I've been thinking about post quantum for Cashu.
@Cashu There's been progress on PQ signature schemes, but *blind* signatures might be a harder problem.
Personally, I'm not worried about quantum computing. Maybe 100 years from now quantum computers still won't be able to factor a 3-digit number. But let's imagine elliptic curves are broken, whether by quantum computers or a classical attack.
Inflation rather than blindness is the problem for Cashu. An attacker could recover the mint's private keys and forge unlimited ecash. But I think the blindness of the signatures would remain intact; I don't see how solving the discrete logarithm problem would allow them to unblind
If Bitcoin hasn't adopted PQ signatures, Cashu is dead anyway. And if we have practical PQ blind signatures, we can just use those. Apparently, the lattice-based schemes might allow blind signing
So the interesting scenario is where Bitcoin has adopted PQ signatures but Cashu hasn't.
Suppose elliptic-curve private keys can be recovered within a month. Cashu could continue using elliptic curves, but keysets would have to expire after perhaps a week. Not just rotate to new active keysets: old ecash would become worthless.
Every user would have to come online weekly to refresh their entire balance, or lose it.
My prediction is that people simply wouldn't do that, and everyone would use on-chain Bitcoin, Lightning, or something else
As I said, I'm optimistic that elliptic curves will be fine for another century. If not, then chaumian ecash needs a quantum-safe blind signing scheme; there are no workarounds to keep elliptic curve blind signing in operation
