Algorithm Agility for Bitcoin to maintain security in the face of quantum and classic breaks in the signature algorithms

In the recent discussions on the Bitcoin Development Mailing List, there was an exchange concerning the implementation of new signature schemes as a step towards enhancing Bitcoin's transaction verification process. Matt Corallo highlighted the debate between selecting SLH-DSA or ML-DSA for immediate use is less critical than most believe. The focus should rather be on adopting an interim solution that is acceptable to all parties involved until a more refined signature system, such as SQIsign, becomes broadly available and optimized. SQIsign, despite being in its early stages, shows promise with its compact signature size (65 + 148 bytes) and the capability of a non-optimized reference implementation running on dated hardware (a DDR3 era Haswell PC from 2014) to verify 1000 signatures per second. In contrast, a modern budget CPU could enhance this performance up to 30,000 verifications per second. More information on SQIsign can be found at SQIsign.

The discussion further critiques the notion of bypassing intermediate solutions like SLH-DSA in favor of directly implementing zero-knowledge proof systems for transaction verification. Critics of immediate migration to zero-knowledge proofs argue that such a move would necessitate a complete halt of the Bitcoin network, greatly diminishing efficiency and practicality compared to a more gradual transition approach. SLH-DSA is defended as not only a viable stopgap but also an efficient means to ensure the network's seamless operation during the transition period to a superior signature scheme. This perspective underscores the importance of pragmatic steps in network upgrades, prioritizing continuity and efficiency over the rush towards implementing theoretically perfect but practically challenging solutions.