Quantum-Resistant Bitcoin with SPHINCS+-SHAKE256f

Quantum-Resistant Bitcoin

The imminent quantum computing revolution presents an existential threat to Bitcoin's cryptographic foundations that demands immediate architectural evolution. Current ECDSA signatures rely on the elliptic curve discrete logarithm problem (ECDLP), which Shor's algorithm efficiently solves on quantum computers. Approximately 25% of Bitcoin's UTXO set representing hundreds of billions of dollars remains vulnerable through exposed public keys in P2PK transactions and address reuse. SPHINCS+-SHAKE256f (standardized as SLH-DSA-SHAKE-256f in NIST FIPS 205) provides mathematically proven quantum resistance through conservative hash-based constructions. This stateless signature scheme eliminates number-theoretic vulnerabilities while maintaining Bitcoin's trust-minimized security model. The Bitcoin Foundation strongly recommends this transition as essential for Bitcoin's long-term survival.

Quantum attackers face fundamentally different security boundaries when confronting SPHINCS+-SHAKE256f's multi-layered defenses. The core security parameter n=256 establishes computational boundaries exceeding Bitcoin's original design specifications. Classical brute-force complexity reaches 2²⁵⁶ operations while quantum adversaries face minimized 2¹²⁸ security floor. SHAKE256's extendable-output functionality provides cryptographic primitives for all substructures. The hyper-tree structure amplifies security through nested authentication layers, creating exponential security margins that resist even multi-target attacks.

Mathematical Security Foundations

SPHINCS+-SHAKE256f's security derives from well-understood cryptographic primitives with conservative parameterization. The Winternitz One-Time Signature (WOTS+) foundation provides information-theoretic security with bounded leakage per signature. Security bounds follow strict mathematical formulations:

WOTS+ security ≤ q_hash · (w · len / 2^n + Adv_collision)

Where w=16 (Winternitz parameter), len=67, and n=256 creates exponential security margins. The hyper-tree structure amplifies security through nested authentication layers:

Security = min(2^{n/2}, 2^{d·h}) = min(2¹²⁸, 2^{1156}) = 2¹²⁸

With tree depth d=17 and full height h=68 (as specified in NIST FIPS 205), this construction resists even multi-target attacks. Existential unforgeability under chosen-message attacks (EU-CMA) is mathematically guaranteed:

Adv^{EU-CMA}(A) ≤ q_hash · Adv^{SPR}(B) + q_sig · (w/2^h + Adv^{PRF}(C))

With w=16 and h=68, the advantage becomes negligible (≤ 2⁻⁶⁸). The security reduction against quantum adversaries establishes firm boundaries:

Quantum-Resistance ≤ min(q²/2^{n/2}, q/2^{n/3})

For practical query counts (q ≤ 2⁸⁵), security exceeds 2¹²⁸ operations.

Key Security Parameters

Private key security derives from 64-byte secrets containing 512-bit entropy (the 128-byte private key includes 64 bytes of public data for convenience). This massive key space creates insurmountable barriers for quantum brute-force attacks:

Seed security at 96 bytes (768 bits) provides additional protection:

Information-Theoretic Advantages

Information-theoretic advantages fundamentally differentiate SPHINCS+ from ECDSA. While ECDSA private keys become fully compromised upon public key exposure (trivial for quantum adversaries), SPHINCS+ protects the master secret through PRF-based key derivation. Each signature uses a fresh one-time key from a hyper-tree containing 2⁶⁸ leaves (h=68), with master secret security maintained regardless of signature count:

ECDSA: Private key fully compromised via quantum attack on public key
SPHINCS+: Master secret protected by PRF security
Signature capacity: 2⁶⁸ messages without security degradation

This progressive security degradation model prevents catastrophic key exposure. NIST's SL 5 categorization - the highest security level - reflects conservative parameterization that aligns with Bitcoin's security-first philosophy.

Migration Path: Phased Implementation

The backward-compatible migration path ensures minimal disruption while providing clear timelines for ecosystem adaptation. The two-phase approach balances security with practical implementation constraints:

The Speedy Trial activation mechanism with 18-month timeout and 90% miner signaling threshold provides decisive momentum while quarterly adoption metrics create accountability.

Cryptographic Implementation Details

The reference implementation demonstrates production readiness through optimized Bitcoin-specific constructs. Key generation from 96-byte seeds provides sufficient entropy for millennia of security. SPHINCS+-SHAKE256f signing produces deterministic 49,856-byte signatures that maintain EU-CMA security even under quantum chosen-message attacks.

Signature generation process:
1. Message → SHAKE256(message) → 256-bit digest
2. FORS (Forest of Random Subsets) key generation
3. WOTS⁺ one-time signature construction
4. Hyper-tree authentication path computation
5. Concatenated signature structure

Verification works with both WIF keys and quantum Bitcoin addresses, maintaining compatibility with Bitcoin's existing infrastructure. Extended witness structures efficiently accommodate large signatures without blockchain bloat, while priority mempool treatment for QR transactions during transition phases creates economic incentives for adoption.

Stakeholder Impact Analysis

The migration requires coordinated action across Bitcoin's ecosystem with clearly defined responsibilities:

This distribution of responsibilities maintains Bitcoin's decentralized ethos while ensuring comprehensive protection. Hardware wallet manufacturers face particular challenges with the computational requirements of SPHINCS+ operations, though modern secure elements demonstrate sufficient capability in reference implementations.

Quantum Threat Mitigation Strategy

The system provides multi-layered defense against quantum attack vectors through cryptographic design principles:

Transaction Malleability Elimination: Stateless deterministic signatures prevent transaction malleability vulnerabilities entirely. Each signature binds uniquely to both message and private key without nonce requirements.

Post-Quantum Forward Secrecy: Unlike ECDSA, SPHINCS+ signatures reveal only one-time key material derived via PRF from the master secret. The master key remains protected regardless of how many signatures are published. This creates protection against "harvest now, decrypt later" attacks.

Comparative Security Analysis

Implementation Considerations

Signature size at 49,856 bytes presents engineering challenges but remains feasible within Bitcoin's existing architecture. Witness data discounting applies proportionally, maintaining reasonable transaction costs. Block propagation optimizations include:

1. Signature aggregation techniques
2. Compact sparse tree representations
3. Batch verification protocols
4. Sliding window authentication paths

The reference implementation demonstrates verification times that are well within Bitcoin's block validation constraints. Future efficiency improvements through zero-knowledge proof systems remain possible without consensus changes.

