Commit on chain. Keep the signature off it.
Bitcoin miners still require a secp256k1 signature to spend coins. This page makes a normal P2PKH address, then a hybrid signature over the transaction id. Only a hash of that attestation is small enough for an OP_RETURN output.
Protect one transaction id
- 01
A compressed secp256k1 key becomes a P2PKH address.
That address is spendable under today’s consensus rules. The hybrid key sitting next to it is not a Bitcoin output type.
- 02
The hybrid signature covers the txid, both public keys, and a timestamp.
It is 3,373 bytes. You keep it, and the signed statement, wherever you keep records. Miners never see it.
- 03
The chain gets 34 bytes of script.
6a is OP_RETURN. 20 says the next 32 bytes are data. Those 32 bytes are SHA-256 of the statement plus the signature.
No attestation yet. The address is created the first time you protect a txid.
This does not make the coins quantum-safe. An address that has never sent a transaction has not published its secp256k1 key, and that is the exposure to avoid. After the key is revealed, a break of that curve can still produce a spend that miners accept. Gather a multisig off chain so the individual signatures are not published. Do not rush a migration to get there. Move the coins when a post-quantum output type exists, and do not reuse the address.
Same call in Python
from qrclib.bitcoin import QuantumProtectedWallet
wallet = QuantumProtectedWallet.generate()
attestation = wallet.protect_transaction("11" * 32)
assert attestation.verify()
script = attestation.op_return_script()
assert script[:2] == bytes.fromhex("6a20")
assert len(script) == 34