, and they have confidential transactions as well, which is good for privacy. And so, if you're interested in privacy coins, Vlad, I know you were on a privacy coin investment kick for a little while there. I invest, I would highly recommend an investment called L-BTC.

43:17It's Liquid BTC.

43:19Vlad CosteaYeah, it sucks. I would not touch that.

43:24Hunter BeastI just tried to get you...

43:25Vlad CosteaI would not trust the Federation. First of all, secondly, it just has confidential transactions, which means you can hide the amount. You cannot hide the sender and the receiver. You only hide the amount and that's already enough information. Okay.

43:41Hunter BeastFair enough.

43:44I tried that's, that's one try. I'll, I'll try to get you, I'll try to get you by Bitcoin some other ways too. Let's see. There's a, so you don't, you don't like Federation coins. We need to activate drivechains and then deploy quantum-resistant sidechains or, privacy coins, you know, like just that are based on, that are pegged to Bitcoin. Right. Like, like that would be good too. You know, like, I don't know what you call it.

44:17Like basically like one thing I don't like about pretty much most private privacy coins, by the way, is because that they aren't quantum-resistant. So they look to me like a harvest now, decrypt later system. And so, like that's something they'll need to fix. One way to fix that was STARKs. RGB uses, RGB 12 uses STARKs now, which is amazing. And so, yeah, that would be like, cause they replaced Bulletproofs and Pedersen commitments, which are both not quantum-resistant.

44:50Those they both require elliptic curve cryptography in order to work instead. We have, like ZK-STARKs. And I think that's, that's a perfectly fine, like compromise. And if we had like currencies based in that, like if you put Bitcoin into that might be useful or good, especially if you compare that with Prime, right? Like an alternative layer one that Dr. Orlovsky is working on. Yeah. You know, it's, there might be hope there for Bitcoin. So, for confidentiality and quantum resistance.

45:33And so, or not confidentiality, privacy. So, I think

45:39Vlad CosteaThe zSide sidechain or the drivechain that gets enabled with BIP 300 is much more interesting because you get Zcash level privacy with BTC. I mean, that's something that I want to see or ZKCoins by, was it Robin Linus? I think it was him. That's also something that's interesting to me or Shielded CSV, which is by Robin Linus and Jonas Nick. And, I know his face. I just don't remember his name. He looks like Andrew Poelstra's little brother.

46:21No, I'm going to get killed here. He was on my podcast too, two times and I forget his name. I got to look up Shielded CSV and I'll let you know. Yeah.

46:34Hunter BeastSorry. Can't help you.

46:38Yeah, like with Shielded CSV, it seemed interesting, but the, like, one thing I, it just kind of reminded me of was just that like RGB was, is CSV also. So like, and RGB doesn't require any changes to Bitcoin.

47:03Vlad CosteaSo, Liam Eagen, Liam Eagen. Okay. That's the name. Very smart guy. He also made Bulletproofs++ and a bunch of other stuff that's being used in Monero right now. Nice. He's an actual cryptographer and works at Alpen Labs.

47:26Hunter BeastOh yeah. Very cool. Oh yeah. Oh, I met that guy. I've met that guy. We've had some conversations. Yeah. Yeah. Very bright. Yeah. Very smart guy.

47:39Vlad CosteaYeah. So I'm bullish on these inventions, not too bullish on using 2014 level privacy technology on top of Bitcoin where the sender and the receiver are public still. And you can see, even if you make a confidential transaction out of a UTXO that is public, you can still make some guesses afterwards. Like you get this initial black box. It would be very interesting if Liquid had active coinjoins. I mean, that would make it almost Monero level, but it doesn't have the scale of Monero and it doesn't have the users to actually care about this.

48:20Yeah.

48:21Hunter BeastI mean, Monero doesn't also doesn't really have a lot of scale either. If you think about it.

48:30Vlad CosteaThey have the dynamic block size right now. So you can argue that it's not really scaling. It's bloating, getting bigger all the time, but they're fine with this. Yeah, it works. I think short term, it's reasonable. I think Zcash is so much better. It's like a rocket ship, like state of the art cryptography.

