How vulnerable is Monero to Quantum Computing?

Question

Elliptic curve cryptography, which is used in Monero, is vulnerable to QC. Would Monero be more vulnerable than Bitcoin, because the addresses contain public keys, not hashes of public keys? What plans are in place to deal with future QC concerns?

Answer 1

From Monero developer Smooth:

“Yes it would be more vulnerable (with regard to public keys) but the protection it affords if uncertain and fragile. If QC can crack keys "slowly" then you can safely move coins from an address that hasn't been spent before to a new quantum-resistant output (assuming such a thing is implemented). But if QC can crack keys "quickly" (before any spend attempt is deeply buried in the blockchain) then any attempt becomes a race to securely move your coins before an attacker can steal them. I doubt Bitcoin would survive the latter.”

^{Source: Reddit}

From Monero developer/researcher (Monero Research Lab) NobleSir:

“Once the current round of improvements is finished (apps/ guis/multisig/etc) the attention will likely move to quantum secure, and hopefully by then there will be more signature implementations available to choose from. Hopefully a Bernstein type will have coded the new ref for quantum. Note that a lot of the necessary math (i.e. ring sigs / one time keys) has been studied already in the literature.”

^{Source: Reddit}

One possible replacement for more conventional schemes like RSA and ECDSA is Sphincs. See: https://github.com/jedisct1/libsodium/issues/371