Commit-Delay-Reveal (CDR) Protocol (Part 3)Commit-Delay-Reveal (CDR) Protocol (Part 3)
This is Part 3 of our visual series on quantum threats to Bitcoin and how we can defend against them.
📚 In case you missed the earlier posts:
🧠 The Threat: Quantum Computers🧠 The Threat: Quantum Computers
Quantum computers can break ECDSA.
Once your public key is exposed, your funds can be stolen.
🎯 The Goal🎯 The Goal
We want to move coins from vulnerable UTXOs (e.g., P2PKH) to a quantum-safe address without revealing the old key.
🛡️ The Solution: Commit-Delay-Reveal🛡️ The Solution: Commit-Delay-Reveal
A protocol with 3 phases:
Commit ➝ Delay ➝ Reveal
🧩 CDR Phases Overview🧩 CDR Phases Overview
Commit (C): You commit to your keys
Delay (D): You wait for a security window
Reveal (R): You prove ownership and migrate safely
🔶 1. Commit Phase🔶 1. Commit Phase
Bob creates a commitment of two keys:
pk: old (ECDSA)pkQR: new (quantum-safe)
➡️ H(pk || pkQR)
Bob includes this hash in a transaction T_commit using OP_RETURN.
This hides the keys, while anchoring the commitment on-chain.
🟡 2. Delay Phase🟡 2. Delay Phase
Bob waits a period t_sec without touching the UTXO.
This pause prevents attackers from reorg-ing the chain.
⏳ Suggested delay: 6 months
Makes even quantum-powered reorgs too costly.
🟢 3. Reveal Phase🟢 3. Reveal Phase
After the delay, Bob creates T_reveal to move the funds using his quantum-safe key skQR.
T_reveal must include:
pk— old keypkQR— new keyH(pk || pkQR)— prove it was inT_commit- Signature with
skQR
🧾 Detailed Breakdown🧾 Detailed Breakdown
✅ Step 1: Reveal Old Key✅ Step 1: Reveal Old Key
This proves you control the originally locked UTXO.
✅ Step 2: Reveal New Key✅ Step 2: Reveal New Key
This is your quantum-resistant key.
✅ Step 3: Prove the Commitment✅ Step 3: Prove the Commitment
Show that H(pk || pkQR) was committed earlier in T_commit.
✅ Step 4: Sign with Quantum Key✅ Step 4: Sign with Quantum Key
Only someone with the secret key of pkQR can authorize the spend.
🎯 Final Result🎯 Final Result
The network is convinced:
The person who controls pkQR also controlled pk.
The migration is secure.
🚨 Limitation🚨 Limitation
To begin the process, users need access to some quantum-safe UTXOs.
✅ Solution✅ Solution
FawkesCoin protocol solves this by helping bootstrap quantum-safe UTXOs.
👀 Next Post👀 Next Post
We'll dive deeper into FawkesCoin next.
🤖 Follow for more🤖 Follow for more
Follow @Bitcoin_Devs for more visual explainers on Bitcoin's quantum future.
One question I have about CDR is how we would distinguish between a quantum vulnerable address whose public key is still hidden and those addresses with public keys that have been revealed?
Could an attacker who knows your public key "race" you to get their commitment tx in a block, commuting your coins to their QR address?
Perhaps we say p2pk and p2tr are not eligible for CDR, but what about reused addresses or leaked xpubs? How do we know the CDR commitment transaction is actually being made by the true owner of the coins rather than someone who managed to gain access to their pubkey?
Wouldn't this kind of turn public keys into private keys? (I feel like I must be getting something wrong here).
May this be fruitful!