Post Quantum Signatures and Scaling Bitcoin

A bitcoin-dev mailing list post by Ethan Heilman (a BIP-360 co-author) confronting the central practical drawback of post-quantum signatures: they are large. The smallest scheme then proposed for BIP-360 needs roughly 1.5 kB for a public key plus signature, which would either shrink bitcoin's transaction capacity or, if given a fee discount, risk making the chain cheaper to use for arbitrary data storage than for payments.

Heilman's proposed way out is non-interactive transaction compression: a miner would strip the post-quantum signatures out of every transaction in a block and replace them all with a single STARK proof (a kind of zero-knowledge proof that is itself believed quantum-resistant) attesting that all the removed signatures were valid. His back-of-the-envelope math suggests a simple payment could then take ~76 bytes on-chain — smaller than today's Schnorr transactions — turning the post-quantum migration from a capacity loss into a potential scaling gain.

Replies (including from Pieter Wuille, Matt Corallo, and StarkWare's Eli Ben-Sasson) probe the practical costs: proving time and hardware could advantage large miners, mempool relay still has to carry the uncompressed transactions, and the approach adds a heavyweight new cryptographic dependency to consensus. The thread frames a research direction rather than a concrete proposal.