One Type of Post-Quantum Cryptography Is Most Popular. Why Is Crypto Trying Out Three?

Transcript

At the end there are like three main option either you don't do anything and if you do that as soon as there is a quantum computer capable of working cryptography uh they will be stolen and that create like a liquidity problem that create the market problem or you have or you freeze them you say that those coins cannot be spent by anyone anymore and in this case that can be seen as like a private property problem like the people that are very strong on this one uh will will be um against this one. And the third option is the same.

And if you do that, you don't have like a 21 million bitcoin anymore, but something like 16 millions or something like this. Or there is a third option which is all the coins that are not migrated, you freeze them, but not only you freeze them, you tail emit them on the consensus for bitcoin. Instead of emitting only 1 million bitcoin until 2,176, you will emit like four to 5 million bitcoin that were not migrated. So there are the three different options.

>> Hi everyone, welcome to Unchained, your no high resource for all things crypto. I'm your host Laura Shin. Thanks for joining this live stream, but quick note, it was pre-recorded just a few hours before. And now we'll take a quick word from the sponsors who make the show possible. This episode is brought to you by 1-in Aqua, the shared liquidity layer from 1 in. Back multiple liquidity positions with one wallet balance and keep your tokens in your wallet until a swap fills. See how it works at 1in.com/aqua. Today's topic is preparing crypto to become quantum resistant. Here to discuss are Ilia po Ilia Poluin co-founder of Near Protocol and Charles

Giam CTO of Ledger. Welcome Ilia and Charles. >> Great to be here. >> Thank you. >> Yeah, excited to chat. So you both have recent news about your respective projects making moves toward becoming quantum safe and you both have to like obviously approach it from different directions. Charles from a hardware angle, Aaliyah from the chain angle. um which I'm guessing is probably more software related. Uh before we get like into the nitty-gritty of everything that's going on, I think on my show the last time we talked about quantum issues was a few months ago. And I know obviously this space changes pretty quickly. So, I would just love to hear you guys kind of give an assessment of

where the crypto industry is in terms of its work on, you know, making all of crypto quantum resistant, especially because, as people are probably well aware, you know, last fall there was a lot of um criticism and concern going around about Bitcoin in particular not being ready in time. So, you know, I'd love to hear just kind of like what updates you have generally across all of crypto as well as like even updates on the timeline that we're looking at. So, Ilia, do you want to start? >> Sure. Yeah, I think we've had um quite a few updates over past eight months in in the crypto space. Uh it started with

kind of acceleration of the quantum computing technology as well as algorithmic improvements on uh effectively recovering private keys out of public keys for uh for the cryptography. And so that was a big moment I think it was like um and April uh when there was a paper March April when the paper out of Google came out uh where they didn't even present the algorithm they were so kind of concerned with the was this that they presented zero knowledge proof that algorithm >> this was the last time we covered that on the show. Yeah.

>> Yeah. The interesting thing since then happened that I enlayer launched a competition uh for everybody's AI to compete and to find that algorithm and they effectively found it and beat it within I think 48 hours. Uh and since then it's been running kind of continuously improving. So what this means is really the like historically the the schnore algorithm uh which kind of this like dmicless uh sword over cryptography uh usually it was like very far in advance requires a lot of computing power uh from quantum computer that can was keep coming closer and closer while

obviously the quantum computing continuously progress um now we still don't have like a clear date right I think Charles I'll cite him as like you know for past 20 years everybody said it's going to be in five years. Um and so uh I think we're still kind of in in in similarish point but at the same time this five years feel like very different because there's so much investment there's so much um kind of interest and we just have way better tools right with AI now to do material science to do this kind of physics uh that required and so I think like generally it feels a lot more field than ever before. And so I think

everybody's starting to take it seriously. I think there's a lot more conversation happening. Uh there's now uh kind of a lot of uh research and specifically there has been already cryptography that is kind of approved to be used uh for postquantum and the challenge for blockchain has been that it's usually pretty slow and pretty big, right? And so kind of how do we deal with that has been a question. Uh now there is a lot of conversation that's why I mean we want to be here but specifically maybe like from our side um a couple of months ago we actually went to mainet with the first uh postquantum uh signature support uh allowing users

to now hold assets on near with postquantum secure key. Right. So this is as far as I know first time you are able to do that on major blockchain and this enables effectively all the tooling and ecosystem to start supporting that because it takes actually time from the blockchain support to effectively propagate across across the whole ecosystem and we were working with Ledger to make sure we actually work on the same signature scheme and on the same tooling so that Ledger uh be the first hardware support as well uh for this Okay. So, Charles, do you want to give your assessment on where crypto is at?