NIST Standardization and Cryptographic Assurance

FIPS 205 (SLH-DSA) represents the culmination of 8 years of academic scrutiny through the NIST Post-Quantum Cryptography standardization process. SPHINCS+-SHAKE256f's selection as a primary digital signature standard reflects:

Compared to lattice-based alternatives, hash-based cryptography offers superior transparency and resistance to parameter manipulation attacks. The SHAKE256 primitive has undergone extensive cryptanalysis as part of the SHA-3 standard (FIPS 202), providing well-understood security properties.

Economic and Systemic Implications

Quantum-resistant Bitcoin preserves the network's core value propositions while enhancing security guarantees. Fixed supply economics gain protection against quantum wealth destruction events that could permanently erode trust. Decentralized consensus mechanisms remain unchanged, maintaining Bitcoin's permissionless innovation environment. The migration plan specifically addresses coordination challenges through:

1. Progressive economic incentives for early adoption
2. Clear accountability metrics for ecosystem participants
3. Voluntary migration preserving user sovereignty

This balances security with practical implementation constraints, enabling orderly transition while respecting user autonomy.

Reference Implementation

quantum-resistant-bitcoin.cpp

/*
 * Quantum-Resistant Bitcoin
 * SPHINCS+-SHAKE-256f (SLH-DSA-SHAKE-256f) Implementation
 * © 2026 — https://bitcoin.foundation — All Rights Reserved!
 *
 * NIST FIPS 205 Compliant - Security Level 5
 * Signature Size: 49,856 bytes
 */

#include <cstdint>
#include <cstring>
#include <array>
#include <vector>
#include <string>
#include <chrono>
#include <iostream>
#include <iomanip>
#include <sstream>
#include <algorithm>
#include <fstream>
#include <filesystem>
#include <ctime>
#include <span>
#include <string_view>
#include <stdexcept>

#if defined(_WIN32) || defined(_WIN64)
    #define QRB_WINDOWS
    #ifndef WIN32_LEAN_AND_MEAN
        #define WIN32_LEAN_AND_MEAN
    #endif
    #include <windows.h>
    #include <bcrypt.h>
    #pragma comment(lib, "bcrypt.lib")
#elif defined(__linux__) || defined(__unix__) || defined(__APPLE__)
    #define QRB_POSIX
    #include <fcntl.h>
    #include <unistd.h>
    #if defined(__linux__) && defined(__GLIBC__) && (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 25))
        #include <sys/random.h>
        #define QRB_HAS_GETRANDOM
    #endif
#endif

namespace fs = std::filesystem;

namespace qrb {

constexpr std::array<uint64_t, 24> KECCAK_RC = {
    0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL, 0x8000000080008000ULL,
    0x000000000000808bULL, 0x0000000080000001ULL, 0x8000000080008081ULL, 0x8000000000008009ULL,
    0x000000000000008aULL, 0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,
    0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL, 0x8000000000008003ULL,
    0x8000000000008002ULL, 0x8000000000000080ULL, 0x000000000000800aULL, 0x800000008000000aULL,
    0x8000000080008081ULL, 0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL,
};

constexpr std::array<std::array<int, 5>, 5> ROTATIONS = {{
    {0, 36, 3, 41, 18}, {1, 44, 10, 45, 2}, {62, 6, 43, 15, 61},
    {28, 55, 25, 21, 56}, {27, 20, 39, 8, 14},
}};

constexpr int N = 32;
constexpr int H = 68;
constexpr int D = 17;
constexpr int HP = 4;
constexpr int A = 9;
constexpr int K = 35;
constexpr int W = 16;
constexpr int LGW = 4;
constexpr int LEN1 = 64;
constexpr int LEN2 = 3;
constexpr int LEN = 67;
constexpr int SK_SIZE = 4 * N;
constexpr int PK_SIZE = 2 * N;
constexpr size_t SIG_SIZE = 49856;

constexpr int TYPE_WOTS_HASH = 0;
constexpr int TYPE_WOTS_PK = 1;
constexpr int TYPE_TREE = 2;
constexpr int TYPE_FORS_TREE = 3;
constexpr int TYPE_FORS_ROOTS = 4;
constexpr int TYPE_WOTS_PRF = 5;
constexpr int TYPE_FORS_PRF = 6;

constexpr std::string_view BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";

using Bytes = std::vector<uint8_t>;

[[nodiscard]] constexpr uint64_t rol64(uint64_t x, int n) noexcept {
    return (x << n) | (x >> (64 - n));
}

void keccak_f1600(std::array<uint64_t, 25>& state) noexcept {
    std::array<uint64_t, 5> c{}, d{};
    std::array<uint64_t, 25> b{};
    for (int round = 0; round < 24; ++round) {
        for (int x = 0; x < 5; ++x)
            c[x] = state[x] ^ state[x + 5] ^ state[x + 10] ^ state[x + 15] ^ state[x + 20];
        for (int x = 0; x < 5; ++x)
            d[x] = c[(x + 4) % 5] ^ rol64(c[(x + 1) % 5], 1);
        for (int x = 0; x < 5; ++x)
            for (int y = 0; y < 5; ++y)
                state[x + 5 * y] ^= d[x];
        for (int x = 0; x < 5; ++x)
            for (int y = 0; y < 5; ++y)
                b[y + 5 * ((2 * x + 3 * y) % 5)] = rol64(state[x + 5 * y], ROTATIONS[x][y]);
        for (int x = 0; x < 5; ++x)
            for (int y = 0; y < 5; ++y)
                state[x + 5 * y] = b[x + 5 * y] ^ ((~b[(x + 1) % 5 + 5 * y]) & b[(x + 2) % 5 + 5 * y]);
        state[0] ^= KECCAK_RC[round];
    }
}

[[nodiscard]] Bytes shake256(const uint8_t* msg, size_t msg_len, size_t out_len) {
    constexpr size_t rate = 136;
    std::array<uint64_t, 25> state{};
    size_t padded_len = msg_len + 1;
    padded_len += (rate - (padded_len % rate)) % rate;
    Bytes padded(padded_len, 0);
    std::memcpy(padded.data(), msg, msg_len);
    padded[msg_len] = 0x1f;
    padded[padded_len - 1] |= 0x80;
    for (size_t i = 0; i < padded_len; i += rate) {
        for (size_t j = 0; j < rate / 8; ++j) {
            uint64_t lane;
            std::memcpy(&lane, padded.data() + i + j * 8, 8);
            state[j] ^= lane;
        }
        keccak_f1600(state);
    }
    Bytes output(out_len);
    size_t offset = 0;
    while (offset < out_len) {
        std::array<uint8_t, rate> state_bytes{};
        for (size_t j = 0; j < rate / 8; ++j)
            std::memcpy(state_bytes.data() + j * 8, &state[j], 8);
        size_t to_copy = std::min(rate, out_len - offset);
        std::memcpy(output.data() + offset, state_bytes.data(), to_copy);
        offset += to_copy;
        if (offset < out_len) keccak_f1600(state);
    }
    return output;
}

