Public key recovery for EC leaves in P2MR (BIP-360)

The current cryptocurrency ecosystem heavily relies on the sharing of extended public keys (xpubs) and public keys, which underpin numerous functionalities such as multisignature setups, escrow services, watch-only wallets based on descriptors, and wallet indexing services. However, this foundational aspect presents significant vulnerabilities in the face of quantum computing threats, particularly as we approach what is referred to as Q-day, when quantum computers will be capable of breaking elliptic curve cryptography.

To address these vulnerabilities, alternative cryptographic methods are being considered to ensure security post-Q-day. For instance, non-interactive elliptic curve multisignature scripts that utilize a hash of a public key instead of the bare key itself could be implemented. This approach would adapt the traditional Pay to Public Key Hash (P2PKH) used in Bitcoin to support multiple signers without the need to share actual public keys before transaction execution. Such adaptations are crucial as they prevent potential security breaches from quantum-enabled adversaries.

Despite these innovations, some protocols like MuSig2, which necessitates the sharing of individual public keys among participants, pose greater challenges. Trust issues arise, especially considering the potential association of cosigners with quantum-capable attackers. The ongoing development of isogeny-based cryptographic schemes promises a future where current standards such as BIP32 could be replaced entirely, fostering a transition to more secure alternatives that do not require sharing extended keys, thus mitigating risks of theft in a quantum computing era.

In the near term, the community faces the task of designing and implementing cryptographic standards that discourage the sharing of sensitive information, aligning with security practices that anticipate and thwart quantum threats. This includes potentially disabling elliptic curve-based transactions post-Q-day if alternative safeguards like isogeny schemes or new lattice-based cryptography methods become viable and reliable.