>> Yeah. No, I I completely agree with uh what Ilia just just said. I I think the first event that put uh like postcon migration in front and center of everything was uh the NIST's uh like a recommendation and mandate uh to migrate towards postcon cryptography and that was in 2024 and at the time uh the main reaction was okay we will migrate at some point but there is nothing urgent because uh we are nowhere close to build a cotton computer. So that was really the case and um as Ilia just said in the past few months especially with Google breakthrough uh in late March uh the

conversation really changed uh because we are we have like two things that are happening at at the same time. On one side uh we can see progress into um the building of an actual quantum computer. Uh now we have like plenty of uh potential technologies uh that could create quantum computer with several stable cubits. Um and the investment has been multiplied by 10 in the in the in the past few years. So now we can see more and more progress in this area. I think we are still far from uh having like a quum computer with enough cubit but we can see progress. And on the

other side like the algorithm running on on top of this quantum computer which is a shor algorithm that I just mentioned um was improved like the complexity of this algorithm the number of cubit required just dramatic dramatically dropped with um Google uh research and also with the recent layer contest and all of this is also accelerated by AI. AI is a very very powerful tool uh when it comes to doing research um and especially when you have like something that is very systematic such as like improving the complexity of um a short algorithm. So this is where we are um

and I feel the discussion um like really changed recently and now we are I I really hear very less people saying uh that's not a threat we will see later. uh and and so on. Um and um and now we I the conversation are more about like how do we migrate and and this is the this is the big uh the the big challenge now um because at the end we don't really care when the the the next the the quantum computer will happen. We are using cryptography in order to create trust into uh the security of our systems. As soon as this is eroded then we need we need to upgrade. Uh for the

rest of the world you have like two main issue like for non-blockchain application. Uh you have like the encryption schemes that are uh that are uh threatened by uh quantum computer and the problem is that an attacker today could simply g collect all the data in order to be able to decrypt it later. So this is the harvest now decipl. And this is a big problem because the longer we you wait the bigger your time window is uh is open for future decryption. Um in blockchain the blockchain world this uh this problem does not really exist because there is no no real encryption in in in blockchain. So the problem is mostly for signatures um and when it

comes to signatures then you just need to be ready before the quantum computer to to be ready. So this is where we are. Um and in the blockchain world, so technically speaking, I would say that it's a little bit easier that for the rest of the world. But what is complex is really more to create the social consensus like what the algorithm that we are going to use and the postcon algorithm uh that are standardized by the we have several of them and they come with drawbacks compared to the current cryptography that we use. like for instance signatures are bigger requires more compute in order to um to be computed. Um so there are some

drawbacks. So we need to choose the algorithm we need to um figure out what are the impacts on the blockchain like do do we need to change the the size of the blocks? Does it impact the throughput of the blockchain? Like this kind of thing must be settled. And finally, what's the migration path? Because u we need a user to sign transaction in order to move their coins from uh like a precontinum address to a postcontum address. So every single user will need to do this signature. So that means that blockchain will uh have to decide for a time frame for this migration and then the ultimate question is like at the end of this time frame

what do we do with the coins that were not migrated like do we let them on the chain and maybe in the future an attacker would will be able to uh to to steal them or do we freeze them like there are there are a few different options there they all come with drawbacks obviously But those are the kind of um decisions that must be taken at the blockchain level. >> Yeah, I had Matt Carallo, one of the Bitcoin core devs on my show. Um I think it was in the winter and I'm just going to be totally honest and say I was not impressed by his answers actually. Um he said things to me like that the Bitcoin

community at that time would decide on some of the questions I was asking him and I was like okay well then you've already lost at that point. Um but anyway it it's good to hear that like you know at least other groups are also getting uh more active and I think like you know at least some sectors of Bitcoin are as well. Um but we're gonna so let's let's focus now on you know specific things that you guys are doing and then we'll zoom out again to the wider crypto community. Um but why don't we start with Near. So first of all I as far as I understand I guess Near has a little bit of a head start compared to other chains just because its design is actually something that's less

susceptible to quantum computing. So why don't you explain that and then go into what the main problems are that Near is facing with quantum. >> For sure. So the biggest design decision was when when we just were starting building Near was realizing that we cannot limit ourselves to a single cryptography. uh Bitcoin, Ethereum, Salana, they all effectively bake in cryptography into how your address on blockchain uh maps to kind of your private key. And on near we made a decision that your account will be effectively

an account like kind of how you have Google account or Apple account and then you'll have different ways of accessing it uh so called access keys and this access keys can use different cryptography or you know we now support logging in with telegram and Google and whatever but specifically with cryptography we left it kind of as an option right so we from launch supported both the ECDSA and EDDDSA so this two different options that for example Ethereum Salana use two different cryptography underneath and we made it very easy to add a new one because we kind of looked forward into this you know in five years uh quantum computer will be there uh 10 years ago and so we kind of left it as an option and so as

the NIST standization happened and kind of this wave of like hey actually this is important now the timeline is shrinking Um for us it was very easy to add a a cryptography or for that matter we can actually add any number of uh cryptographic curve support. Um, and so we've done it. We we tested it. We rolled it out. And importantly, uh, as Charles mentioned, the social consensus part. And so that's why we doing this conversation and and and actually going to be doing more, uh, because we now need to get the ecosystem to on board to use the same cryptography and have the same support of tooling. Now importantly

