Quantum: An Existential Threat to Crypto?

Transcript

Thank you so much for joining us this afternoon. Um maybe before we get started, we could start off with a round of intros. Uh maybe start from the furthest and then come down. >> All right. Hi. Hi everyone. I'm uh Arthur Brazman. I'm a co-founder and creator of the Tesos protocol. Uh Tesos is a protocol that's started uh in 2014. It's been now 12 years. Uh it's run continuously since 2018, showing lots of resilience and it is focused on uh security uh and staying at the cutting edge through an onchain governance model. Ei ben Sasson.

Um I don't know if you know but a long time ago there used to be this field this occupation that humans did called mathematics. Um I used to do that back in the day. Humans don't do mathematics anymore. That's for machines. So I started my career as a mathematician. Did a lot of research on ZK including postquantum ZK. Um fell in love with Bitcoin in 2013. wrote the white paper on which Zcash is built. Co-founded Zcash, built some postquantum secure ZK called Starks. Uh co-founded Starkware. I'm CEO of that today.

>> Yeah. And I'm Alex. Uh I'm the CEO of Project 11. So Project 11 builds uh postquantum uh key management and signing infrastructure for digital assets. Right. So, we're going to talk about this, but obviously quantum computing is going to have implica implications for cryptography as a whole, but for digital assets in particular around the underlying cryptographic assumptions, and we're the infrastructure layer on top of the protocols that are obviously thinking about uh these upgrades. Um, pleasure to be here. >> Cool. Um, and I'm Ren, engineer, general partner from Electric Capital. Um, I wanted to frame the conversation up a bit, but uh, maybe we should just jump straight into it because I think the industry and the world has reached the point where, uh, quantum is certainly coming. Um, there's a question of when.

Um, but I think most people have this belief now that it is quite soon, like medium-term. Um so with this looming threat um ahead of us um maybe we can start off by diving into what what exactly would quantum break because I think a lot of people have heard a lot about the quantum risk but uh diving a bit one layer deeper like what aspects of the blockchain uh might break what's sensitive >> um all blockchains today use some form of cryptography um cryptography started out with encryption uh prim primarily most blockchains do not use encryption.

What they use instead is signatures. So you need to attest that you know a secret and I am you know the person who knows a secret or control the secrets attest to this message. That's what signatures do. And by and large um almost all blockchain use elliptic curve to do this. And elliptic curves are great. They're fantastic to work with. They let you do all sorts of things. And using classical computers we cannot break their cryptography. It would take an astronomical amount of power. we don't know how to do it. However, uh with quantum computers, we can do that very efficiently. Now, we don't have quantum computers, but if we did have a quantum computer, you can break elliptic curve. The broader picture is like anytime you have something that has this

very strong algebraic group structure like commutive groups that tends to be broken. Not a hard, it's not a hard world, but that tends to be broken by quantum computers. So, they break a whole lot of cryptography, but not all of it. So thankfully lots of cryptography is not susceptible to quantum computers. The quantum computers have a small advantage over a classical computer for for for it but not a big or exponential advantage. Um maybe the way I would I'll take I think that's right. I'll take an maybe a philosophical frame uh is like you know think about blockchains. So what how do blockchains break? I think you're prompt and I would say diff it depends on the blockchain.

Blockchains come in all shapes and sizes right? We have Bitcoin the original. Well, you know, there are blockchains that are defined by zero knowledge proofs and there are blockchains that have smart contracts and all these have slightly different threat models. But I think the thing I would just the way I would frame it is, you know, we kind of distinguish between blockchains based on technical features and decentralization kind of and that can be defined in any number of ways but I think the universal aspect here exactly what Arthur said is that we all use elliptic curve cryptography for signing. And what is signing used for? It's effectively to prove ownership. Right? So the concept of ownership in a postquantum world assuming it's not mitigated kind of ceases to mean anything because like if I have a quantum computer and I'm looking at Bitcoin say you know

Satoshi's coins are my coins and anyone with an exposed public key I can I can prove ownership of and so what does it mean to own something in the dig in in that world and this is why I think this is a very deep problem and and it has a number of things that fall from it. >> Got it. Um anything to add Eli? >> No I mean I I think they explained it very well. So like, >> okay, cool. Um, so now that we have a rough sense of what might break this question of losing ownership, um, big issue, can it be fixed? What are the three of you working on? What are the different approaches that different teams in the industry and outside of the industry um are taking?