[[nodiscard]] Bytes shake256(const Bytes& msg, size_t out_len) {
    return shake256(msg.data(), msg.size(), out_len);
}

[[nodiscard]] std::string base58_encode(const Bytes& data) {
    if (data.empty()) return "";
    Bytes num(data);
    std::string result;
    while (!num.empty()) {
        uint32_t carry = 0;
        Bytes next;
        for (auto b : num) {
            carry = carry * 256 + b;
            if (!next.empty() || carry >= 58) {
                next.push_back(carry / 58);
                carry %= 58;
            }
        }
        result.insert(result.begin(), BASE58_ALPHABET[carry]);
        num = std::move(next);
    }
    for (auto b : data) {
        if (b == 0) result.insert(result.begin(), '1');
        else break;
    }
    return result;
}

[[nodiscard]] Bytes base58_decode(std::string_view str) {
    Bytes result;
    for (char c : str) {
        auto pos = BASE58_ALPHABET.find(c);
        if (pos == std::string_view::npos) return {};
        uint32_t carry = static_cast<uint32_t>(pos);
        for (auto it = result.rbegin(); it != result.rend(); ++it) {
            carry += 58 * (*it);
            *it = carry & 0xff;
            carry >>= 8;
        }
        while (carry > 0) {
            result.insert(result.begin(), carry & 0xff);
            carry >>= 8;
        }
    }
    for (char c : str) {
        if (c == '1') result.insert(result.begin(), 0);
        else break;
    }
    return result;
}

[[nodiscard]] bool secure_compare(const uint8_t* a, const uint8_t* b, size_t len) noexcept {
    volatile uint8_t result = 0;
    for (size_t i = 0; i < len; ++i) {
        result |= a[i] ^ b[i];
    }
    return result == 0;
}

[[nodiscard]] bool secure_compare(const Bytes& a, const Bytes& b) noexcept {
    if (a.size() != b.size()) return false;
    return secure_compare(a.data(), b.data(), a.size());
}

void random_bytes(uint8_t* buf, size_t len) {
    if (len == 0) return;
    
#if defined(QRB_WINDOWS)
    NTSTATUS status = BCryptGenRandom(nullptr, buf, static_cast<ULONG>(len), BCRYPT_USE_SYSTEM_PREFERRED_RNG);
    if (!BCRYPT_SUCCESS(status)) {
        throw std::runtime_error("BCryptGenRandom failed with status: " + std::to_string(status));
    }
#elif defined(QRB_POSIX)
    #if defined(QRB_HAS_GETRANDOM)
        size_t total = 0;
        while (total < len) {
            ssize_t result = getrandom(buf + total, len - total, 0);
            if (result < 0) {
                if (errno == EINTR) continue;
                throw std::runtime_error("getrandom() failed: " + std::string(strerror(errno)));
            }
            total += static_cast<size_t>(result);
        }
    #else
        int fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC);
        if (fd < 0) {
            throw std::runtime_error("Failed to open /dev/urandom: " + std::string(strerror(errno)));
        }
        size_t total = 0;
        while (total < len) {
            ssize_t result = read(fd, buf + total, len - total);
            if (result < 0) {
                if (errno == EINTR) continue;
                close(fd);
                throw std::runtime_error("Failed to read from /dev/urandom: " + std::string(strerror(errno)));
            }
            if (result == 0) {
                close(fd);
                throw std::runtime_error("/dev/urandom returned EOF unexpectedly");
            }
            total += static_cast<size_t>(result);
        }
        close(fd);
    #endif
#endif
}

struct Adrs {
    int layer = 0;
    int64_t tree = 0;
    int type = 0;
    int key_pair = 0;
    int chain = 0;
    int hash = 0;
    int tree_height = 0;
    int tree_index = 0;
    
    [[nodiscard]] std::array<uint8_t, 32> to_bytes() const noexcept {
        std::array<uint8_t, 32> result{};
        auto write_be32 = [](uint8_t* p, uint32_t v) {
            p[0] = (v >> 24) & 0xff; p[1] = (v >> 16) & 0xff;
            p[2] = (v >> 8) & 0xff; p[3] = v & 0xff;
        };
        auto write_be64 = [](uint8_t* p, int64_t v) {
            for (int i = 7; i >= 0; --i) { p[i] = v & 0xff; v >>= 8; }
        };
        write_be32(result.data(), layer);
        write_be64(result.data() + 4, tree);
        write_be32(result.data() + 12, type);
        write_be32(result.data() + 16, key_pair);
        write_be32(result.data() + 20, chain);
        write_be32(result.data() + 24, hash);
        write_be32(result.data() + 28, tree_height);
        return result;
    }
    
    [[nodiscard]] Adrs with_layer(int l) const noexcept { Adrs a = *this; a.layer = l; return a; }
    [[nodiscard]] Adrs with_tree(int64_t t) const noexcept { Adrs a = *this; a.tree = t; return a; }
    [[nodiscard]] Adrs with_type(int t) const noexcept { 
        Adrs a = *this; a.type = t; a.key_pair = 0; a.chain = 0; 
        a.hash = 0; a.tree_height = 0; a.tree_index = 0; return a; 
    }
    [[nodiscard]] Adrs with_key_pair(int kp) const noexcept { Adrs a = *this; a.key_pair = kp; return a; }
    [[nodiscard]] Adrs with_chain(int c) const noexcept { Adrs a = *this; a.chain = c; return a; }
    [[nodiscard]] Adrs with_hash(int h) const noexcept { Adrs a = *this; a.hash = h; return a; }
    [[nodiscard]] Adrs with_tree_height(int h) const noexcept { Adrs a = *this; a.tree_height = h; return a; }
    [[nodiscard]] Adrs with_tree_index(int i) const noexcept { Adrs a = *this; a.tree_index = i; return a; }
};