this is only support for the signing for the user right so this is accessing your account now I think that's the most important part because this is what takes time to actually migrate users the tooling like it's all the external you know the custodians the wallets exchanges all of them need to actually add this support and so that's that's where kind of the most of the social consensus needs to happen and actual like integration develop velment there is still other parts which is specifically consensus that we still use kind of uh traditional cryptography uh EDSA specifically because that's where you need the most performance and kind of the you have the uh most over kind of

networking overhead uh trade-off and so ideally we still need a cryptography that can be faster cheaper and smaller and that's generally I think the whole uh research community is looking for how do we actually enable you know if we have 600 millisecond blocks if we have 200 millisecond blocks which we're targeting uh in incoming year how do we actually en ensure that we can sign we can verify all of this in time you know given right now the postquantum cryptography is uh kind of larger near is also unique because we're actually sitting across all of the other chains as well we with our near intense we connected to you know 35 five plus

chains and so we're actually holding assets on those chains. So we need them to be postquantum secure as well so that we can actually provide the same service to our users and so that's partially also why we want to make sure that other uh chains are also uh kind of working in the same cryptographic schemes as well uh and you know want to kind of uh push the social consensus forward. So for us, it's not just near blockchain. It's also like how do we get the whole ecosystem to transition to this and actually be able to secure this across everyone.

>> Yeah, in a way it's it's interesting because that makes near more similar to ledger that you have to u make sure all these other chains are secure as well. Um, so in a moment we're going to talk a little bit more about what Near is doing to work on the quantum issue, but first we're going to take a quick word from the sponsors who make the show possible. $540 million. That's how much concentrated liquidity sat idle in a given week in the first half of this year. About 30% of the DeFi TVL if you're wondering. That's according to Dune Research commissioned by 1 in. But there's a solution. 1-in Aqua is the new shared liquidity platform. It lets LPS back multiple positions with the same

token balance and keep their tokens in their wallet till a swap comes. Why does that help? Because LPS don't have to split their tokens across positions. They can cover more market conditions and pairs with their full balance. That means more activity across deeper liquidity. See how it works at 1in.com/ aqua. Remember that providing liquidity carries risk and fees aren't guaranteed. back to my conversation with Ilia and Charles. So, um, Ilia, you, you know, talked a little bit about the problems you're facing. So, now talk us through the different solutions that you have, um, identified, including even, uh, like I know that you're you're working on something with your test net even that

was announced earlier today. So, go ahead and talk us through what you're working on. >> For sure. Yeah. So overall we focusing on kind of building building this tooling and making sure that the cryptography is there um to to enable this right and so the first one was as I said like how do we enable users to have access to this keys and and enable it enable them to access effectively with quantum keys uh their accounts and So the kind of the next step is how do we actually um go beyond that and

enable uh more broader support and then kind of from there we'll be securing the consensus the and and kind of this crosschain stuff. So the the big work is like what that today it um we're working with safe horn and a few other folks to test out the multi-party computation. So this is what enables the um custodians as well as actually Neo intense kind of the core technology uh to hold assets across different chains in a way that there's no single party right there's no single computer that has access to the full uh cryptography and there hasn't been a postquantum kind

of cryptography for that yet uh kind of in production and so this is kind of the first pilot to to start building this out. Again, importantly, and and this is where, you know, maybe Charles can also uh dive into more like there's a difference between different types of cryptography. Uh there's so-called um latisbased and hashbased and there's a little bit of a debate right now in the in the uh kind of web three space, what should be used and different trade-offs. So the important part has been how do we bring not just signing but the whole ecosystem forward to support uh postquantum cryptography. uh importantly

people are used to signing kind of wizard wallet which is a traditional way but if we go to more institutional adoption people use multi-party computation uh so-called MPC this is also what backs near intense and kind of a lot of the uh crosschain work that near is doing and so today we have uh kind of announcement that we have a consortium that can be testing multi-party computation across custodians banks, regulators to um actually showcase how this is going to work going forward in production for this like real institutional use cases.

Now, importantly the there's a difference between which cryptography to use. So there's two diff two different kind of approaches. One is latisbased and one is hashbased and Charles can kind of expand more on that. But this is right now a debate in in the blockchain space. And this is where kind of we need the social consensus to effectively uh for the whole web 3 to work together in a reasonable way because uh hashbased are actually very hard to support by kind of hardware wallets. This multi-party computation solutions and so it's kind of for us important that there's a cons consensus on on the ladders based uh for that. And

so we want to show we want to be kind of ahead of ahead of the curve and showcase how all of the tools are working and bring it to both kind of you know individual users as well as institutional usage uh across the board. Uh because that enables we think you know both security and and also like trust in in the blockchain right we've seen we've seen that plummet uh a bit uh when this kind of postqu quantum computers started just coming out uh kind of as you said late last year beginning this year. So, yeah. So, let's talk about this for, you know, for a second because obviously Ethereum, at least for now, is going down the hashbased route. So, like, and they're they're kind of like, you know, at least one of the elephants in the room. So,