>> Yeah, I mean, I can maybe quickly start. Uh, can it be fixed? Absolutely, it can be fixed. In fact, the world has known it's not like so quantum computers have been like, you know, theorized since the 80s. Practical con algorithms for breaking cryptography been known since the '90s. Cryptographers have been thinking about this for the better part of three decades. And so this is not a new thing from the for the field of cryptography. So there's a solution in the form of postquantum cryptography. So postquantum signatures that you could in theory drop in everywhere there's elliptic curve signatures and then everything would be fine. The issue is that the implications of dropping in this new cryptography uh you know kind of it's not exactly a one for one replacement for example uh elliptic curve signatures are very very efficient

they're very small in size for example right and bitcoin effectively transaction throughput you you know people think about okay how many elliptic curve signatures can I fit into a block well now if my potentially a postquantum signature scheme like lattis is maybe 10 times as big let's say as an elliptic a curve scheme. Uh so that's now your your throughput is 10 times smaller all things being equal, right? So you have to either increase the block size by 10 or accept 10x lower throughput potentially, right? And so it's these implic it's the implications of introducing postconum cryptography that I think the challenges start to show up. The one thing you need to do about it and unfortunately not a lot of the big projects are doing

that is take it very seriously and understand that it's a big problem. So, and to me the biggest problem is that Bitcoin isn't approaching it in this manner. There's a sort of sticking the head in the sand kind of mentality. You know, Bitcoin is perfect. So, you know, and in particular, because it's perfect, a quantum computer is never going to threaten it. [laughter] But, um, you know, if you think about something like the year 2000 bug, the reason it didn't cause any harm in the end was because the whole industry, right, would put billions of dollars and thousands of uh maybe hundreds of thousands of engineer years into addressing the problem. So the number one thing that needs to be

done is to say, "Holy you know, Houston, we have a problem." Um, once that is said, it's easier to to move on. And I want to stress this point. There's uh, you know, the known unknown, which is will a quantum computer break cryptography soon? I'm less worried about that because I think the nature of that kind of thing will be you know it will come slowly relatively slowly from a respected you know company or nation state and there'll be time to prepare. What really freaks me out is that with like the super intelligence in math of uh just of

AI, I'm really worried that uh there will be classical algorithms. Classical means they run on your smartphone that could um break these things. And if that happens, so you know this morning open AI uh released 400 uh new papers and results. each one of them just staggering you know as I said I used to be a mathematician like my heart goes out to all of my colleagues who are like saying okay what [snorts] do we do tomorrow right there's no more room for uh mathematical innovation just by yourself so but the issue is that we cannot rule out in a week or in a year a classical algorithm coming now a

classical algorithm is something that anyone can implement you know in 5 minutes um on their laptop top and this to me is the bigger threat because this is the unknown unknown and I'll say this it affects much more than just uh blockchain it affects the whole digital economy and I'm even worried about the fallback mechanisms which are also based on very clean structured math so I mean once you recognize there's a big problem you have to start hedging and preparing the safest kind of hedging is based on what's called hashbased cryptography and um you know I didn't have premonition but ZK Starks and the

signature schemes based on them which I co-invented in 2018 they're based only on hashes. So what is needed is to say there's a huge problem and converge as quickly as possible to the safest ground which is hashedbased cryptography. anything short of that I wouldn't sleep well at night. >> So I I agree with much of what has been said. Um I will add one thing. So they are there's a tech you know can it be solved from a technological standpoint?

