Quantum Tripwire demo

[Sjors]

Experimental demo of the quantum tripwire: Anthony Towns' "aRsm" ECDL-break proof from the bitcoindev thread https://gnusha.org/pi/bitcoindev/aj9SkwXqdRbuVZxH@erisian.com.au/

A 128-byte proof a || R || s || m is valid for a NUMS point N if (R, s) is a valid BIP-340 signature of m under P = N + a·G. A valid signature proves knowledge of dlog(N), which is only possible by breaking the elliptic-curve discrete log problem on secp256k1 — i.e. it is self-incriminating evidence of a post-quantum, key-path theft of a NUMS-internal-key Taproot output. The owner (or anyone) can assemble the proof from the public tweak a and the attacker's on-chain signature.

This branch implements it as a series of commits:

1. test — a functional test that simulates the theft end to end (using a fake NUMS point with a known discrete log, so the theft can actually be signed) and verifies the proof in Python.
2. node — an in-memory store holding a single proof, verified against a configurable NUMS point (default the BIP-341 NUMS point; -test=fakenums on regtest selects the known-dlog point). Adds submitquantumproof / getquantumproof RPCs and an XOnlyPubKey::AddTweak helper to compute P = N + a·G.
3. mining — the held proof is published as a single required coinbase OP_RETURN, via both the generate* RPCs and the Mining IPC getCoinbaseTx() required outputs (the proof doesn't fit in the 80-byte header).
4. validation — the block carrying the proof instantly activates the tripwire from the next block; after activation the OP_RETURN is no longer added and further proofs are ignored. Activation is persisted to a small self-verifying file: the activation block hash, the full coinbase transaction, and its merkle inclusion path. At startup — after headers load from disk, before the network accepts new headers (to avoid a reorg race) — it is checked two ways: the coinbase's merkle path must reconstruct the header's merkle root, and the coinbase must carry a verifying proof; the block header is also confirmed still in the active chain. Only the header is read, so it works on pruned nodes, and the proof is recovered by scanning the coinbase rather than stored twice. Deactivation is keyed on the activation block, so reorging out a later proof-bearing block does not deactivate. Not a consensus rule change.
5. rpc — surface the tripwire as a quantum deployment (type tripwire) in getdeploymentinfo, so clients can observe it like a soft fork.
6. p2p — a new qproof message gossips proofs: the first valid one is stored and flooded to peers; malformed/invalid/duplicate proofs are ignored. submitquantumproof also relays to peers (even when one is already held).

Caveats: this is a demo to explore the mechanism, not for merge. The held proof itself is kept only in memory (just the activation point is persisted), and the store is a process-global singleton.

Co-authored with Claude (Opus 4.8).

[Sjors]

cc @ajtowns

[ajtowns]

What sort of idiot would call it "aRsm" when "ASMR" was right there? Tsktsktsk.