um, yeah, I'm just curious. It seems like you you're you, if I understood you correctly, you want to try to sway the cryptic community to go with Latispace, which both of you have done. Um but it feels like if Ethereum is already going down one road then then then certainly some huge segment of the community will as well. Am I right or talk about that for for a bit? >> Yeah I can I can chime in on on on this one. So you you have like three different algorithm that are standardized by the NIST. Two of them are that is based. So you have the Palon and MLGSA and you have a last one that is called Sphinx that is hashbased. So uh those are the three choices that the

community has. Um like the rest of the world nonblockchain world they will all use MLGSA like there is no debate uh anywhere they will all use MLGSA mostly for performance reason and also because it's um like it's more convenient you can do MPC like that there are plenty of benefits uh from using MLGs. When it comes to blockchain, uh there is no real consensus across the different community. Um today we have like two big blockchains that are using MLGSA which are uh algorand and um and the near uh and MLGSA comes with plenty of benefits.

Uh the the size of the signatures is uh smaller. Um also you can do multi-party computation cryptographically. Um this is what Ilia was mentioning and this is most likely the only algorithm that will uh enable u multi-party computation. However, it it might be important to state that it's a very new uh research like the possibility to do MPC on MLGSA is very new and it needs to uh pass the test of time uh let's say. Um and then you have like hashbased hashbased cryptography which is uh which seems to be preferred uh by the etherum community and and also by the bitcoin community

and for them uh the main reason uh to go towards um hashb signature is that it's a little bit more conservative uh in terms of uh security like a hash uh hashbased and hash in generals are studied for for a very long time and they are in production for a very long time not for signatures but for doing hash in general. When it comes to latisbased cryptography uh this is not a very new technology like the the first discovery I think that that was 30 maybe 40 years ago. So it's quite old technology but it was never in production before now and now we are putting it in production. So

there is a little uh less uh trust uh into this uh there's security assumption and with AI some people are like we should be more conservatist we should like observe more conservatism be more conservative because we don't know what we don't know AI could find vulnerabilities here and there and um and this is the reason why uh on the Bitcoin community and also on the on the Etherum community they are more leaning towards hashbased cryptography. The the algorithm that is standardized by Denis is called is called Sphinx but it's just very uh bad to implement it because it produced very

very large signatures. Uh it cost a lot to uh to compute them. It cost a lot to verify them. So that's why they they won't use the Sphanx as it is like so they will use like different variation different parameters of hashbased signatures in order to uh to make it secure enough uh to make sure that the the signatures are not too big and so on and so on. But it often comes with different the drawbacks. Uh so sometimes they are uh stateful. So doing stateful signatures is not very um uh like convenient because that means that you the wallet needs to remind to record like the state of the signer in order to

be able to sign further signatures. Also there is a possibility to um to restrict the number of signatures that you can do with a specific keys. Uh so this is another parame parameter that you can do. So this is what the Etherum foundation and the Bitcoin community are working on today trying to find the right permit parameters for hashbased cryptography uh so that you have like a decent level of security not too large signatures. There will be they will still be large but not too large. Um and um and also they would like to uh to implement u MPC on top of hashbased signatures but it's very unlikely this

to be uh possible. So this is what we have and you finally have Solena foundation and for them like the the main um the the main focus is to have a very very uh quick uh blockchain so limit latency. So they will choose the the the shortest signatures so that it um it doesn't impact too much the latency of Salana and in the in this case uh they will have to use palcon the third one. So in the in the ego system we will have the third the three signatures. So us as a wallet we will have to support all of them. There is no there is no real debate. uh we will have

to to support all of them with with the different constraint that we have on a hardware wallet like hardware wallet are using like secure element and this technology is mostly designed for banking application for identity applications um and the current version of secure element that we use uh like they don't support like at the hardware level uh the signatures because they were not designed for it the good thing is that we can create a VMware that that is supporting them. Um it's not completely ideal. You don't benefit from every single feature of the sector element but it allows to assign uh transaction on near for instance. So to today we are supporting MLGSA uh at the

at the firmware level in order to uh to be able to sign um MLGsa signature for NIA and we're going to do the same for other blockchain and other protocol. uh but in the next generation secure element and next generation uh hardware wallet we will have like this capacity at the hardware level uh making the implementation and the support of this algorithm like easier faster with more security guarantees. So this is this is where we are and as Dia said it really requires a lot of coordination because sometimes I'm asked like when the ledger is secure against against quantum computer and this sentence doesn't really make sense as as a standalone

because we can support every single postquantum algorithm if Bitcoin is not postquantum ready like we don't we don't protect our users against a quantum computer. So this is really like a an overall community effort. Um on on the ledger side we are going to provide all the primitives to the developers uh so that they can uh support uh their blockchain. But the blockchain also need to uh upgrade. The same comes with custodians and comes with with everyone in the ecosystem.