[[nodiscard]] Bytes F(const Bytes& pk_seed, const Adrs& adrs, const Bytes& m) {
    auto adrs_bytes = adrs.to_bytes();
    Bytes input(pk_seed.size() + 32 + m.size());
    std::memcpy(input.data(), pk_seed.data(), pk_seed.size());
    std::memcpy(input.data() + pk_seed.size(), adrs_bytes.data(), 32);
    std::memcpy(input.data() + pk_seed.size() + 32, m.data(), m.size());
    return shake256(input, N);
}

[[nodiscard]] Bytes H_func(const Bytes& pk_seed, const Adrs& adrs, const Bytes& m1, const Bytes& m2) {
    auto adrs_bytes = adrs.to_bytes();
    Bytes input(pk_seed.size() + 32 + m1.size() + m2.size());
    size_t off = 0;
    std::memcpy(input.data() + off, pk_seed.data(), pk_seed.size()); off += pk_seed.size();
    std::memcpy(input.data() + off, adrs_bytes.data(), 32); off += 32;
    std::memcpy(input.data() + off, m1.data(), m1.size()); off += m1.size();
    std::memcpy(input.data() + off, m2.data(), m2.size());
    return shake256(input, N);
}

[[nodiscard]] Bytes Tl(const Bytes& pk_seed, const Adrs& adrs, const std::vector<Bytes>& messages) {
    auto adrs_bytes = adrs.to_bytes();
    size_t total = pk_seed.size() + 32;
    for (const auto& m : messages) total += m.size();
    Bytes input(total);
    size_t off = 0;
    std::memcpy(input.data() + off, pk_seed.data(), pk_seed.size()); off += pk_seed.size();
    std::memcpy(input.data() + off, adrs_bytes.data(), 32); off += 32;
    for (const auto& m : messages) {
        std::memcpy(input.data() + off, m.data(), m.size());
        off += m.size();
    }
    return shake256(input, N);
}

[[nodiscard]] Bytes Prf(const Bytes& pk_seed, const Bytes& sk_seed, const Adrs& adrs) {
    auto adrs_bytes = adrs.to_bytes();
    Bytes input(pk_seed.size() + 32 + sk_seed.size());
    std::memcpy(input.data(), pk_seed.data(), pk_seed.size());
    std::memcpy(input.data() + pk_seed.size(), adrs_bytes.data(), 32);
    std::memcpy(input.data() + pk_seed.size() + 32, sk_seed.data(), sk_seed.size());
    return shake256(input, N);
}

[[nodiscard]] Bytes chain(const Bytes& x, int i, int s, const Bytes& pk_seed, Adrs adrs) {
    Bytes tmp = x;
    for (int j = i; j < i + s; ++j)
        tmp = F(pk_seed, adrs.with_hash(j), tmp);
    return tmp;
}

[[nodiscard]] std::vector<Bytes> wots_sk_gen(const Bytes& sk_seed, const Bytes& pk_seed, const Adrs& adrs) {
    std::vector<Bytes> sks(LEN);
    Adrs sk_adrs = adrs.with_type(TYPE_WOTS_PRF);
    for (int i = 0; i < LEN; ++i)
        sks[i] = Prf(pk_seed, sk_seed, sk_adrs.with_chain(i));
    return sks;
}

[[nodiscard]] Bytes wots_pk_gen(const Bytes& sk_seed, const Bytes& pk_seed, const Adrs& adrs) {
    Adrs wots_adrs = adrs.with_type(TYPE_WOTS_HASH);
    auto sks = wots_sk_gen(sk_seed, pk_seed, adrs);
    std::vector<Bytes> tmp(LEN);
    for (int i = 0; i < LEN; ++i)
        tmp[i] = chain(sks[i], 0, W - 1, pk_seed, wots_adrs.with_chain(i));
    return Tl(pk_seed, adrs.with_type(TYPE_WOTS_PK), tmp);
}

[[nodiscard]] Bytes xmss_node(const Bytes& sk_seed, const Bytes& pk_seed, int i, int z, const Adrs& adrs) {
    if (z == 0)
        return wots_pk_gen(sk_seed, pk_seed, adrs.with_type(TYPE_WOTS_HASH).with_key_pair(i));
    Bytes left = xmss_node(sk_seed, pk_seed, 2 * i, z - 1, adrs);
    Bytes right = xmss_node(sk_seed, pk_seed, 2 * i + 1, z - 1, adrs);
    return H_func(pk_seed, adrs.with_type(TYPE_TREE).with_tree_height(z).with_tree_index(i), left, right);
}

[[nodiscard]] Bytes prf_msg(const Bytes& sk_prf, const Bytes& opt_rand, const Bytes& m) {
    Bytes input(sk_prf.size() + opt_rand.size() + m.size());
    size_t off = 0;
    std::memcpy(input.data() + off, sk_prf.data(), sk_prf.size()); off += sk_prf.size();
    std::memcpy(input.data() + off, opt_rand.data(), opt_rand.size()); off += opt_rand.size();
    std::memcpy(input.data() + off, m.data(), m.size());
    return shake256(input, N);
}

[[nodiscard]] Bytes h_msg(const Bytes& r, const Bytes& pk_seed, const Bytes& pk_root, const Bytes& m) {
    Bytes input(r.size() + pk_seed.size() + pk_root.size() + m.size());
    size_t off = 0;
    std::memcpy(input.data() + off, r.data(), r.size()); off += r.size();
    std::memcpy(input.data() + off, pk_seed.data(), pk_seed.size()); off += pk_seed.size();
    std::memcpy(input.data() + off, pk_root.data(), pk_root.size()); off += pk_root.size();
    std::memcpy(input.data() + off, m.data(), m.size());
    size_t out_len = (K * A + 7) / 8 + (H - H / D + 7) / 8 + (H / D + 7) / 8;
    return shake256(input, out_len);
}

[[nodiscard]] std::vector<int> base_2b(const Bytes& x, int b, int out_len) {
    std::vector<int> result(out_len);
    int consumed = 0, bits = 0, total = 0;
    for (int i = 0; i < out_len; ++i) {
        while (bits < b) {
            total = (total << 8) | x[consumed++];
            bits += 8;
        }
        bits -= b;
        result[i] = (total >> bits) & ((1 << b) - 1);
    }
    return result;
}

