The hash is not the box. The signature is. Treating them as one weakens the argument either way.

Hash closes the box, signature opens it: why the line still holds

Updated 17 October 2026

That is the distinction between hash and signature. It is not a debate about whether SHA 256 is also 'broken'.

Two roles, one box

Bitcoin's UTXO model relies on two cryptographic primitives that look like one job from the outside. SHA 256 commits. Secp256k1 over the SEC family of elliptic curves authorises. Conflating them is how bad predictions enter the discourse, and how confident dismissals are then met with a panic that does not match the structure of the system. The model on this site has always been the box and the key. A box is closed by a hash. A box is opened by a signature produced by a private key. Those are two different jobs, and the quantum threat targets them on different timescales.

Hashing shows up in four places that matter to the box. The script and redeem bytes are committed to through HASH160, which is RIPEMD 160 of SHA 256, and the address is the base58 or bech32 representation of those bytes. The block header commits to the transactions through a merkle root of double SHA 256 hashes. The mining work itself is a search for a nonce whose double SHA 256 of the header sits below a target. Finally, taproot tweaked outputs (P2TR) commit to a script through tagged SHA 256, not HASH160. All of these uses rely on preimage and collision properties of SHA 256 and on the preimage property of RIPEMD 160 inside HASH160.

Signatures show up at the moment of opening. A P2PKH output asks for an ECDSA signature against the hash of the transaction. A P2WPKH output asks for the same, with the witness commitment pinned in a different field. A P2TR output offers two spending paths. The key path asks for a Schnorr signature against a tweaked private key. The script path asks for the script, the witness, and the script spend signatures. All of these signatures live on the secp256k1 curve, and that is where Shor's algorithm on a sufficiently large quantum computer does its work.

What a quantum computer actually does to each

Grover's algorithm is the threat to symmetric primitives. It squares the cost of unstructured search, which means an n bit preimage search drops from 2 to the n operations to about 2 to the n over 2. The constant factors and the cost of building the oracle are the reason why this is not a four bit reduction in the way that Shor is a complete break for the discrete log problem. For SHA 256 with a 256 bit output, the post Grover security sits at roughly 128 bits of effective classical cost, and the published estimates for quantum ASICs that would attempt such a search in 2026 are still well above the global hashrate in wall time, energy, and gate count. A single SHA 256 invocation is cheap. A preimage attack requires many of them, and the oracles are not free in a quantum circuit. Mining centralisation, not a quantum break, is the operative risk to the block header commitment and to the merkle root.

Shor's algorithm is the threat to asymmetric primitives. A quantum computer with around 2 to the n cubed logical qubits, where n is the bit length of the order of the group, breaks the discrete log on secp256k1 in polynomial time. The engineering question is not whether the mathematics is right. It is whether the physical machine exists, with the gate fidelity, the connectivity, and the runtime, to attack a 256 bit curve in any useful window. The runway tracker on this site, in its earlier incarnation and the more recent update past nine billion, tracks the gap between that engineering milestone and the value exposed on chain. As of October 2026 the threshold has not been crossed and the runway is still positive, even after the revaluation in the tier 1 reset.

What this means for the box is asymmetric. The hash is not the weakest link. The signature is. Quantum resistance work in Bitcoin, including the BIP 360 proposal and the QSB design without a fork, focuses on introducing a new signature primitive, a new output type, and a freeze window for legacy outputs. None of them propose to retire SHA 256. The reason is that the lock and the seal, the merkle root and the proof of work commitment, do not lose their security under the threat model that the rest of the post is built on.

Why this matters for the freeze window

The freeze window in BIP 360 is calibrated against the signature break, not the hash break. The proposal sets a clock on legacy outputs, and that clock must end before the engineering milestone for Shor on secp256k1. A premature freeze, set against a hash break that is not coming, would inconvenience holders with no compensating security gain. A delayed freeze, set against a signature break that is closer than the engineering surveys suggest, would leave boxes open to a fast rederivation attack on the public key the moment it appears on chain.

That is why the NIST rounds out the signature finalists work is the relevant benchmark for the clock, and not the quantum hashing benchmarks. The relevant figure is the ML DSA parameter set, the SLH DSA parameter set, and the Falcon compact variant that survived the third round. The signature size, the verification time, and the aggregation story all enter the freeze window because the freeze window decides which boxes the network will refuse to open. The cost of a wrong choice is borne by holders whose keys were, in fact, never going to be broken under a Grover only model.

This is also why the runway end question is asked in months, not decades. Hashing and signatures are two different runways, and they have two different end points. Only one of them is the basis for the freeze.

Watch only and the line

Watch only wallets display a box and the public key that would open it. They do not hold the key. The line between hash and signature shows up in the watch only UI as a difference between an address, which is a hash commitment, and a script, which is the byte string that the hash commits to. The address is safe to share with a watch only server, because the address commits to a hash, and the public key is not yet on chain for the legacy P2PKH and P2WPKH paths. The script, once spent, exposes the public key, and from that moment the box is in the fast rederivation window under a sufficiently large quantum computer.

Two practical consequences follow. The first is that the watch only field for an address is not a place to enter anything secret, because nothing secret is required to display an address. The second is that the moment a transaction is broadcast, the public key appears in the mempool, and the runway that mattered is now the one on the signature, not the one on the hash. The clock that mattered for the freeze is now the clock that matters for the broadcast. Never paste a seed into a watch only field.

That sentence is not a slogan. It is a consequence of the model. The watch only field accepts a public key or an xpub, because the field is a window, not an opening. A seed, a passphrase, or a private key entered into that field hands over the ability to open the box. The hash and signature line is what makes the field safe in one direction and fatal in the other.

What a snapshot of October 2026 confirms

The snapshot of this month is consistent. The NIST PQC standards are finalised for FIPS 203, FIPS 204, and FIPS 205, and the first round of signature finalists is closed. The engineering milestones for a cryptanalytically relevant quantum computer against secp256k1 are tracked, and the trend line is downward, not upward, but the threshold has not been crossed. The mining hashrate sits in the high 600s of exahashes per second, and the economic commitment to double SHA 256 remains the largest single investment in any hash function in production. None of those facts change the line. The hash closes the box. The signature opens it. The freeze window in BIP 360 is calibrated against the opening.

The next pieces on this site will look at the difference between ML DSA and SLH DSA on taproot, and at the question of whether the freeze window needs to be aligned to the block subsidy halving in 2028 or to the signature milestone. Until then, the rule on the wall is the same one we have had since the first quantum post on this site. A box is closed by a hash. A box is opened by a signature. Treat the two as one and you mis time every decision you make on the freeze.