Even with a quantum computer, nobody can work backwards from your keys to your seed words.
The idea: Quantum computers turn public keys into private keys, but they don't reverse hashes efficiently: the best they can do is a square-root speedup on guessing. Your seed sits behind such one-way functions, so even after a quantum attacker computes your private key, the seed stays out of reach. That makes "prove you know the seed" a way to tell the real owner from a thief, which the emergency plan relies on.
Why it matters: This is what the emergency recovery plan relies on.
On the map: PBKDF2 / HMAC-SHA512 can't be inverted to recover a BIP-32 seed (Shor only recovers the key)
The assumption that a wallet's BIP-32 seed can't be recovered from the keys derived from it[1]. Derivation uses HMAC-SHA512, a one-way function, so even a quantum attacker who computes a private key from a public key still can't find the seed: quantum computers only speed up that search quadratically.
The emergency fork plan uses this to let real owners prove ownership with a proof of knowing the seed[2].
If any of these breaks, this breaks too.
If this breaks, these break with it.