Aligning privacy incentives in P2MR

The recent discussions on the Bitcoin Development Mailing List have delved into the complexities of preparing Bitcoin for potential quantum computing threats, specifically focusing on designing secure post-quantum (PQ) cryptographic protocols. The primary concern revolves around the unpredictable nature of "Q-day," the hypothetical future point when quantum computers could break existing cryptographic defenses. This unpredictability challenges the community's ability to timely transition to quantum-resistant cryptographic methods such as those involving PQ signatures.

One proposed solution is to transition to use P2MR, a new output type that supports only PQ signatures. The argument in favor of P2MR over the alternative P2TRv2 is predicated on its flexibility regarding the timing of disabling elliptic curve (EC) cryptography, which is vulnerable to quantum attacks. If EC were disabled too early before Q-day, there would be a significant period during which users might revert to using less secure, classical wallet types due to various reasons such as incomplete migration to PQ cryptography or disbelief in the imminent threat of quantum computing. This reversion could expose users to risks if quantum capabilities advance unexpectedly. Conversely, disabling EC too late would leave all users vulnerable from the moment a capable quantum computer comes online. Hence, P2MR is seen as providing a safer buffer by being effective even if the EC-disable fork happens slightly after Q-day.

Additionally, there are concerns about the practical aspects of coordinating such a significant shift across the decentralized Bitcoin network, fraught with misinformation and divergent opinions. The ideal scenario would involve a seamless and well-timed transition dictated not by centralized decision-making but through a decentralized consensus, which adds another layer of complexity to the issue.

To further complicate matters, the notion of using smaller 'canary' curves as an early warning system against quantum breakthroughs was critiqued. Current understanding suggests that these smaller curves might not offer reliable security against quantum attacks because they could be susceptible to classical attacks, thus giving false positives and leading to premature or unnecessary reactions.

Overall, the discourse underscores the need for a robust, quantum-resistant framework that accommodates the unpredictable timeline of quantum advancements while ensuring the security and integrity of Bitcoin transactions. The continuous development and discussion within the community aim to steer these efforts toward a consensus on how best to protect the cryptocurrency against future quantum threats.