48:52Hunter BeastExcept it uses zk-SNARKs.

48:55Vlad CosteaYeah, but have you read the Tachyon paper? I think that's going to come to fruition in a couple of years.

49:02Hunter BeastTachyon? No, I haven't. What is that about?

49:04Vlad CosteaBasically scaling zk-SNARKs to billions of users.

49:10Hunter BeastBut what about quantum resistance?

49:13Vlad CosteaWell, I don't know about that. I guess they're gonna be adding it. Hopefully, hopefully they do that. I mean, yeah, I care about pristine, actually functional privacy that is rooted in math and not just computation. You don't just expect the hardware to get better all the time. You make it more efficient. I love that.

49:37Hunter BeastYeah, that's really cool. It's just like, if it's not quantum resistant, it doesn't fit my threat model. I don't know why you're discounting quantum resistance. Do you not buy the actual concerns that are being raised by US cryptography authorities?

50:00Vlad CosteaWell, I don't trust the US government, if that's what your question is, but I do think it's a threat. I don't know when it becomes a practical threat.

50:10Hunter BeastI'm not asking you to trust the US government, but what I would invite you to think about is the government is warning people who protect government secrets. They're warning everybody, right? It's not just a warning that's specific to Bitcoiners. They're warning banks, they're warning universities, they're warning anything that keeps valuable, highly sensitive data. And in the very least, they want to protect the US consumer against foreign attackers.

50:55Think about the incentives there. It's not just saying, the US government isn't saying anything about Bitcoin. They're saying that quantum computers are a threat to elliptic curve cryptography, which Bitcoin happens to use. And not just Bitcoin, but all these things we've just been talking about, like Zcash and Monero and all these Bulletproofs, all that stuff is like, if elliptic curve cryptography is broken, you get inflation bugs in all those other systems, and so it's really bad. And so, especially the Mimblewimble coins, those are not in a good spot unless they adopt maybe some kind of ZK range proof or something.

51:43But regardless, I totally get there's every reason to distrust the US government. They've done some really bad stuff in the past, and they will continue to do so. And they somehow have stumbled into a way to break Bitcoin, because they can't help themselves to do a bunch of really bad stuff. And so it's almost like, in a way, I would like to think that because you shouldn't trust the US government, you should upgrade Bitcoin and heed their warnings that they accidentally fucked up, and they made something really terrible.

52:34We had the Manhattan Project, it's 1945, they have a bomb, and they're like, they have this bomb now. And I don't know if they, I'm not a history buff, so I don't know if they actually warned Japan before they dropped the bomb, I don't think they did. But regardless, this would be the warning before you drop the bomb, right? And of course, I'm not saying that the US government is going to attack Bitcoin, but they could fund an attack on Bitcoin. They could, right? They could attack Bitcoin.

53:09And that's the other thing, if you're really worried about the US government, they're warning you that elliptic curve cryptography is broken, and they have basically every capability to attack Bitcoin. We should upgrade Bitcoin, we should do something, I don't know, I keep coming back to that.

53:31Feel free to push back on that, or maybe make me, I don't know, maybe think about that more, but I keep coming back to the fact that we need to upgrade Bitcoin to solve for its quantum resistance, because the US government is very much warning everybody that elliptic curve cryptography will be broken soon.

54:02Vlad CosteaWell, I would frame this differently, because it's not the US government that is building, or not the only builder of this quantum computer, it's also China. So it might as well be the Chinese government, or it could be Google or IBM. Looking at the stats right now, I think the most powerful quantum computer is the one that's built by IBM, which is called the Condor, and it has 1,121 qubits. I think it takes like 100 times more to break Bitcoin. But assuming that the progress is gonna happen at the same rate, we have like 10 years or less.

