Satoshi Nakamoto Predicted Bitcoin’s Hash Defense 16 Years Before Quantum Fears

A Forum Post That Set the Rules

On July 16, 2010, a idiosyncratic named bdonlan questioned Bitcoin’s treble SHA-256 hashing connected the Bitcointalk forum. He asked whether the plan weakened security.

Satoshi answered directly. Bitcoin’s inventor compared SHA-256 to the leap from 32-bit to 64-bit computing, not a tiny measurement up successful spot length. Computers ran retired of 32-bit code abstraction astatine 4 gigabytes, helium said, but cipher expects to tally retired of 64-bit abstraction anytime soon. SHA-256 works the aforesaid way, and the mathematics gives Bitcoin country to spare.

Satoshi besides gave the web an exit plan. If SHA-256 ever weakened, developers could brushed fork to a caller hash relation astatine a acceptable artifact height. Old and caller hashes would tally broadside by broadside until each node upgraded.

Bitcoin’s marketplace capitalization has since grown past a trillion, and the web settles hundreds of billions of dollars successful worth daily. Every dollar of that enactment inactive depends connected the hash relation Satoshi defended successful a azygous forum reply sixteen years ago.

Why Bitcoin Runs Two Hashes Instead of One

Bitcoin’s codification hashes information twice: SHA256(SHA256(data)), a method developers telephone SHA256d. Cryptographers Niels Ferguson and Bruce Schneier recommended the attack to artifact magnitude hold attacks, a flaw successful the Merkle-Damgard operation SHA-2 uses.

Miners hash artifact headers doubly to conscionable the network’s trouble target, and nodes hash transactions doubly to physique Merkle trees. Wallets adhd a 3rd layer, RIPEMD-160 implicit SHA-256, to shorten nationalist keys into addresses.

Satoshi picked SHA-256 for a reason. The National Institute of Standards and Technology published the algorithm successful 2001 arsenic portion of the SHA-2 family, offering a ample leap successful spot implicit SHA-1, which already showed cracks by the clip Bitcoin launched successful January 2009. SHA-256 needs astir 2^128 operations to unit a collision and astir 2^256 to unit a preimage.

Sixteen years later, and nary 1 has cracked this design. No researcher has recovered a moving collision, preimage, oregon 2nd preimage onslaught against afloat SHA-256. Reduced-round versions person fallen to cryptanalysis, but those attacks halt scaling earlier they scope the existent 64-round algorithm. NIST and autarkic groups specified arsenic ECRYPT-CSA proceed to complaint the afloat relation arsenic secure.

Mining hardware tells the aforesaid story. Application-specific integrated circuit (ASIC) makers person built full merchandise lines astir SHA-256d, and web hashrate present runs successful the exahash range. Satoshi predicted Moore’s Law unsocial would ne'er endanger the function, and trouble adjustments person kept artifact times adjacent 10 minutes contempt exponential gains successful mining power.

Quantum Computing Changes the Conversation

Classical brute unit ne'er disquieted Satoshi, and it inactive doesn’t endanger Bitcoin. Quantum computing splits the hazard into 2 abstracted problems.

Grover’s algorithm speeds up brute-force search. Run against SHA-256, it cuts effectual information from 256 bits to astir 128 bits, a fig that inactive sits acold retired of reach. Researchers accidental an attacker would request quantum hardware connected a standard the satellite has not built, truthful things stay harmless for now.

Shor’s algorithm poses the bigger problem, and it targets signatures, not hashes. A quantum machine moving it could propulsion a private key from an exposed nationalist cardinal connected the elliptic curve Bitcoin uses. An estimated 7 cardinal bitcoin, adjacent to 35% of supply, beryllium successful addresses with exposed nationalist keys and would transportation hazard if that hardware existed.

Google Quantum AI published probe successful 2026 that lowered the qubit number needed to interruption Bitcoin’s curve to astir 500,000 carnal qubits. Current quantum machines tally successful the scope of 1,000 to 1,500 qubits. Researchers inactive peg a moving menace determination betwixt 2029 and 2035, depending connected advancement successful mistake correction.

Developers Revisit the Question Over Sixteen Years

Satoshi returned to hash-related concerns much than erstwhile during 2010, including what would hap if SHA-256 suffered a partial collision. His reply stayed consistent: fastener successful the honorable concatenation earlier occupation spreads, past migrate to a caller function.

Later Bitcoin upgrades near halfway hashing untouched. Segregated Witness was activated successful 2017, and Taproot activated successful 2021, some aimed astatine ratio and privateness alternatively than hashing. Quantum absorption did not go a front-burner taxable for developers until consciousness of Grover’s and Shor’s algorithms dispersed done the cryptography assemblage successful the 2020s.

Developers Propose Exit Ramps Satoshi Promised

Bitcoin developers person already projected the migration way Satoshi described successful 2010, conscionable aimed astatine signatures alternatively of hashes. Several ideas person been brought to the table.

BIP-360 introduces a caller code format, pay-to-Merkle-root addresses starting with bc1z, built astir quantum-resistant signature schemes. Developers merged the connection successful 2026. A companion proposal, BIP-361, lays retired however the web could yet sunset older, exposed code types. With the second method a spot much controversial.

Wallet providers present look unit to halt code reuse and steer users toward the newer output types earlier immoderate quantum deadline arrives.

Migration carries its ain obstacles. Developers inactive request a program for coins locked successful aged addresses whose owners are inactive oregon unreachable, including immoderate bitcoin tied to Satoshi’s ain aboriginal wallets. Post-quantum signatures besides instrumentality up much artifact abstraction than the signatures Bitcoin uses today, and researchers are investigating hash-based signature schemes to support that migration manageable.

What This Means for Bitcoin Holders

Nothing astir SHA-256 requires enactment today. The hash relation that secures mining and transaction past remains untouched by immoderate known attack, classical oregon quantum.

Signature vulnerability is the point worthy watching. Holders with coins successful old-style addresses, oregon anyone who has reused a Bitcoin address, transportation much vulnerability than idiosyncratic utilizing modern output types with nationalist keys that enactment hidden until spending.

Satoshi closed the 2010 thread with a informing that inactive reads arsenic existent policy. Any onslaught beardown capable to interruption SHA-256 would apt harm stronger cousins similar SHA-512 too, truthful a afloat interruption looks improbable connected its own. Bitcoin’s defence was ne'er permanence. It was the quality to determination earlier a menace becomes real.