Absolutely. Um they are primitives that exist um and you know to your point once the problem is like they're more costly and in fact if you move you know from um elliptic curve to lises it's it's more costly but latises also have this type of algebraic structure that is worried about. So if you want to move to hashbased signatures then I think you're very safe indeed but then the cost is even higher right they're even bigger uh so there's a cost aspect but there's also a social aspect and I believe that blockchains can be updated fairly quickly uh especially in an emergency you know I I I don't think that we're going to wake up tomorrow and uh and and there's a quantum computer attacking Bitcoin and uh and and the chain hasn't

upgraded I I think it it that can be done in a day Right? And the code for doing it can be can be written in a day. But there's a social problem. If you did this tomorrow, you would still have tons of users who have funds at risk. You need every single user who has their phone at risk who has addresses that are based on elliptic curve, especially if the public key if they use if they reuse the address, the public key is visible. And all of these need time to migrate because some of them, you know, they bought some Bitcoin or they bought some cryptocurrency and they're sitting on it and they don't want to monitor it every month. they're not reading the news about quantum computers and you want to have as long of a window as possible. So the the the reason blockchain should be

great now is not because necessarily like oh we know for sure it's coming you know next months I think it's going to be at least a couple years but you don't want to wait the last minute. You want to give your users years to migrate and that's why I think it's important to move quickly. you brought up uh throughout that uh conversation two two interesting so two two different approaches in terms of postquantum signatures hashbased signatures lattisbased signatures maybe for the audience because these will be terms that you will likely hear for for the next 5 years and there will be great debate about these two topics um maybe for the audience can you explain the trade-off between these two types and

families of signatures and where they currently sit. >> Let me give you an example of a lattice. If you look behind, you see these regular dots. They form a two-dimensional lattice. So, sort of points that are at the same distance from one another. That's a lattice structure. Now, this is a two-dimensional lattice. You can imagine a three-dimensional lattice. Maybe some of you can imagine a 100dimensional lattice. I cannot. But that's that's what a lattice it. Now, as you can see, it has a lot of structure, right? It's very repetitive. So, lises are used as a sort of math problem to uh um form postquantum cryptography. And

there's an assumption of hardness. The assumption of hardness is that it is very hard to find a point in the lattice that is very close to another point. Okay. Now it's very easy uh in two dimensions but you'll have to trust me that it's very hard in 100 dimensions to uh do this. Um however it has a lot of structure and that makes for short signatures for things that are fast to compute and that's why everyone loves them. But that's also why they're a little bit more scary. Hashes are they don't look nice like this. They are basically a hash function is something that says take a bunch of bits,

you know, garble them around, throw them at each other, do that again without any sort of reasonable structure and they're messier. They lead to uh longer signatures, but because of that, they're going to be more resilient to things like uh super intelligence. That's like kind of mental image you should have. I I think I'd like to add that it's it's not necessarily it's it's not it's not a graduation. It's not like oh the more intelligent AI gets you know the more latis is going to be broken mathematically it is a mathematical fact uh whether or not they are efficient

algorithm for latises and we just don't know now it's very unlikely that efficient algorithms exist for hash functions because if they were we would live in a very strange world however for latises we generally don't know and so you know you want to give it like a 10% chance 20% chance in fact recently um one of the latest based signature algorithm that was proposed and that was selected uh by the NIST uh hawk artificial intelligence found attacks on uh on on uh on this problem. Um there's another uh system the Mac system which is a very old system which has resisted decades and decades of cryptographic analysis was also broken by artificial intelligence lately. So

>> no that was actually humans. I think >> it was humans one of the last human >> basis disparaged one of the last human discovery. >> I I know the authors and they told me that it's not uh AI. So >> don't give up on mathematics yet. [laughter] >> You have to if you if you want to write a math paper you have to get it out now. >> Yeah. [laughter] >> It's the last call. >> Uh yeah. The only thing I guess to agree with everything that was said uh the the trade-off that I would add that I focus on is you know I think a lot of people think about the cryptography and okay kind of like in the abstract what does this mean for block size etc. I would say from the practical standpoint, which is where where project 11 sits, is like,