[[nodiscard]] std::vector<Bytes> wots_sign(const Bytes& m, const Bytes& sk_seed, const Bytes& pk_seed, const Adrs& adrs) {
    auto msg = base_2b(m, LGW, LEN1);
    int csum = 0;
    for (int i = 0; i < LEN1; ++i) csum += W - 1 - msg[i];
    csum <<= (8 - ((LEN2 * LGW) % 8)) % 8;
    Bytes csum_bytes(2);
    csum_bytes[0] = (csum >> 8) & 0xff;
    csum_bytes[1] = csum & 0xff;
    auto csum_msg = base_2b(csum_bytes, LGW, LEN2);
    std::vector<int> full_msg(LEN);
    std::copy(msg.begin(), msg.end(), full_msg.begin());
    std::copy(csum_msg.begin(), csum_msg.end(), full_msg.begin() + LEN1);
    std::vector<Bytes> sig(LEN);
    auto sks = wots_sk_gen(sk_seed, pk_seed, adrs);
    Adrs wots_adrs = adrs.with_type(TYPE_WOTS_HASH);
    for (int i = 0; i < LEN; ++i)
        sig[i] = chain(sks[i], 0, full_msg[i], pk_seed, wots_adrs.with_chain(i));
    return sig;
}

[[nodiscard]] Bytes wots_pk_from_sig(const std::vector<Bytes>& sig, const Bytes& m, const Bytes& pk_seed, const Adrs& adrs) {
    auto msg = base_2b(m, LGW, LEN1);
    int csum = 0;
    for (int i = 0; i < LEN1; ++i) csum += W - 1 - msg[i];
    csum <<= (8 - ((LEN2 * LGW) % 8)) % 8;
    Bytes csum_bytes(2);
    csum_bytes[0] = (csum >> 8) & 0xff;
    csum_bytes[1] = csum & 0xff;
    auto csum_msg = base_2b(csum_bytes, LGW, LEN2);
    std::vector<int> full_msg(LEN);
    std::copy(msg.begin(), msg.end(), full_msg.begin());
    std::copy(csum_msg.begin(), csum_msg.end(), full_msg.begin() + LEN1);
    std::vector<Bytes> tmp(LEN);
    Adrs wots_adrs = adrs.with_type(TYPE_WOTS_HASH);
    for (int i = 0; i < LEN; ++i)
        tmp[i] = chain(sig[i], full_msg[i], W - 1 - full_msg[i], pk_seed, wots_adrs.with_chain(i));
    return Tl(pk_seed, adrs.with_type(TYPE_WOTS_PK), tmp);
}

struct XmssSig { 
    std::vector<Bytes> wots_sig; 
    std::vector<Bytes> auth; 
};

[[nodiscard]] XmssSig xmss_sign(const Bytes& m, const Bytes& sk_seed, int idx, const Bytes& pk_seed, const Adrs& adrs) {
    std::vector<Bytes> auth(HP);
    for (int j = 0; j < HP; ++j)
        auth[j] = xmss_node(sk_seed, pk_seed, (idx >> j) ^ 1, j, adrs);
    auto wots_sig = wots_sign(m, sk_seed, pk_seed, adrs.with_type(TYPE_WOTS_HASH).with_key_pair(idx));
    return {wots_sig, auth};
}

[[nodiscard]] Bytes xmss_pk_from_sig(int idx, const XmssSig& sig, const Bytes& m, const Bytes& pk_seed, const Adrs& adrs) {
    Bytes node = wots_pk_from_sig(sig.wots_sig, m, pk_seed, adrs.with_type(TYPE_WOTS_HASH).with_key_pair(idx));
    Adrs tree_adrs = adrs.with_type(TYPE_TREE);
    for (int k = 0; k < HP; ++k) {
        tree_adrs = tree_adrs.with_tree_height(k + 1).with_tree_index(idx >> (k + 1));
        node = ((idx >> k) & 1) == 0 
            ? H_func(pk_seed, tree_adrs, node, sig.auth[k])
            : H_func(pk_seed, tree_adrs, sig.auth[k], node);
    }
    return node;
}

[[nodiscard]] Bytes fors_sk_gen(const Bytes& sk_seed, const Bytes& pk_seed, const Adrs& adrs, int idx) {
    Adrs sk_adrs = adrs.with_type(TYPE_FORS_PRF).with_tree_height(0).with_tree_index(idx);
    return Prf(pk_seed, sk_seed, sk_adrs);
}

[[nodiscard]] Bytes fors_node(const Bytes& sk_seed, const Bytes& pk_seed, int i, int z, const Adrs& adrs) {
    if (z == 0) {
        Bytes sk = fors_sk_gen(sk_seed, pk_seed, adrs, i);
        Adrs leaf_adrs = adrs.with_type(TYPE_FORS_TREE).with_tree_height(0).with_tree_index(i);
        return F(pk_seed, leaf_adrs, sk);
    }
    Bytes left = fors_node(sk_seed, pk_seed, 2 * i, z - 1, adrs);
    Bytes right = fors_node(sk_seed, pk_seed, 2 * i + 1, z - 1, adrs);
    Adrs node_adrs = adrs.with_type(TYPE_FORS_TREE).with_tree_height(z).with_tree_index(i);
    return H_func(pk_seed, node_adrs, left, right);
}

struct ForsSig { 
    std::vector<Bytes> sks; 
    std::vector<std::vector<Bytes>> auths; 
};

[[nodiscard]] ForsSig fors_sign(const Bytes& md, const Bytes& sk_seed, const Bytes& pk_seed, const Adrs& adrs) {
    auto indices = base_2b(md, A, K);
    ForsSig sig;
    sig.sks.resize(K);
    sig.auths.resize(K);
    for (int i = 0; i < K; ++i) {
        int idx = indices[i];
        sig.sks[i] = fors_sk_gen(sk_seed, pk_seed, adrs.with_tree_index(i * (1 << A) + idx), idx + i * (1 << A));
        sig.auths[i].resize(A);
        for (int j = 0; j < A; ++j) {
            int s = (idx >> j) ^ 1;
            sig.auths[i][j] = fors_node(sk_seed, pk_seed, i * (1 << (A - j)) + s, j, adrs);
        }
    }
    return sig;
}

