Revisiting secp256r1 signatures (i.e. P256, mobile HSM support)

The discussion opens with an analysis of the feasibility and timing concerns associated with integrating a new signature algorithm, specifically P256, into the Bitcoin protocol. The process of achieving community consensus, developing a high-quality implementation comparable to libsecp256k1, and executing a soft fork is highlighted as a multi-year endeavor. This timeline is juxtaposed against ongoing developments in the field, including BIP360 and discussions around post-quantum cryptographic solutions, suggesting that by the time P256 could be implemented, the focus within the Bitcoin community may have already shifted towards these newer technologies. There's an implicit suggestion that the advent of quantum computing may render such efforts obsolete if it arrives sooner than anticipated.

The correspondence then shifts focus to the WebAuthn standard, questioning its compatibility with future Bitcoin cryptographic needs, particularly in the context of hardware security modules (HSMs) and post-quantum security. It suggests that exploring how WebAuthn's signature formats could be made compatible with Bitcoin's evolving post-quantum standards might be a more productive avenue for ensuring long-term security and utility.

Finally, the email raises concerns about the practicality of integrating WebAuthn with Bitcoin's unique requirements for user autonomy and security. It points out the potential limitations of WebAuthn in supporting key Bitcoin features, such as deterministic backup seeds for user recovery, compatibility with hierarchical deterministic wallets like BIP32, and the management of multiple addresses. These issues underscore the challenges of adapting WebAuthn, primarily designed for centralized web authentication, to decentralized systems like Bitcoin that prioritize user control and resilience against loss.