54:42Hunter BeastYeah, so that's plenty of time to upgrade Bitcoin, right? We just got to do it. I'm not saying we rush or anything, it would be nice to have solutions prepared ahead of time, just in case we're caught by surprise, but I'm not saying we rush or change like this. It's a big change, we need to think about it thoroughly, and maybe we'll even come up with something better along the way, before we activate it, right? And so just think, okay, maybe we should use that change instead, and that'll be better, and it'll scale Bitcoin.

55:25And by that, I mean by BitZip, right? BitZip would be a perfectly fine way to solve for post-quantum cryptography and scale Bitcoin, and solve all the problems all in one software. It's just not anywhere ready yet. Maybe within five to 10 years, we'll be much more closer to readiness with BitZip. And as a result, that would be how we solve for scalability and quantum resistance. But before we do that, we can use things like RGB, we could, like RGB technically would, RGB with Prime would technically give us the same, like really maybe not the same, but similar, like very similar, maybe even better than BitZip.

56:11But BitZip would be pretty familiar. That said, yeah, I'm very supportive of Prime and any experimentation work on that. And open invitation to Dr. Orlovsky to talk about post-quantum cryptography, if he ever wants to implement that in anything he's working on.

56:29Vlad CosteaYeah, I got a fact check myself. So right now, I mentioned that the IBM quantum computer is at 1100 qubits. And in order to break ECDSA, or 2048 bit RSA, you need about 20 million qubits. So it's not 100 times more. It's 20,000 times more.

56:58Hunter BeastI don't know about that. Like, for one, I've heard estimates, so like the way I would process parts of that is you need about 3,000 logical qubits, 3,000 logical qubits to break elliptic curve cryptography using the most advanced implementations of Shor's algorithm that I've seen, like somewhere between two and 3,000.

57:36And then you need to factor in quantum error correction codes, which could be hundreds, could be thousands, may even be less. It could be as low as 49. That was one innovation that Google's Willow project came in with was like, no, maybe we only need 49 physical qubits to a logical qubit. And so it's possible that it may require only 50 times 3,000, which is 150,000 qubits. So I think like in the six to seven figures range would be like a safe bet for when to be really worried about like logical or physical qubits and elliptic curve cryptography being broken.

58:38Vlad CosteaYeah. Anyway, assuming Moore's law, which says that the computing power doubles every four years or something. Two years. Every two years. It's going to take a while assuming that this is true, but I think so far quantum computers have exceeded Moore's law.

58:58Hunter BeastIt's possible. I mean, like it's very early time in quantum computing development, like still we're, we're, we're talking about like vacuum tube level stuff. We don't really know how to do them all yet. It's all just like experimentation and stuff, but I mean, you know, what else was an experiment, the Trinity bomb, you know, you know, the one they set off here in the U.S. Before they dropped the bomb in Japan.

59:34Vlad CosteaYeah, I'm not denying this. I'm just saying that maybe it will take a while, but I got to plug a couple more ads. And then I'll ask you why you chose the number 360 for the BIP, because I don't think there is a 359 or whatever. There are a lot of numbers in between. It seems all very arbitrary. There's also BIP 420, if I'm not mistaken, or whatever. But I got to tell you about Citrea, which is a ZK roll-up, the first optimistically verified ZK roll-up on Bitcoin. They're going to launch later this year.

1:00:10They have been waiting for CTV or whatever, but they were able to figure out a way to do it without it, just like the Ark people. And basically what they're going to do is bring a suite of financial applications that currently are not available on Bitcoin. Like basically borrowing your BTC to get some stablecoins. Lending, not borrowing. Lending your BTC to get some stablecoins. Or having other more advanced financial applications that today you only find on Ethereum. And I think the long-term game for Citrea, and also Alpen Labs, is to get some of that liquidity that's currently locked on Ethereum as wrapped Bitcoin.

1:00:54And make it work for the same use cases with the security of the Bitcoin blockchain. So if you want to test Citrea today, there's their website, which is citrea.xyz. And you can download the software to see what it's going to look like. Right now I think it's on testnet4 for Bitcoin. And also the other sponsor that I got to plug is Edge Wallet, which I find very convenient when I'm traveling. It has the duress mode that you can use for typing a different PIN, which unlocks another wallet which maybe has zero funds or maybe has only $10 that you put in there.