okay, we have custody infrastructure that is built today in a certain way. Some people use hardware security modules. By the way, what does that mean? It's a it's a chip that actually has like all the cryptography kind of layered onto the chip. And so that's the security assumption is like the hardware has the cryptography. When you're going away from elliptic curves, you have to first off, you need to find hardware that supports your given postquantum scheme. And there are some hardware, you know, there's there's getting to be some trusted hardware that's getting deployed, but it's it's, you know, typically very limited in the range of algorithms that it can support. And these are kind of untested algorithms. And the thing I would add to what Ellie said, which is really important, is, you know, AI is obviously, you know, making great strides in mathematics and these

breakthroughs. And I think we I think it's it's definitely worth worrying about that from classical cryptography, but I think it's it's defin it's also worth worrying about from postquantum cryptography. postponed photography. I so hash functions have stood the test of time for sure, but other new algorithms have not. And I think this is why you see exactly what Arthur said with Hawk. You know, Hawk had been around for a few years um but it got broken kind of overnight effectively. And this is kind of the scary thing is that you you might have a situation from an infrastructure standpoint where suddenly an algorithm is now broken and then how do you move from what is broken to something new?

Because there's a lot of dependencies here, right? is blockchains needs to support the signature scheme that you want to move to. also the hardware or the MPC technique that you're using to aggregate or somehow thresholdize or basically enforce the policies of your customers has to also become you know man you know fit with that right so there's this a lot of second and third order effects that folks are considering and I'll say from my perspective where we talked to a lot of different chains and space like we work with the EF we've advised the Bitcoin security consortium done grant work with with Salana Ripple others you know unfortunately no one is really coalescing around a standard I think a lot of people like the conservative nature of the hashbased signatures, but a lot they often find they're impractical from the cost perspective. So they try and invent

optimizations which unfortunately it turns into there's a lot of different schemes out there and maybe at some point they'll reconge into a single standard but right now the the field of postarm cryptography is very bulcanized and I think that has big implications for infrastructure and custody. >> Let's talk about that. So we're at token 2049. A lot of the people in the audience probably care about potential market implications or like what what what what do blockchains look like in five 10 years? What like let's say hypothetically um uh the industry settles on hashbased signatures. Let's just say hypothetically that happens. If we go down like the most the largest pieces of

infrastructure within the industry um what are the implications of that? what does the day-to-day like user experience look like? What needs to change at like the hardware level or the validator level or even the network level um in in that future? Maybe I'll start with this one and go back that way. I I think I think an unavoidable consequence of the transition to this new these new cryptographic schemes is um the UX is going to potentially degrade uh in the short term and I think it will make it much more expensive I think to have the many the variety of wallets that we have today. I think so practically speaking this cryptography is going to be much more complex. To take an example, some

of the hashbased schemes that uh that are being considered for Bitcoin say involve a stateful element which means in addition to kind of keeping this secret, you also need to kind of keep a counter and make sure you don't sign twice that you know using the same you know you don't you don't sign at the same level of the counter right and so this is kind of it's like it's a completely new paradigm for wallets to have to manage that has implications that include users loss of funds right and so this problem that was kind of commoditized and easy just implement this you elliptic curve library is now kind of gotten a little bit more it's gotten more complicated and so I think that's going to see you're going to see a consolidation I think first of all of wallets I I think also it's going to

make the cost thing is going to drive it's going to make the cost of decentralization higher right and so I think for different ecosystems obviously everyone is at a different point on how much value there is on decentralization versus not decentralization but I think it's just the simple fact is elliptic curve signatures are small therefore or transactions based on them are small. Latisbased and hashbased signatures on average are bigger and therefore blocks are bigger and therefore maintaining that state is bigger and harder and the network needs to look different and that just means there needs to be probably architecture or like an approach would be to make architecture more efficient by optimizing centralizing it. So I think you're kind of going to see ironically some of these blockchains I

I'll pick an example like Ripple you know the the validator set there is kind of smaller. People I think sometimes crit criticize Ripple. It's like, oh, this is like a permissioned kind of multisig, but in a sense they're kind of well positioned here because they already have this semi-permissioned uh system that they can upgrade and not pay as much of a cost as say Bitcoin. I think where again, not only because like the technical constraints are high, but also the philosophical belief in what is important is in Bitcoin is very deep. I think that'll be a challenge. I think for any ecosystem to remain decentralized, I think the planning has to start now because ob I think everyone here believes that decentralization to some degree is important, but that can't be taken for granted, I think, is what I would say.

