BIP draft: CISA for Taproot Key Path Spends

The email from Fabian discusses several key points regarding the integration and potential adaptation of Post-Quantum (PQ) cryptographic schemes into existing Bitcoin Improvement Proposals (BIPs). Fabian admits a lack of deep study in PQ scenarios but expresses a willingness to invest more time now that the proposal has been published. He addresses specific technical aspects such as the transaction-level structure which he believes should generalize across different schemes. This includes markers, mode commitment in the signature message, group formation, and the handling of aggregate final inputs. However, he also notes that new witness versions and output types would be necessary for full implementation in a PQ scenario.

Fabian evaluates the trade-offs involved in aggregation and public key visibility. He mentions that hiding public keys to facilitate verification under certain conditions incurs a data cost, which could negate some benefits of aggregation. The proposal aligns with the taproot security model, optimizing for maximum savings by utilizing bare keys. Furthermore, he speculates on the possibility of implementing a hash-hidden variant within the same framework, suggesting it could be defined as a new output type if favored by the ecosystem.

The discussion also touches on strategic considerations related to the potential arrival of Cryptographically Relevant Quantum Computers (CRQCs). Fabian highlights the network's need to reach a consensus on the timeline and impact of PQ schemes, anticipating a significant demand for transaction consolidation and CoinJoins in response to these developments. He suggests that the availability of a Crypto-ISA (CISA) could provide beneficial effects, albeit temporarily, contingent upon the migration of coins by that time. For further details on his responses to specific inline comments, see his answer on GitHub: discussion_r3609171527.