Again we need to agree on what are the algorithm what is the timeline what's the what does mean for the for the chain and then create this migration path and and also give an answer to the question what do what do you do with the coins that are not migrated which is an important question >> okay yeah we'll cover that in a second um I actually just realized while you were speaking when you talked about how Ledger will have to deal with all the different uh solutions that that these chains have near is actually facing the same situation because um so they already have this feature that allows users to secure assets in a postquantum fashion on 30 plus other chains. So I

find that super interesting. Um I don't know if you want to explain how that works and just like your general philosophy about you know what Charles talked about about like trying to support all these different postquantum uh solutions. >> Yeah. So for us through a near account you can hold assets on other chains right so this is near network uh and specifically multi multi-party computation network of near effectively is able to hold and sign on other blockchains and so because of this you know if you go to a near.com account you can have bitcoin you can have ethereum you can have salana you can have you know tron etc all in one place and then you can secure all that with single ledger and so because of this if your

near account is secure with postquantum. Now effectively all the assets there are secure with an asterisk that effectively as those blockchain migrate effectively the near blockchain will migrate all those assets into postquantum uh kind of account on those chains. So that's kind of the idea. So instead of you as individual user needing to monitor when the blockchains will uh upgrade, what they're going to use, how to how to change that. through near you can effectively abstract all that work and already now kind of you know put it on a seed phrase you know dig it in a hole forget about it for whatever a decade and know that you know all these assets

as as things evolve going to continue to be there now from our perspective as developers as Charles mentioned because we need to support all of these different options uh we want to make sure that there's some standardization in the web 3 and like the the less options and and the more uni uniform this options obviously the better and there's specific requirements right with multi-party computation that's uh you know make it harder and harder to be uh used so like depending on parameters that uh that people will choose so to to your point yes like we you know in theory we can support everything but like it's important like it I think it's important for the ecosystem to converge

to you know fewer options uh because then you kind of have like you have you have just also network effect of the ecosystem supporting looking at the same cryptography looking at the same uh systems looking at the same code and making sure it's all secure right we've seen you know yeah >> yeah and and again like this discussion does not happen anywhere anywhere else like only in the blockchain world where in defense in banking in TLS they all use the same algorithm which is MLGSA for the blockchain world. This is where this discussion is happening. Um and this is this is a this is quite weird to to to see that uh because

like you have like a brilliant cryptographer like the full world of cryptographer and security researcher uh is has settled for MLGSA and when it comes to uh the blockchain world you have like different people with different opinions and and uh and this is where there's discussion happen. So maybe they are right at the end. We will see in in the near future in maybe maybe never hopefully. Um but this is this is quite weird to to see that. >> And and why do you think that is? >> Um I so I think this is really to be overly conservative. Um some some people think there is uh there was a small risk that in the near future uh latisbased

cryptography could be uh like weakened by AI mostly or by cryp analysis in in general and in order to avoid taking this risk uh they they would tend towards um uh hashbased cryptography and when it comes to Solana for instance they they are like they are not conservative a conservative as conservative as the etherum guys and so on they don't really care about MLGSA being the standard they only care about latency so they are choosing uh falcon but you have like plenty of application in the world where latency is very important however they don't choose falcon so this is really um we have to

see how fragmented our ecosystem is uh but also um one possible explanation is that every single uh blockchain um is competing against each other and um and having like something different to propose to the users can be a competitive advantage as well. >> Yeah, that's exactly what I was thinking that the reason that there's these differences is because people are competing. Um so Charles, now let's talk about um ledgers approaches to um you know facing this quantum threat. Um I know that you actually also have two new algorithms in your SDK to address that.

So do you want to first talk about the problems that you had to solve on the ledger side and then these two solutions and how they work? >> Yeah, sure. Uh so at leger we are we are using cryptography mostly for two different things. Um on one side we are using cryptography uh for like ledger security in order to maintain the whole security of ledger devices make sure that the devices are genuine can securely connect with ledger infrastructure. So all of this is using like cryptography by ledger for ledger let's say and on the other side uh we have our users that are using cryptography in order to sign

uh blockchain transaction. So these are the two main use for cryptography. Um on our case we are using on the case the first one we are using um we can use the cryptography we want because we must be compatible with ourselves and that's it. We don't have any external requirement. So what we are doing is using like the same standard that the rest of the tech the rest of the world. So we are using MLGSA for like doing authentication and signatures and this kind of thing. Um and we are using MLKM which is the encryption standard that is standardized by by Dist for encryption. There is less um less questions about which algorithm

to use. So the are the two algorithm that we just released. Uh we are using them internally for like ledger security and ledger cryptography. Um and also we are offering them um as cryptographic primitives uh at the SDK level. So meaning that um so because Ledger is a security platform we have an operating system and anyone can build his own application on top of this operating system and the operating system is offering a set of cryptographic API in order to do encryption in order to do authentication signatures hashes like every single um cryptographic primitives. Uh this allows um Ilia

