A Post-Quantum Path for BIP 324

Jonas Schnelli has provided insights regarding the integration of TLS 1.3 with Bitcoin's BIP 324, highlighting several technical and strategic considerations. Initially, he notes that Bitcoin Core, along with other implementations like btcd, generally prefers to maintain minimal dependencies, historically exemplified by the removal of OpenSSL. This preference suggests potential resistance to adopting comprehensive protocols such as TLS 1.3 due to their complexity.

In the cryptographic realm, BIP 324 employs secp256k1, whereas TLS 1.3 does not support this within its cipher suites, posing a compatibility issue. Moreover, BIP 324 emphasizes the use of an oblivious Key Encapsulation Mechanism (KEM), which is absent in TLS 1.3. This discrepancy underscores a fundamental mismatch between the objectives of BIP 324 and the functionalities offered by TLS 1.3.

Additionally, there's an ongoing effort within the IETF to introduce a hybrid Post-Quantum KEM to TLS 1.3, detailed in the draft IETF TLS ECDHE MLKEM. However, this proposal only supports specific elliptic curves, which do not include secp256k1. Another point of divergence is the introduction of certificates in TLS 1.3, which would complicate BIP 324’s current mechanism that solely provides confidentiality without authentication.

For those interested in understanding why BIP 324 opts for a specialized approach rather than a general-purpose transport encryption protocol, further details are available in the rationale section of the BIP documentation, accessible here. This explanation provides clarity on the specific choices made in the design and implementation of BIP 324 relative to broader, more generic encryption strategies.