[[nodiscard]] Bytes fors_pk_from_sig(const ForsSig& sig, const Bytes& md, const Bytes& pk_seed, const Adrs& adrs) {
    auto indices = base_2b(md, A, K);
    std::vector<Bytes> roots(K);
    for (int i = 0; i < K; ++i) {
        int idx = indices[i];
        Adrs leaf_adrs = adrs.with_type(TYPE_FORS_TREE).with_tree_height(0).with_tree_index(i * (1 << A) + idx);
        Bytes node = F(pk_seed, leaf_adrs, sig.sks[i]);
        for (int j = 0; j < A; ++j) {
            Adrs node_adrs = adrs.with_type(TYPE_FORS_TREE).with_tree_height(j + 1).with_tree_index((i * (1 << (A - j - 1))) + (idx >> (j + 1)));
            node = ((idx >> j) & 1) == 0
                ? H_func(pk_seed, node_adrs, node, sig.auths[i][j])
                : H_func(pk_seed, node_adrs, sig.auths[i][j], node);
        }
        roots[i] = node;
    }
    Adrs pk_adrs = adrs.with_type(TYPE_FORS_ROOTS);
    return Tl(pk_seed, pk_adrs, roots);
}

struct Keypair { 
    Bytes sk; 
    Bytes pk; 
};

struct Signature { 
    Bytes r; 
    ForsSig fors_sig; 
    std::vector<XmssSig> ht_sig; 
};

[[nodiscard]] Keypair key_gen() {
    Bytes sk_seed(N), sk_prf(N), pk_seed(N);
    random_bytes(sk_seed.data(), N);
    random_bytes(sk_prf.data(), N);
    random_bytes(pk_seed.data(), N);
    Adrs adrs;
    adrs = adrs.with_layer(D - 1);
    Bytes pk_root = xmss_node(sk_seed, pk_seed, 0, HP, adrs);
    Bytes sk(SK_SIZE), pk(PK_SIZE);
    std::memcpy(sk.data(), sk_seed.data(), N);
    std::memcpy(sk.data() + N, sk_prf.data(), N);
    std::memcpy(sk.data() + 2 * N, pk_seed.data(), N);
    std::memcpy(sk.data() + 3 * N, pk_root.data(), N);
    std::memcpy(pk.data(), pk_seed.data(), N);
    std::memcpy(pk.data() + N, pk_root.data(), N);
    return {sk, pk};
}

[[nodiscard]] std::string create_address(const Bytes& pk) {
    auto checksum = shake256(pk, 4);
    Bytes full(pk.size() + 4);
    std::memcpy(full.data(), pk.data(), pk.size());
    std::memcpy(full.data() + pk.size(), checksum.data(), 4);
    return "SN" + base58_encode(full);
}

[[nodiscard]] Bytes pk_from_address(std::string_view address) {
    if (address.length() < 3 || address.substr(0, 2) != "SN") return {};
    Bytes decoded = base58_decode(address.substr(2));
    if (decoded.size() < PK_SIZE + 4) return {};
    Bytes pk(decoded.begin(), decoded.begin() + PK_SIZE);
    Bytes stored_checksum(decoded.begin() + PK_SIZE, decoded.end());
    auto computed_checksum = shake256(pk, 4);
    if (!secure_compare(stored_checksum, computed_checksum)) return {};
    return pk;
}

[[nodiscard]] Bytes pk_from_sk(const Bytes& sk) {
    Bytes pk(PK_SIZE);
    std::memcpy(pk.data(), sk.data() + 2 * N, N);
    std::memcpy(pk.data() + N, sk.data() + 3 * N, N);
    return pk;
}

[[nodiscard]] std::string address_from_sk(const Bytes& sk) {
    return create_address(pk_from_sk(sk));
}

[[nodiscard]] Signature sign(const Bytes& m, const Bytes& sk) {
    Bytes sk_seed(sk.begin(), sk.begin() + N);
    Bytes sk_prf(sk.begin() + N, sk.begin() + 2 * N);
    Bytes pk_seed(sk.begin() + 2 * N, sk.begin() + 3 * N);
    Bytes pk_root(sk.begin() + 3 * N, sk.begin() + 4 * N);
    Bytes opt_rand(N);
    random_bytes(opt_rand.data(), N);
    Bytes r = prf_msg(sk_prf, opt_rand, m);
    Bytes digest = h_msg(r, pk_seed, pk_root, m);
    constexpr size_t md_len = (K * A + 7) / 8;
    constexpr size_t idx_tree_len = (H - H / D + 7) / 8;
    constexpr size_t idx_leaf_len = (H / D + 7) / 8;
    Bytes md(digest.begin(), digest.begin() + md_len);
    uint64_t idx_tree = 0;
    for (size_t i = 0; i < idx_tree_len; ++i)
        idx_tree = (idx_tree << 8) | digest[md_len + i];
    uint32_t idx_leaf = 0;
    for (size_t i = 0; i < idx_leaf_len; ++i)
        idx_leaf = (idx_leaf << 8) | digest[md_len + idx_tree_len + i];
    idx_leaf &= (1U << (H / D)) - 1;
    Adrs adrs;
    adrs = adrs.with_tree(idx_tree).with_type(TYPE_FORS_TREE).with_key_pair(idx_leaf);
    ForsSig fors_sig = fors_sign(md, sk_seed, pk_seed, adrs);
    Bytes fors_pk = fors_pk_from_sig(fors_sig, md, pk_seed, adrs);
    std::vector<XmssSig> ht_sig;
    Bytes msg = fors_pk;
    for (int layer = 0; layer < D; ++layer) {
        Adrs layer_adrs;
        layer_adrs = layer_adrs.with_layer(layer).with_tree(idx_tree);
        XmssSig xsig = xmss_sign(msg, sk_seed, idx_leaf, pk_seed, layer_adrs);
        ht_sig.push_back(xsig);
        msg = xmss_pk_from_sig(idx_leaf, xsig, msg, pk_seed, layer_adrs);
        idx_leaf = idx_tree & ((1 << HP) - 1);
        idx_tree >>= HP;
    }
    return {r, fors_sig, ht_sig};
}

[[nodiscard]] bool verify(const Bytes& m, const Signature& sig, std::string_view address) {
    Bytes pk = pk_from_address(address);
    if (pk.empty()) return false;
    Bytes pk_seed(pk.begin(), pk.begin() + N);
    Bytes pk_root(pk.begin() + N, pk.begin() + 2 * N);
    Bytes digest = h_msg(sig.r, pk_seed, pk_root, m);
    constexpr size_t md_len = (K * A + 7) / 8;
    constexpr size_t idx_tree_len = (H - H / D + 7) / 8;
    constexpr size_t idx_leaf_len = (H / D + 7) / 8;
    Bytes md(digest.begin(), digest.begin() + md_len);
    uint64_t idx_tree = 0;
    for (size_t i = 0; i < idx_tree_len; ++i)
        idx_tree = (idx_tree << 8) | digest[md_len + i];
    uint32_t idx_leaf = 0;
    for (size_t i = 0; i < idx_leaf_len; ++i)
        idx_leaf = (idx_leaf << 8) | digest[md_len + idx_tree_len + i];
    idx_leaf &= (1U << (H / D)) - 1;
    Adrs adrs;
    adrs = adrs.with_tree(idx_tree).with_type(TYPE_FORS_TREE).with_key_pair(idx_leaf);
    Bytes fors_pk = fors_pk_from_sig(sig.fors_sig, md, pk_seed, adrs);
    Bytes msg = fors_pk;
    for (int layer = 0; layer < D; ++layer) {
        Adrs layer_adrs;
        layer_adrs = layer_adrs.with_layer(layer).with_tree(idx_tree);
        msg = xmss_pk_from_sig(idx_leaf, sig.ht_sig[layer], msg, pk_seed, layer_adrs);
        idx_leaf = idx_tree & ((1 << HP) - 1);
        idx_tree >>= HP;
    }
    return secure_compare(msg, pk_root);
}

