<p>This was answered by Pieter Wuille on <a href="https://delvingbitcoin.org/t/lamport-signatures-and-other-cat-tricks/236/6" rel="nofollow noreferrer">Delving Bitcoin</a>:</p>
<blockquote>
<p>As long as SHA256 remains preimage resistant, script path spends
remain secure (obviously only under the assumption the script itself
isn’t vulnerable to a DL break).</p>
</blockquote>

CC BY-SA 4.0
2024-02-09T14:06:50.547Z
2024-02-09T14:06:50.547Z
Vojtěch Strnad
<p>If an attacker in posession of a quantum computer can break the ECDLP, they can of course spend every Taproot output using the key path. However, do they also have the ability to construct a valid control block and spend using the script path with a script of their own choosing?</p>

<script><taproot><quantum-computing>
Is the Taproot script tree commitment quantum safe?
Vojtěch Strnad
# Is the Taproot script tree commitment quantum safe?

(Asked by: username_0 on 2023-12-16)

If an attacker in posession of a quantum computer can break the ECDLP, they can of course spend every Taproot output using the key path. However, do they also have the ability to construct a valid control block and spend using the script path with a script of their own choosing?

**Tags:** script, taproot, quantum-computing


---

## 1 answers

### Answer by username_0 on 2024-02-09. Score: 3 | Accepted answer

This was answered by Pieter Wuille on [Delving Bitcoin](https://delvingbitcoin.org/t/lamport-signatures-and-other-cat-tricks/236/6):

> As long as SHA256 remains preimage resistant, script path spends
> remain secure (obviously only under the assumption the script itself
> isn’t vulnerable to a DL break).


---

