From Enigma to Bitcoin

That sounds obvious until you notice how often people talk about “Bitcoin encryption” as if Satoshi had shipped a rotor machine for the internet. He didn’t. Enigma scrambled letters so an intercept looked like noise. Bitcoin publishes a ledger and uses mathematics to prove who may move coins, and how expensive it is to lie about the past. Same family of ideas. Different job.

A machine that never said the same thing twice

Arthur Scherbius patented a rotor cipher at the end of the First World War and sold it as Enigma in the 1920s. The German military later put hardened versions in every service. The box looked like a stout typewriter. Press A and a lamp lit some other letter. Press A again and you usually got a third. The rotors had stepped. The substitution had changed.

Inside, current ran from the key through a plugboard, through three rotors (four on the later naval M4), bounced off a reflector, and came back out another path to a lamp. Because of that reflector, the machine was reciprocal: the same daily settings that encrypted a letter decrypted it. A letter also never encrypted to itself. Operators loved the first property. Cryptanalysts used the second.

The daily secret was the setting sheet — which rotors, in which order, starting positions, rings, plug pairs. Count those pieces one way and you get the famous Army figure: about 159 quintillion settings, roughly 67 bits. Count them another way, with known wiring and wartime procedure, and Allied analysts faced something like 10²³ possibilities. Count the wiring itself as unknown and the theoretical space balloons toward 3×10¹¹⁴. German confidence sat on those numbers. The break sat on something smaller: operators who reused message keys, weather stations that opened with the same phrases, a machine that had to be issued to thousands of people who all needed the same secret in advance.

Polish mathematicians reconstructed the military wiring in 1932. In 1939 they handed the method to Britain and France. Bletchley Park industrialized the rest. The hardware was clever. The system was human.

What Bitcoin actually protects

Bitcoin, launched in 2009, does not hide amounts, addresses, or scripts. Anyone can download the chain. The cryptography does three other things.

It binds blocks with SHA-256. A hash of any input is a 256-bit fingerprint. Change a bit, the fingerprint changes. Mining is a race to find a nonce such that hashing the block header twice falls below a target. That is brute force on purpose.

It proves ownership with elliptic-curve signatures. A private key is a random number d. The public key is the point Q = d·G on the curve y² = x³ + 7 over a 256-bit prime field (secp256k1). Going from d to Q is easy. Going back is the discrete logarithm problem. Classically, that is about 128 bits of security. To spend, you hash a transaction and sign the digest with ECDSA, or — since Taproot in 2021 — with Schnorr on the same curve. Anyone can check the signature. Nobody learns d.

It turns keys into addresses by hashing. A legacy address is not the public key. It is RIPEMD-160 of SHA-256 of the public key, plus a checksum. Until you spend, the raw key stays off-stage. Taproot gave that up on purpose: the output carries a tweaked public key from the moment coins arrive, which is convenient for scripts and miserable if someone can one day invert the curve.

Call this encryption if you want. Just know you are stretching the word. Enigma’s product was confidentiality. Bitcoin’s product is verification without a trusted clerk.

The failure modes rhyme anyway. Enigma died on procedure. Bitcoin wallets die on reused nonces, reused addresses, copied seed phrases. The math can be sound and the operator can still give the secret away.

After the next machine

A quantum computer would not read the blockchain the way Bletchley read naval traffic. The chain is already readable. Shor’s algorithm would do something narrower and worse: turn an exposed public key back into a private key, then sign a theft. ECDSA and Schnorr fall together. SHA-256 does not. Grover’s algorithm weakens it; it does not flatten it.

Not every coin is equally exposed. Old pay-to-public-key outputs and funded Taproot outputs show a key immediately. Ordinary hashed addresses hide it until the first spend — or until someone reuses the address. Tallies in 2026 put something like four and a half to seven million bitcoin in outputs whose keys are already public. An attacker can copy those keys now and wait. Nothing has to be decrypted. The data is sitting there.

There is no adopted quantum upgrade. As of this writing the serious work is still in draft: hide keys better (BIP-360’s proposed P2MR output), eventually retire elliptic-curve spends (BIP-361), and add a signature Shor does not break. The Bitcoin-specific candidate getting the most airtime is SHRINCS, a hash-based scheme whose signatures, in the current draft, run from hundreds of bytes to nearly six thousand. Schnorr is 64. That is the whole scalability problem in one ratio.

Which is why layer 2s belong in the last act, and only there

An L2 cannot authorize a coin the base chain will not accept. Lightning channels still open and close with on-chain scripts. If those scripts are secp256k1, the channel dies with the key. Sidechains can try new signatures first — Liquid already ran opt-in post-quantum spends in 2026 as an experiment — and Lightning can harden its own off-chain gossip and transport without a Bitcoin soft fork. None of that replaces an L1 spend rule.

What L2s can do is absorb size and, if they are built for it, offer privacy the base chain will probably never grow. Stacks founder Muneeb Ali put the bandwidth point bluntly on 18 September 2026:

When Bitcoin gets a quantum upgrade, the effective bandwidth will be reduced by 50–97%. In other words, once post-quantum signatures go live, Bitcoin must have a scalability solution/layer ready to handle the bulk of Bitcoin traffic. The quantum upgrade must happen at L1, but privacy likely wouldn’t.

Muneeb Ali on X, 18 September 2026

The 50–97 percent is his estimate, not a measured constant. The direction is right. If every on-chain spend suddenly carries a signature fifty or a hundred times larger than Schnorr, payments have to live somewhere else. Shielded L2 addresses can also break the link between a user’s later activity and their public L1 history. They cannot un-publish keys already written into old outputs. Ali’s own Satoshi roadmap is a product plan, not consensus. The split underneath it is the part that matters: change how L1 coins are authorized; put volume and privacy on layers that can afford the extra bytes.

Enigma failed because a shared daily secret had to travel with every operator. Bitcoin’s quantum problem is the opposite. Too many public keys already traveled with the ledger, and they will not come back. Hide the ones that are still hidden. Give people a way to move coins under a signature that survives Shor. Decide what happens to coins that never move. Use L2s to keep the network usable after signatures get fat. Then change the base layer anyway. That is still where ownership settles.

Sources

• Muneeb Ali on X, 18 September 2026