Ilia's team to build the support for near within uh the operating system with the near application and same with Bitcoin, same with Etherum and same with like nonblockchain related application such as password management, the SSH support like all of this pass keys like all of this is also supported by the operating system. You just have to build the app that will support your own application. And now what we have to do uh is really to support all the primitives uh because as I said uh in the blockchain world depending on the blockchain they will use different primitives uh so we will have to implement all of them part of the operating system. So we we have started

with um MLGSA which is used uh by near. So this is the this is the first one that allows to sign postcontum transaction um with secure device with ledger secure device. So this is a first in the world let's say um and and then we will support the uh other algorithm uh with some uh some things to have in mind. Uh we will support all of them on our current devices. Um but as I said the secure element was not designed for postcon cryptography. Uh so we will have to support it at the firmware level meaning that the performance will be a little bit lower like the signature will won't

be crazy fast. Uh also you cannot benefit from um the security properties that are provided by the secure element. Uh so you you still have a high level of security. The key remains in the secure element. the cryptography is implemented inside and so on, but you don't benefit from like the the secure element properties. And for the next generation ledger devices, we will have the the last generation secure element and we will have the support at the hardware level inside the secure element. So meaning it will be possible to sign MLDSA signature uh very quickly with high performance, higher level of security and so on. Um that will be also the case for hashbased signature. Uh so

we will have like a better support of hashbased signature at the hardware level. Um it it will still produce very large signature that that will take time and so on that that will be faster than than what we can do uh today with the current secure element. And for the last one for falcon that is used for Solana. Unfortunately this uh signature won't be supported at the hardware level. So we will have to implement it at the firmware uh meaning that it will be a little bit slower and so on uh and uh but we will support them. So this is really uh where we are and what's the plan. Um and at the end the idea for ledger is to be ready before the

blockchain migrates and uh and this is uh this this will be the case >> and so something I need to understand is um you know because the device is small but these algorithms can create keys and signatures that are quite a bit larger. Um how how did you manage to make that work? Um so inside the secure element you can see it as a very small computer uh with some flash with some RAM uh with with some with a CPU um with um with crypto accelerator.

So this is really what what it is. Um it's it's quite minimal. uh it has it doesn't have a lot of flash doesn't have a lot of RAM but it's on purpose because the idea is not to build your the full application within the secure element but only the security part the cryptographic part so this is really uh uh what is the secure element but uh it's it is extensible um because we can build our own operating system that is loaded in the secure um so when we have to support MLGSA what we are going to do u on the current secure elements is to simply um implement at the firmware level the primitive of MLGS and you have like the small CPU that is using the RAM

and the flash and everything uh to to make it happen. It it requires some optimization uh because all the all because of all the constraints in terms of uh RAM size mostly um and um and the computation time. So we need to optimize a little bit but at the end we we proved that it's possible to do it for hashb signatures uh the sphinx plug like the biggest one the the performance are very are really terrible but hopefully like no one will use like sphinx which is like the the most complicated hashbased signature standard they will use like um smaller version of it.

>> Okay. And then I wanted to just ask one last question about um something I noted in uh one of your blog posts where you talked about like the current version of of this quantum resistant algorithm doesn't protect against physical attacks which appear to be something like with the the signing. So like explain what what you mean by that because I don't think you meant wrench attack. It was like like a virtual version of that. Yeah. So explain what that means. Well, when when we talk about like a physical attacks is the idea like um I'm a thief.

I'm I break into your home. I steal your ledger device and I would like to try to extract the keys from the GM. So this is really like the kind of attacks that we want uh to mitigate and this is one of the reason why we are using secure element because it's extremely difficult to extract the keys from a from a secure element which is not the case if you don't use a secure element like some other hardware wallet don't use a secure element making this kind of attack possible let's say and and easier um and we are using s element in order to avoid uh this kind of um threat uh so this is really what uh what we mean uh by uh like physical attacks. Um and

when you when when you are using like MLGSA on the on ledger signer like you benefit from uh some of the uh counter measure of the secure element but not all of them uh because you don't have like this hardware accelerator but in practice for um for someone who would like to extract the keys from the sec element it doesn't change much it's still very very difficult like this is really the reason why we are using uh secure elements. Does it make sense? >> Yeah. Yeah. So I now have a question for both of you. um because you know so we already talked about the challenges of just dealing with multiple chains and how they're you know you know coming up with different solutions all those

things but then I also imagine that um they're all working on different timelines and when it gets close to uh you know when it seems more likely that actually quantum computing could be a reality there could be um you know these people that are privately harvesting uh some you uh like like an attack basically. I forget what what what the phrase is that they're I guess they're harvesting seed phrases or something in order to >> just ju just just to shan on this one.