1:01:37So if anyone ever asks you at the airport to unlock your wallet, that can come in handy. And also something else that I like is that when I'm at a conference and this actually happened to me, someone said, I want to give you Dash. And I was like, I don't have a Dash wallet. Well, I have Edge Wallet and I can generate a Dash wallet within seconds. And then I can swap that Dash into BTC within a couple of minutes maybe. So I think that's a very cool use case that they have.

1:02:07And you can download it at edge.app, which is edge.app. And now let's talk about the number 360 in your BIP. Does it refer to some sort of U-turn where you're doing something but you're facing the same direction?

1:02:24Hunter BeastWell, it certainly wasn't something I picked. You're not supposed to self-assign. BIP authors aren't supposed to self-assign numbers. Like Udi tried to do with BIP 420, which wound up actually being BIP 347.

1:02:42They've skipped a number of ranges. There's no BIP that starts with 200. They completely skipped the 200 range. That's because they were thinking about maybe adding Lightning BIPs there. And so they just kind of reserve that. There's a lot of reserved ranges. BIP 360 is like the reserved range for quantum stuff. So presumably there's like, there'll be a 361, 362 or whatever for whatever. But, you know, we'll see. We'll see how that shakes out.

1:03:15Vlad CosteaSo it was not your decision. Then who picked 360?

1:03:20Hunter BeastWell, there's like this elite cabal of BIP reviewers that meet in secret IRC chat rooms and they all just kind of make these unilateral decisions.

1:03:41Maybe if we're going with a communist analogy, it's like the BIP bureau, like the Politburo, but BIP bureau, you know? Maybe we'll call it that.

1:03:53Vlad CosteaRight, because I know that for a while it was Luke Dashjr who was in charge of the BIP process and assigning numbers and basically reviewing the BIPs. And it was also, of course, a bunch of other people, but it was him who was assigning numbers.

1:04:08Hunter BeastYep. And then we involved all these communists and now it's no longer Pope Dashjr that's doing it. And so we no longer have the Nazis in charge of the BIPs. They're instead, you know.

1:04:26Vlad CosteaI think Bryan Bishop is in charge right now.

1:04:29Hunter BeastYeah, Bryan Bishop is one of them. I haven't heard much from him actually in the review process. I don't know how active he is. The other reviewers are like Murch, Jon Atack, and Ava Chow are kind of the ones I've interacted with most.

1:04:53Vlad CosteaWhat was their reception of the BIP? Did they have anyone? Was there any feedback from the high priests, the popes, whatever you want to call them, the cabal?

1:05:06Hunter BeastYeah, well, Murch was very helpful. So is Jon Atack. They both have very helpful review. Ava also gave some review items that were tangible and useful. And then Ava also called it stupid and dumb.

1:05:26Vlad CosteaSo why would it be stupid and dumb? Because he doesn't or she doesn't believe in quantum computing or because the solution being presented is not the optimal one?

1:05:44Hunter BeastWell, I think if it doesn't really believe that there's a near term threat, and also if there was a near term threat, then this BIP is worded way incorrectly. It's just for what it does. We recently scoped it down. And so it's not necessarily a near term threat. It's more just everything that's needed to... Well, so it does address the near term threat, which is just to Taproot. But Taproot is only about 150,000 coins. And so, yeah, it's just, I mean, Ava's natural reaction to just about everything seems to be that.

1:06:41It's stupid, but that's just, it just seems to be the case. But her feedback was very useful regardless. I mean, it was harsh criticism, but we definitely are making decisions based on it. And we're always grateful for the attention and the review, of course.

1:07:09Vlad CosteaOkay. Where can people find the BIP to read it?

1:07:15Hunter BeastYou can go to bip360.org. Bip360.org.