[[nodiscard]] Bytes serialize_sig(const Signature& sig) {
    Bytes result;
    result.reserve(SIG_SIZE);
    result.insert(result.end(), sig.r.begin(), sig.r.end());
    for (int i = 0; i < K; ++i) {
        result.insert(result.end(), sig.fors_sig.sks[i].begin(), sig.fors_sig.sks[i].end());
        for (int j = 0; j < A; ++j)
            result.insert(result.end(), sig.fors_sig.auths[i][j].begin(), sig.fors_sig.auths[i][j].end());
    }
    for (const auto& xsig : sig.ht_sig) {
        for (const auto& ws : xsig.wots_sig)
            result.insert(result.end(), ws.begin(), ws.end());
        for (const auto& auth : xsig.auth)
            result.insert(result.end(), auth.begin(), auth.end());
    }
    return result;
}

[[nodiscard]] Signature deserialize_sig(const Bytes& data) {
    Signature sig;
    size_t off = 0;
    sig.r = Bytes(data.begin() + off, data.begin() + off + N); off += N;
    sig.fors_sig.sks.resize(K);
    sig.fors_sig.auths.resize(K);
    for (int i = 0; i < K; ++i) {
        sig.fors_sig.sks[i] = Bytes(data.begin() + off, data.begin() + off + N); off += N;
        sig.fors_sig.auths[i].resize(A);
        for (int j = 0; j < A; ++j) {
            sig.fors_sig.auths[i][j] = Bytes(data.begin() + off, data.begin() + off + N);
            off += N;
        }
    }
    sig.ht_sig.resize(D);
    for (int layer = 0; layer < D; ++layer) {
        sig.ht_sig[layer].wots_sig.resize(LEN);
        for (int i = 0; i < LEN; ++i) {
            sig.ht_sig[layer].wots_sig[i] = Bytes(data.begin() + off, data.begin() + off + N);
            off += N;
        }
        sig.ht_sig[layer].auth.resize(HP);
        for (int i = 0; i < HP; ++i) {
            sig.ht_sig[layer].auth[i] = Bytes(data.begin() + off, data.begin() + off + N);
            off += N;
        }
    }
    return sig;
}

[[nodiscard]] std::string to_hex(const uint8_t* data, size_t len) {
    std::ostringstream oss;
    for (size_t i = 0; i < len; ++i)
        oss << std::hex << std::setfill('0') << std::setw(2) << static_cast<int>(data[i]);
    return oss.str();
}

[[nodiscard]] std::string to_hex(const Bytes& data) {
    return to_hex(data.data(), data.size());
}

[[nodiscard]] Bytes from_hex(std::string_view hex) {
    Bytes result;
    result.reserve(hex.size() / 2);
    for (size_t i = 0; i + 1 < hex.size(); i += 2) {
        uint8_t byte = 0;
        for (int j = 0; j < 2; ++j) {
            char c = hex[i + j];
            byte <<= 4;
            if (c >= '0' && c <= '9') byte |= (c - '0');
            else if (c >= 'a' && c <= 'f') byte |= (c - 'a' + 10);
            else if (c >= 'A' && c <= 'F') byte |= (c - 'A' + 10);
        }
        result.push_back(byte);
    }
    return result;
}

}

void print_header() {
    std::cout << "\n";
    std::cout << "╔══════════════════════════════════════════════════════════════╗\n";
    std::cout << "║           Quantum-Resistant Bitcoin                          ║\n";
    std::cout << "║           SPHINCS+-SHAKE-256f (SLH-DSA)                      ║\n";
    std::cout << "║           https://bitcoin.foundation                         ║\n";
    std::cout << "╚══════════════════════════════════════════════════════════════╝\n";
}

void print_section(std::string_view title) {
    std::cout << "\n" << std::string(64, '-') << "\n";
    std::cout << title << "\n";
    std::cout << std::string(64, '-') << "\n";
}

int main() {
    print_header();
    std::cout << "\n[1] Generate new keypair\n";
    std::cout << "[2] Recover address from private key\n";
    std::cout << "[3] Sign a message\n";
    std::cout << "[4] Verify a signature\n";
    std::cout << "\nChoice: ";
    int choice;
    std::cin >> choice;
    std::cin.ignore();
    
