Dilithium Overview

BTQ Core implements CRYSTALS-Dilithium as specified in NIST FIPS 204, providing quantum-resistant digital signatures that protect against future quantum computer attacks.

Why Dilithium?

Current Bitcoin uses ECDSA (Elliptic Curve Digital Signature Algorithm) based on the secp256k1 curve. While secure against classical computers, ECDSA is vulnerable to quantum attacks:

• Shor's Algorithm can break ECDSA in polynomial time on a sufficiently powerful quantum computer
• A quantum computer with ~2,330 logical qubits could theoretically break Bitcoin's cryptography
• While such computers don't exist today, "harvest now, decrypt later" attacks are a real concern

Dilithium is a lattice-based signature scheme that:

• Was selected by NIST for post-quantum standardization (2024)
• Is based on the Module Learning with Errors (MLWE) problem
• Is believed secure against both classical and quantum adversaries
• Has fast verification (faster than ECDSA!)

Dilithium2 Parameters

BTQ uses Dilithium2 (NIST Security Level 2, equivalent to AES-128):

Comparison with ECDSA

How It Works

Key Generation

(pk, sk) = Dilithium2.KeyGen()

Where:

• pk is the 1,312-byte public key
• sk is the 2,560-byte secret key

Key generation uses SHAKE-256 as the extendable output function (XOF) for deterministic randomness expansion.

Signing

sig = Dilithium2.Sign(sk, m)

Where:

• sk is the secret key
• m is the message (transaction sighash)
• sig is the 2,420-byte signature

The signing process:

1. Compute sighash of transaction (SHA-256 double-hash, same as Bitcoin)
2. Generate Dilithium signature over sighash
3. Append sighash type byte (e.g., 0x01 for SIGHASH_ALL)
4. Total signature: 2,421 bytes

Verification

result = Dilithium2.Verify(pk, m, sig)

Verification returns 1 (valid) or 0 (invalid). BTQ nodes verify Dilithium signatures during:

• Mempool acceptance
• Block validation
• Script execution

Security Properties

Dilithium provides:

• EUF-CMA Security: Existential Unforgeability under Chosen Message Attack
• Quantum Resistance: Based on MLWE hardness, resistant to Shor's algorithm
• Deterministic Signatures: Same inputs produce same signature
• Fast Verification: ~1.5ms on modern hardware

Implementation Architecture

BTQ wraps the Dilithium C reference implementation in C++ classes:

CDilithiumKey (Private Key)

class CDilithiumKey {
    void MakeNewKey();           // Generate new keypair
    bool Sign(hash, signature);  // Sign 32-byte hash
    bool Load(privkey);          // Import private key
    CDilithiumPubKey GetPubKey(); // Extract public key
};

CDilithiumPubKey (Public Key)

class CDilithiumPubKey {
    bool Verify(hash, signature); // Verify signature
    CKeyID GetID();               // 160-bit key identifier
    size_t Size();                // Returns 1312
};

The key identifier is computed as RIPEMD160(SHA256(pubkey)), consistent with Bitcoin's approach.

Network Parameters

BTQ adjusts consensus parameters to accommodate larger Dilithium signatures:

This ensures Dilithium transactions are valid under consensus rules while maintaining network security.

Current Status

Learn More

• Dilithium Addresses - Address formats and encoding
• Dilithium Signatures - Signing and verification
• Dilithium Cryptography - Technical deep-dive
• BIP360 P2MR - Witness v2 Pay-to-Merkle-Root rules and behavior