1:07:23Vlad CosteaIs it any different than going to the GitHub on Bitcoin Core? Are there any other notes or opinions or justifications for the BIP on the website?

1:07:33Hunter BeastThere are. And also it is different because BIP 360 hasn't been merged yet. And so it's still in draft. And so there's still time to review, still time for people to chime in. I definitely recommend that people go out of their way to look it up and take a look at it and chime in on their opinion, but their informed opinion, hopefully. But no, all opinions are welcome, I suppose. And so, yeah.

1:08:11So because it's in draft, I pre-rendered it using some of the same software that bips.dev uses, which is a really great site, by the way, if you ever want to quickly look at BIPs. Bips.dev. And I basically forked the guy's work and then ran it over my own repo and then took the HTML from that and put it on to the site and with a little modification. So it's easy to read. It doesn't have all the tables fully rendered or anything either. There is a link to the actual Git repo that has my BIP in it.

1:08:55It's just not in the main Bitcoin BIPs repo yet because it hasn't been merged yet. It's still a pull request.

1:09:04Vlad CosteaSomething else that I have been meaning to ask you is we have a lot of proposals for Bitcoin soft forks like CTV, CAT, CSFS. There's also the Great Script Restoration. There are a bunch of others that have come and gone, like ANYPREVOUT. And anyway, my point is, do you think that any of these will make Bitcoin's quantum resistance better or improve on to what you're proposing with BIP 360?

1:09:39Hunter BeastWell, CTV is hash based, so there might be something there. What are some of the other options?

1:09:49Vlad CosteaIf I'm not mistaken, there were a bunch of researchers, including Jeremy Rubin and Andrew Poelstra, who have written articles about how you can build quantum resistance with OP_CAT.

1:10:02Hunter BeastYeah, yeah, that's that's that's another possibility. It's just the only problem is it doesn't allow you to reuse that address, right? Like you it's only a one time signature. And so if you well, I mean, you can reuse the address, you're just going to risk the funds in it, right? Because like you risk exposing your your private key. And so, okay, it's like, okay, I guess CSFS will need to be updated with post-quantum cryptography if it's ever implemented. I think that's that's a perfectly fine thing to do.

1:10:39But yeah, so there's, you know, any of those, like all of those have implications.

1:10:47Vlad CosteaI think a bunch of Bitcoiners are still butthurt because they were psy-oped into activating Taproot and they believe they're gonna have Monero level privacy and indestructible multisigs and Ethereum level smart contracts and whatever. And what they got is ordinal inscriptions. And I was gonna ask you, do you believe there's gonna be any side effects or unintended consequence to BIP 360?

1:11:16Hunter BeastWell, it's not much different from Taproot, except that it removes a feature that's already in it. So it's almost like, taking something we already have, and making it smaller and do less, which is in some ways why sipa is not too psyched about it. But you know, anyway, it's, it's not really adding anything new that people couldn't do already with Bitcoin. Like, it's just adding quantum resistance to long exposure attacks to Taproot type scripts. And so, like funds held in them. And so, there's no, there's, there's no chance that we're going to get something like some kind of surprise that will like, you know, oh, no, now we can't use elliptic curve cryptography with Taproot.

1:12:10So we can, I just don't know where you go with that, you know.

1:12:18Vlad CosteaIs this quantum resistance perishable, meaning that if quantum computers are going to become much more powerful in the coming years, we're gonna have to update again? Or is this final and definitive in the way that it upgrades Bitcoin?

1:12:38Hunter BeastWell, we're, we're, we're gonna need to add, like, BIP 360 doesn't even add post-quantum cryptography, right? Like it just gives us the capability to commit to that in wallets in a reasonable way, right? So like to be activated later. So, you know, we'll see if that's ever activated. But that's, that's like, it's, it's not, it's not definitive, no.

1:13:07Vlad CosteaRight. So after BIP 360, if that happens, we're gonna need to constantly have updates every maybe 10 years or something.

1:13:19Hunter BeastI think that might be smart. Yeah, it might be smart.