    if (choice == 1) {
        print_section("Key Generation");
        std::cout << "Generating keypair...\n";
        auto start = std::chrono::high_resolution_clock::now();
        auto [sk, pk] = qrb::key_gen();
        auto end = std::chrono::high_resolution_clock::now();
        auto duration = std::chrono::duration_cast<std::chrono::milliseconds>(end - start).count();
        std::cout << "Done in " << duration << "ms\n";
        std::cout << "\nPrivate Key (SK) - " << qrb::SK_SIZE << " bytes:\n";
        std::cout << "  SK.seed: " << qrb::to_hex(sk.data(), 32) << "\n";
        std::cout << "  SK.prf:  " << qrb::to_hex(sk.data() + 32, 32) << "\n";
        std::cout << "  PK.seed: " << qrb::to_hex(sk.data() + 64, 32) << "\n";
        std::cout << "  PK.root: " << qrb::to_hex(sk.data() + 96, 32) << "\n";
        std::cout << "\nFull Private Key (hex):\n" << qrb::to_hex(sk) << "\n";
        std::cout << "\nPublic Key (PK) - " << qrb::PK_SIZE << " bytes:\n";
        std::cout << "  PK.seed: " << qrb::to_hex(pk.data(), 32) << "\n";
        std::cout << "  PK.root: " << qrb::to_hex(pk.data() + 32, 32) << "\n";
        std::cout << "\nFull Public Key (hex):\n" << qrb::to_hex(pk) << "\n";
        std::string address = qrb::create_address(pk);
        std::cout << "\nSN Address: " << address << "\n";
        std::cout << "Address length: " << address.length() << " chars\n";
    }
    else if (choice == 2) {
        print_section("Address Recovery");
        std::cout << "Enter private key (256 hex chars): ";
        std::string sk_hex;
        std::getline(std::cin, sk_hex);
        if (sk_hex.length() != 256) {
            std::cerr << "Error: Private key must be 256 hex characters (128 bytes)\n";
            return 1;
        }
        qrb::Bytes sk = qrb::from_hex(sk_hex);
        qrb::Bytes pk = qrb::pk_from_sk(sk);
        std::cout << "\nPublic Key (PK) - " << qrb::PK_SIZE << " bytes:\n";
        std::cout << "  PK.seed: " << qrb::to_hex(pk.data(), 32) << "\n";
        std::cout << "  PK.root: " << qrb::to_hex(pk.data() + 32, 32) << "\n";
        std::cout << "\nFull Public Key (hex):\n" << qrb::to_hex(pk) << "\n";
        std::string address = qrb::address_from_sk(sk);
        std::cout << "\nRecovered SN Address: " << address << "\n";
    }
    else if (choice == 3) {
        print_section("Sign Message");
        std::cout << "Enter private key (256 hex chars): ";
        std::string sk_hex;
        std::getline(std::cin, sk_hex);
        if (sk_hex.length() != 256) {
            std::cerr << "Error: Private key must be 256 hex characters (128 bytes)\n";
            return 1;
        }
        qrb::Bytes sk = qrb::from_hex(sk_hex);
        std::cout << "Enter message to sign: ";
        std::string message;
        std::getline(std::cin, message);
        qrb::Bytes msg(message.begin(), message.end());
        std::string address = qrb::address_from_sk(sk);
        std::cout << "\nSigning address: " << address << "\n";
        std::cout << "Signing message...\n";
        auto start = std::chrono::high_resolution_clock::now();
        qrb::Signature sig = qrb::sign(msg, sk);
        auto end = std::chrono::high_resolution_clock::now();
        auto duration = std::chrono::duration_cast<std::chrono::milliseconds>(end - start).count();
        std::cout << "Done in " << duration << "ms\n";
        qrb::Bytes sig_bytes = qrb::serialize_sig(sig);
        std::cout << "\nSignature size: " << sig_bytes.size() << " bytes\n";
        
        fs::path sig_dir = fs::path("signatures") / address;
        fs::create_directories(sig_dir);
        
        auto now = std::chrono::system_clock::now();
        std::time_t now_t = std::chrono::system_clock::to_time_t(now);
        std::tm* utc_tm = std::gmtime(&now_t);
        auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(
            now.time_since_epoch()) % 1000;
        std::ostringstream ts;
        ts << std::put_time(utc_tm, "%Y-%m-%dT%H-%M-%S") 
           << "-" << std::setfill('0') << std::setw(3) << ms.count() << "Z";
        std::string filename = ts.str() + ".txt";
        fs::path sig_path = sig_dir / filename;
        
        std::ofstream sig_file(sig_path);
        sig_file << "Quantum-Resistant Bitcoin Signature\n";
        sig_file << "====================================\n";
        sig_file << "Address: " << address << "\n";
        sig_file << "Message: " << message << "\n";
        sig_file << "Timestamp: " << std::put_time(utc_tm, "%Y-%m-%dT%H:%M:%S") << "." 
                 << std::setfill('0') << std::setw(3) << ms.count() << "Z\n";
        sig_file << "Signature-Size: " << sig_bytes.size() << " bytes\n";
        sig_file << "\n[SIGNATURE]\n";
        sig_file << qrb::to_hex(sig_bytes) << "\n";
        sig_file.close();
        
        std::cout << "\nSignature saved to: " << sig_path.string() << "\n";
    }
    else if (choice == 4) {
        print_section("Verify Signature");
        std::cout << "Enter signature file path: ";
        std::string sig_path;
        std::getline(std::cin, sig_path);
        
        if (!fs::exists(sig_path)) {
            std::cerr << "Error: File not found: " << sig_path << "\n";
            return 1;
        }
        
        std::ifstream sig_file(sig_path);
        std::string line, address, message, sig_hex;
        bool in_signature = false;
        while (std::getline(sig_file, line)) {
            if (line.rfind("Address: ", 0) == 0) {
                address = line.substr(9);
            } else if (line.rfind("Message: ", 0) == 0) {
                message = line.substr(9);
            } else if (line == "[SIGNATURE]") {
                in_signature = true;
            } else if (in_signature && !line.empty()) {
                sig_hex += line;
            }
        }
        sig_file.close();
        
        if (address.empty() || sig_hex.empty()) {
            std::cerr << "Error: Invalid signature file format\n";
            return 1;
        }
        
        std::cout << "\nLoaded from file:\n";
        std::cout << "  Address: " << address << "\n";
        std::cout << "  Message: " << message << "\n";
        std::cout << "  Signature size: " << sig_hex.length() / 2 << " bytes\n";
        
        qrb::Bytes msg(message.begin(), message.end());
        qrb::Bytes sig_bytes = qrb::from_hex(sig_hex);
        qrb::Signature sig = qrb::deserialize_sig(sig_bytes);
        std::cout << "\nVerifying signature...\n";
        auto start = std::chrono::high_resolution_clock::now();
        bool valid = qrb::verify(msg, sig, address);
        auto end = std::chrono::high_resolution_clock::now();
        auto duration = std::chrono::duration_cast<std::chrono::milliseconds>(end - start).count();
        std::cout << "Done in " << duration << "ms\n";
        std::cout << "\nSignature valid: " << (valid ? "TRUE" : "FALSE") << "\n";
        if (valid) {
            std::cout << "Message authenticated for address:\n" << address << "\n";
        }
    }
    else {
        std::cerr << "Invalid choice\n";
        return 1;
    }
    
    print_section("Done");
    return 0;
}

Makefile

CXX = g++
CXXFLAGS = -std=c++17 -O3 -Wall -Wextra
TARGET = quantum-resistant-bitcoin
SOURCE = quantum-resistant-bitcoin.cpp

all: $(TARGET)

$(TARGET): $(SOURCE)
	$(CXX) $(CXXFLAGS) -o $(TARGET) $(SOURCE)

clean:
	rm -f $(TARGET)

run: $(TARGET)
	./$(TARGET)

.PHONY: all clean run