Zcash and Quantum Computers

Zcash’s protocol designers and cryptographers differ about how soon quantum computers will become a real threat, but we broadly agree that preparing for their potential impact on user privacy and security is crucial. This careful attitude has existed since the project's inception: we have always anticipated future cryptographic breakthroughs—quantum or otherwise—and worked to compartmentalize the parts of our protocol that rely on vulnerable assumptions. As an extreme example of our attention to detail, ZIP 212 identified and fixed an issue where a (possibly even non-quantum) adversary that could break zk-SNARK soundness would have had the ability to compromise privacy in a somewhat contrived situation. As mentioned in the ZIP, "we have attempted to avoid any instance in the protocol where privacy (even against interactive attacks) depended on strong cryptographic assumptions" and we have been cognizant of these threats throughout our project's history.

Thanks to this careful protocol design, Zcash’s shielded transactions already achieve post-quantum privacy in many common cases.¹ Notably, quantum adversaries cannot compromise on-chain anonymity whatsoever.² This advantage stems from Zcash’s use of zero-knowledge proofs, (perfectly) hiding commitment schemes, blinded signing keys, and strong symmetric primitives used in various parts of our cryptography. Despite this, we have never claimed to have post-quantum privacy because the contexts in which these guarantees hold are not intuitive to users. We would much rather wait until we have perfected the situation to avoid misleading our users.

As part of our ongoing work to scale Zcash with Project Tachyon, we plan to remove in-band secret distribution from Tachyon transactions to fully defend against all quantum attacks on privacy in on-chain transactions. This step is essential, because harvest now, decrypt later threats are perilous for blockchain protocols.

🔗Soundness

The remaining concern about quantum computers in our protocol’s shielded components arises from the potential vulnerability of elliptic curve cryptography. These cryptographic breakthroughs would put the soundness of our protocol in jeopardy, which would possibly allow counterfeiting or (somewhat equivalently) theft of user funds, though not necessarily pose a risk to user privacy. Our users are currently protected under the same cryptographic assumptions that almost every other cryptocurrency relies on.³

Although we must make every effort to improve the privacy guarantees of our protocol in the face of quantum adversaries, soundness breaks are less of a priority because of our ability to adapt and react to quantum developments.⁴ There is a huge opportunity cost for changing our protocol to fully defend against future quantum computers.⁵ In my view, there are many risks for our project's survival that are more imminent.⁶

However, we can minimize the tail risk. In other cryptocurrencies there is a burgeoning study of quantum robustness techniques that would allow funds to be immune to quantum adversaries (under plausible assumptions) if the community flipped a switch to replace or augment spending conditions with stricter post-quantum tests.⁷ Protocol designers at the Electric Coin Company have spent some time over the last year developing techniques in Zcash's shielded transactions (specifically, for Orchard) for what is referred to as quantum recoverability. After a change to the way wallets work, likely to be integrated over the next year, if quantum computers do suddenly appear then users can safely recover their funds through a special mechanism that prevents quantum adversaries from stealing funds. This mechanism would also protect user privacy.

There are other improvements in the pipeline. For one thing, the design of Tachyon inherits many of the philosophies that make this proposed recovery protocol possible. And a general purpose long-term storage protocol that allows users to fortify their (cold storage) funds is being considered for those who are concerned about quantum computers or bugs in our cryptography more generally. Finally, we've worked hard to ensure that our dependence on pre-quantum cryptographic assumptions is isolated to primitives that can be replaced with quantum-resistant technology in the future.

🔗Today's Best Practices

The best practice for protecting your shielded funds from a quantum apocalypse is to just shield your coins and await upcoming improvements to the software. Even after the aforementioned changes, the main soundness threat from quantum computers remains the ability for adversaries to counterfeit shielded coins, and while Zcash's cryptographers will stay ahead of developments to protect users, the final defense remains turnstiles.

---