So the harvest now and decrypt later applies for the rest of the internet because like you can capture the traffic of the internet and decrypt it later but it doesn't apply for blockchain because this threat doesn't exist for blockchain because on blockchain we don't really use like symmetric encryption. Oh. Oh, okay. Okay. >> So, so there's few things where where uh this might be referring to. One is the addresses on Ethereum are are a hash of a public key. So there is actually and it's like and it's like truncated. So there's not always visible public key available on Ethereum. And so there's a little bit of

a challenge around that. But yeah, there is ways to effectively get the public key in most cases. And so like I think that may be referring to collecting those public keys. >> Yeah. And and about that, I'd like to just mention something because sometimes I hear this argument saying that if your public key is not on chain, then an attacker cannot compute your private key with your public key with a quantum computer. And theoretically this is true. The thing is a public key is not meant to be private. It's public. It's maybe it's not onchain but it's public.

So that means that it it is many different back end, many different logs, many different so you cannot assume that your public key is not known by the hacker. That would be that would be a terrible idea because sometimes I hear that only like I don't know five millions of bitcoin are vulnerable because their public key is on chain. This is a very bad argument. All the public key that are related to bitcoins are somewhere in the world and they are not assumed to be private. So they they should be um like treated as vulnerable as well.

>> Yeah. And then maybe to use a specific most of the cases you send this public key to RPCs and to other like services and that networking traffic right now is encrypted with a vulnerable cryptography. So if anyone is you know doing this collect now decrypt later effectively collecting traffic to RPC endpoints is a way to actually get a lot of this information out later when they're able to. >> That's a good >> okay so so then I'm wondering um and actually maybe it matters more for ledger. I'm not I'm not sure. uh you tell me. But so okay, so let's say we're you know like four years out from now or

five years or or whatever and um there is this possibility of this attack actually happening in the background that nobody knows about. You know both of you are um leading companies that are uh you know kind of dealing with multiple different chains that have multiple different solutions to face the quantum thread. and you have to support all of them. Like what would it take for you to say we're no longer going to support this chain or you know like like we believe the danger is to or or would you not do that or like how I I'm just trying to fast forward to think ahead to what different problems might surface at

that time and like what you think would be the best way to deal with those >> too. So to to this specific point like I would say that if like for instance let's say you have coins on a blockchain A that is not postconum resistant uh and coins on the blockchain b that is postconum resistant. Um, as long as uh the fact that a that data didn't migrate doesn't affect the security of the other coins, I would say that we would continue to support both of them and it's up to the user to decide if he wants to continue to hold this vulnerable coin. I I think that would be

the the decision that we would follow because at at the end this is like at least of crypto like you as a user if you prefer like holding Bitcoin, Ethereum on or near it's up to you like on on our side we will secure the three of them um as long as like holding one doesn't affect the security of the others. I I I I think that would be the the idea. Ilia.

>> Yeah, I mean on our side it's it's a bit more uh complicated because we're allowing to trade between these different assets and so obviously assuming you know there's like not a very like not even low but like reasonable probability that one of the chains is compromised then people can you know trade off stolen coins into something that is postquantum. And so this will affect kind of the overall balance. And uh for context, we're already doing a lot not not even with postquantum hacks effectively, but with regular hacks, right? We're doing a lot of anomaly detection scanning to effectively prevent stolen uh crypto from traveling across chains, right?

because uh we we're kind of constantly under attack by uh everyone from North Korea to h to regular hackers trying to uh launder money and so generally we we are trying to kind of prevent and stop crosschain crime as part of this and so uh yeah for us it will be a little bit different decision- making uh that's why we kind of trying to be really ahead and and kind of be the proponents get synthesization make it easy for everyone if you you know if there's already APIs there's already support if there's already kind of drop in replacement um at least adding that support and then uh as an optionality and then kind of

through through that you can drive people to actually uh to actually uh migrate. I think the the the real question goes back. Yeah. What what happens like at what time and what conditions do you say like cool we we kind of just need to burn whatever is not migrated right uh I I would note that there is one cryptographic approach where if you can zero have a zero knowledge proof that you have a seed phrase for a particular private key which you you cannot presumably uh recover just through quantum computing from public key and So that right now seems like a default people want to use as a kind of

when you know you turn turn off the de like default private key support but if you have a zero knowledge proof that you have a seed phrase you are still able to use your uh uh account >> but it doesn't work for Satoshi coins for instance. >> Yeah. So a lot of the early day uh we didn't have a seed phrase like it didn't exist right bip bip 38 is like not you know not bip one um but yeah like it and and obviously a lot of people may have lost it or didn't didn't have it but um at least like that is a escape hatch I think that that ecosystem also converging >> and and that's for bitcoin or or just >> it works for everything okay