1:13:26Vlad CosteaYeah. But for that, basically, we're gonna need to build a culture around it, right? Because I think the ossifiers have done a pretty good job presenting their case. And most people are lazy. So if lazy people hear that we're fine, and we don't need anything else, and everything else is a scam and an attempt to destroy Bitcoin, an attack, they're gonna love it. So we do need, I think, honestly, and it hurts to say this, I think having a quantum attack on Bitcoin is gonna be the trigger for any improvement.

1:14:04That's what's gonna get people to say, well, we were wrong. And we need to fix this somehow. And I think the only way to fix past an actual attack is to hard fork and use something that we already have and has been in development for many years.

1:14:24Hunter BeastWell, that's definitely a thought that ETF custodians have been having in their fork choice clause, right? So like, if we fuck it up too much, and the custodians are going to then want to fork the chain because their bags are kind of worthless because of the quantum attack, then you know, like, that's something I would like to avoid, right? Like that in the way to avoid that is to be proactive and transfer your funds to quantum-resistant addresses. And, you know, but yeah, it's, yeah, that's, that's hopefully something we can avoid, but you, your pessimism might be warranted.

1:15:18I have no idea. I can't predict the future. Most I can do is just try to give us good solutions for any kind of problem that we might face in that regard.

1:15:29Vlad CosteaThere's also the risk of being the boy who cried wolf, right? You're making estimations and then people will not take you seriously anymore.

1:15:39Hunter BeastLook, you know, like Bitcoin isn't about you, right? Like it's, I'm not worried about like people thinking like 10 years on, you know, it hasn't happened yet. Where's, where's, why are we, why are we soft forking, Hunter? Like, you know what, fuck it. Like, I'm fine having job security for 10 years, you know, like that's great. You know, whatever, like, I'm fine with that.

1:16:09Vlad CosteaNo, there's always a risk in being too early with something.

1:16:15Hunter BeastYeah. Yeah. And, and as they say, you know, there's, there's an old adage that like being too early is the same as being wrong, but you know, we'll see. We'll see. I just think that it's, it's just too big, a, like too big a problem to ignore, you know, like, I think it's like, it would be foolish to ignore this, but it's the thing that's kept me up at night. It keeps a lot of Bitcoiners up at night. There's, we don't talk a lot enough about those Bitcoiners, right?

1:16:46The people who are like very grateful about the work that I'm doing, but regardless there's, you know, there's just like a loud contingent and community of ossifiers. And like the thing is like they're loud and like present, but there's also like a lot of smart people who don't talk about this that are actually in charge and they will probably make the right choice. If the time makes it like relevant, right? Like if it becomes obvious, if the right choice becomes obvious, I think the people, all the decision makers in Bitcoin and there are hundreds of thousands, it's not just like one big, you know, like whatever, but there's lots of individual decision makers that will probably just be like, okay, this is the, this is, it's about time.

1:17:40And like there'll be consensus formed amongst the people who actually matter, not plebs. And it's sorry to say this, but like plebs like literally do not matter. Like node runners, like there is like the UASF, but a UASF has never occurred. It's not like it's, it's just a threat. And so like, you know, like there's, there's a lot of threats, right? Like there's a lot of threats. And so yeah, anyway, I'm, I'm not, I'm not too worried about the plebs. I'm more worried about like, you know, like the mining Illuminati and the you know, the economic node runners, ETF people, you know, those are, those are the people that all like really kind of force the hand.

1:18:29Right.

1:18:32Vlad CosteaWhen we started the interview, you mentioned that you only have one hour 20 minutes. Is that hard cap still in place?

1:18:38Hunter BeastIt is.

1:18:39Vlad CosteaSo you have to go now?

1:18:41Hunter BeastI do.

1:18:42Vlad CosteaOh, no, I gotta tell the people the funny story about how we basically ended up doing this interview and also have two more sponsors to plug. So let me plug the sponsors. Then I tell the story. NoOnes.com is a peer-to-peer exchange that aims to empower the global south. It's a place where you can buy and sell gift cards using Bitcoin, Monero and a bunch of other coins, mostly stablecoins.

1:19:06And they also offer a spot exchange and a debit card if you want to spend your coins, check it out. Basically, if you're using this platform, you're giving liquidity to Africans and people from the Middle East, who are basically 90% of the users. And the CEO Ray Youssef is very adamant about trying to provide tools to the people who need them the most and not the ones who just speculate. So check it out. It's N-O-O-N-E-S.com. And last but not least, and I'm sorry that you guys are last, but Bitcoin.com has recently rebranded. They're orange now, and their news website is pretty good.

1:19:45I'm actually the one who reached out to them because I saw that they have a more diverse approach to news. The URL is news.bitcoin.com. And they have also news about gold, about silver, about Bitcoin adoption in countries that are not US. And I think it's pretty good. If you want to escape the Bitcoin Magazine bubble and want to find out more stuff that's happening around the world, I think Bitcoin.com News does a pretty good job. So check them out. And now let me tell the story about how this interview actually happened.

1:20:19It wasn't some conversation about quantum computing. I just tweeted after seeing some clips from the Hunter Biden interview that it would be fun to have Hunter Biden on my podcast. Because he seems to be the kind of guy who actually spent Bitcoin on fun stuff. And fun, I mean, by fun, I mean that it was fun for himself, possibly not the people who were also involved in his fun. But he seems very outspoken nowadays. And maybe he has some interesting stories to tell. And then you, Hunter Beast, replied and said, I would happily be the hunter who gets interviewed on your show.

1:20:58And I was like, yeah, I've actually been meaning to do this interview. I just didn't know how to approach you. So I'm happy that this happened.

1:21:06Hunter BeastI'm happy too. Yeah, that was great.

1:21:09Vlad CosteaFor the people who have been listening, you mentioned in the beginning, and I'm sorry I'm keeping you past the established time. You mentioned that there are some good practices that they can use to avoid being exposed to a quantum attack. And I think this is a good way to end this. What are some good ways you mentioned avoiding reusing addresses, but what else to basically put yourself in a better position?

1:21:35Hunter BeastYeah, so let's first define address reuse as, essentially, if you were to spend from a specific address, if you spend from that address, and then receive coins to it again, now those coins are vulnerable. So don't do that. Always use a new address whenever you receive new payments. And either that or make sure that the address that you are receiving to hasn't yet been spent from. And then you just consolidate all those UTXOs and spend them all at once, leaving none in the address where the public key is now exposed.

1:22:10There's also bc1q native SegWit addresses. Those are perfectly fine.

1:22:20Definitely don't expose your xpub to anybody. One addresses and three addresses are probably also fine, so long as you don't reuse them. And so yeah, just sticking with bc1q native SegWit addresses, those are great.

1:22:40If you're just doing everything a normal Bitcoiner should, like a diligent Bitcoiner who has a Foundation Passport or a Coldcard or whatever, then yeah, you should be good. You should be fine. It's just when you go into Taproot, when you go into like, just don't HODL in Taproot, don't HODL in reused addresses. And if things ever get really bad, you can take your transaction to a private mempool like MARA Slipstream, and that will allow you to bypass the public mempool. And so you'll get your transaction mined out of band or sort of like out of privately.

1:23:27And so then you can, you never expose your public key to potential attackers if you're moving a particularly large amount. That might be prudent to do in the future sometime, but it's always an option. So I would say yeah, HODL in bc1q, if you're using multisig, never reveal your xpub to anybody, like encrypt that, whatever, do something to protect it. And then, because your descriptor has your xpubs, just so you know. And so anyway, regardless, yeah, those are the suggestions.

1:24:06Vlad CosteaThank you very much, Hunter Beast. I'm sorry you have to go. It was partially my fault that we started this later. But I'm really grateful for the input that you have given. And I'm happy that we had this conversation about quantum computing, and I wish you all the best with BIP 360.

1:24:23Hunter BeastThank you very much. Take care now.