>> for any chain yeah because like the link between your 24 words and your private keys cannot be broken by a content computer. What what can be broken is only the link between your public key and your private key. Uh and if the attacker is able to uh to to compute your private key, he can like spend your coins. Uh and he doesn't need the private key the the 24 to spend your coins. So this is really how it works. >> Okay. Okay. So, let's actually now talk about this issue with Satoshi's coins because to to my mind that is easily like quite possibly the biggest uh issue. I mean, well, yeah, it's hard to say. It's hard to say this the social consensus issue is obviously also huge

for Bitcoin, but you know, I'm curious to hear your opinion. You know, I heard Charles what you uh proposed to do on another podcast, but um actually, so why don't we start? We'll start with what you think should be done with Satoshi's coins and then we'll go to Ilia and he'll explain what he thinks Bitcoin should do about Satoshi's coins. But yeah, that to me is a really interesting problem. >> Yeah. Yeah, it is definitely. So at the end there are like three main option. either you don't do anything and if you do that as soon as there is a quantum computer capable of working cryptography they will be stolen and that create like a liquidity problem that create the market problem um and so on or you have or you freeze them you say that there's

coins cannot be uh cannot be spent by anyone anymore. Um and in this case that can be seen as like a private property problem like the people that are very uh strong on this one uh will will be um against this one. And the third option is the same and if you do that you don't have like a 21 million bitcoin anymore but something like 16 millions or something like this. Uh or there is a third option which is um all the coins that have not migrated uh you you freeze them but not only you freeze them you tail emit them uh on the consensus for bitcoin. So instead of um tail instead

of emitting only 1 million bitcoin until 2,176 uh you will uh you will emit like four to five million bitcoin um that that were that were not migrated. So there are the three different options. They they are all bad because um because the first one is bad for the market the and the second one the third one is bad for the uh uh private property uh private property um thing um but I would tend to prefer the last one uh because um because first of all like we cannot I I I'm not sure we can afford an attacker

to put on the market millions of bitcoin that would that would simply destroy the project. Um and and also if you tail limit them uh it also helps uh solving the security budget uh discussion uh that sometimes people is think it's not a problem but on the long run if you don't do anything you um you might have an issue uh for having enough money to uh reward the miners that are securing the chain. So uh choosing the third option uh is also uh helping solving this uh this last problem. But I know plenty of plenty of people disagree

with me. I don't have a very strong opinion. I'm just saying that first of all we need to decide we need to settle and I really think the first one is very very dangerous. Even if I'm a big proponent for private property it's very important for me and and so on. However, it creates a too big problem for for for Bitcoin especially. >> Ilia, what do you think? >> Yeah, I mean I agree. A this indeed is probably the biggest issue in general because like even even for other blockchains, the problem obviously if Bitcoin is um get quote unquote attacked in this way, right? uh this will kind of bring

all of the I mean crypto down in the sense that like I mean cryp crypto is built on trust into the technology right like not everyone individually reviewing all the code right it's kind of the the system of trust that like hey a lot of people looked at every layer and uh this trust you know will be will be broken if there is like a massive uh massive effectively uh effectively theft in this format. Uh it's also you know they'll probably sell that bitcoin and so that will be massive as well. So so I think like across the board this is a massive issue for the whole space. um as you said like I ideally they would have a plan and kind

of early on. The challenge is like Bitcoin's government governance right is a very um fluid let's say uh and so like I I don't think they have a way to have a consensus until you know until this is actually like miners making an a proper you know which which binary we select right that that that will be at the end uh state and like they will try to postpone it as as as far as possible right so Uh yeah big >> and there is there is another there is another worst alternative which would be like not doing anything because we don't reach the the social consensus but and and in this case that would be even

worse because I think we might start to see like half forks and so and when the th would be so high uh some people would would start choosing one of the half for so this is also one of the possibility and I I think that would be the worst one. So I really I strongly um like um I I strongly think that we should as a community like settle solution and and implement it as soon as possible and stop discussing too much.

>> Yeah. I mean it's it's like hurting cats. Um, so Ilia, like you know, Charles kind of stated a preference for one of the options, but do you do you think that one is better than another? >> Um, I mean, I think the like freezing is probably like the most likely like I I don't think like remitting is is a a likely a big likelihood. Uh I do agree that like Bitcoin has a security budget problem which is like another problem uh to deal with a bit a bit later. Um so it it is a great solution. I just I

just don't think it's a very likely solution that people will take. >> I agree. >> I agree. >> Yeah. But I'm a third. I think that that would be a good way of killing two birds with one stone. Um I don't know. I mean, yeah, Bitcoin does have a security budget problem. So, I don't know. So, listeners, you you heard it here. Like, like if you agree, make your make your opinion known. The three of us all think that that is actually probably the smartest way to handle it. But yeah, it is going to be controversial.

So, um, okay. Well, why don't we leave it on that note, that controversial note. Um you guys, it's been such a pleasure chatting with you both and it's been super interesting learning about how you're resolving this and um yeah, and you know, thanks for updating us on what's going on in this quantum world because um it's definitely something that we all know is like on the horizon and it's probably going to happen faster than we anticipate. So, um yeah, we appreciate it. Thank you so much.

>> Thank you for having me. Nothing you hear on Unchained is investment advice. This show is forformational and entertainment purposes only, and my guest and I may hold assets discussed on the show. For more disclosures, visit unchainedcrypto.com.