>> Mhm. >> I'm more optimistic. Um, so there's a saying, I saw this as a meme on the internet. It says, if you want to know what Ethereum will look like in 5 years, check out what Starknet is today. And what be stands behind it is if you look at you know what where Ethereum is heading. So it's heading to use ZK starks for which are postquantum secure and hashbased for you know signature aggregation and aggregation of transactions. It's uh looking at higher scale through that and privacy all of these things exist today on starknet and um I can tell you that in terms of UX for privacy and for transactions it's a very smooth UX. They have account abstraction which basically means you

know you could use your whatever smartphone biometrics to sign transactions. So it I think from the user's point of view uh the transition will be uh well okay there are two scenarios. If the catastrophe hits before enough blockchains do whatever is needed then everyone will just see you know prices plummet and everyone rushing to wherever whichever safe heaven there exists. But I'm an optimist. I think that you know folks will adapt and then it will feel like the two the year 2000 uh you know uh bug event where nothing happens and nothing is noticed by end users along the way you will see um developers uh doing a lot of work well now it's going to be AI helping us but

like you will see uh basically a lot more scale you will see uh adoption of uh ZK starts with lean zk VMs um you will see privacy at it. This way you will see aggregation of transactions. So a single transaction will be longer. Uh today it's whatever let's say 1 kilobyte. So it maybe a single transaction will be 10 kilobytes or 20 kilobytes but that's not a big deal because you'll just have uh a lot of aggregation by uh you know validators and provers and uh you will again I'm saying I'm very optimistic because all of this has been working for years on starknet and you can check it out. The final thing I'll say on this is that we um so you know because of my work on

Bitcoin and hashbased signatures and and uh stuff like that. So I actually get asked a lot by you know sovereign wealth funds and large institutionals and so on to advise on these matters. So to this end we wrote a quantum hub that you can go and check out. It has migration paths you know evaluation of different networks. All you need to do is uh go to quantum.starquare.co co or just Google quantum starkware. There's a whole bunch of resources there. Uh check it out, talk to us. Uh happy to uh advise and you know share information.

>> Yes. So I I I agree with a lot of that. I I would say again on the on the wallet and the cost. So I I think the biggest problem for Bitcoin is feelings more than technology. Uh cuz you know now nowadays computers are computers are about 100,000 time you know have 100,000 time more compute than they did when Bitcoin launched. When Bitcoin launched you would buy USB key with 16 GB and now you get like USB drive of a terabyte. Um so you know if hashb signatures in Bitcoin make it 10 times bigger it's fine to increase the block size by 10x.

It is not going to break Bitcoin. But the problem of course is like it's going to hurt a lot. It would hurt a lot of people's feeling and therefore maybe it doesn't happen. That's the uh that's the big problem. >> I think the just to quickly interject on the Bitcoin one, I think it's so there are people that feel differently about decentralization, but I think the one that divides the Bitcoin community the most is Satoshi's coins. Um what do you do with them? Do you burn them or do you let the quantum computers take them basically? And this is um a very divisive issue. We were we were at an event uh in San Francisco, Bitcoin Presidio, where they pulled the audience which consisted of a lot of Bitcoin core devs, investors, etc. And it was split basically 50/50 whether it was right that you you know you let it you just

kind of live and let live or you burn the coins. And I think it's that's a debate that I think it'll be very interesting to see how it plays out. >> Yeah. So for the cent coin here's where I uh here's where I land. Uh I I I I think essentially either you uh you burn them or you block them you know you make them non-ransferable and then you say look if Satoshi comes they have many many ways of proving that they're Satoshi and therefore they will be able to do uh uh to uh to do this or you use some addresses which are strongly believed to be Satoshi's but which still have a hash that protects the the public key is not known and then you put the other coin under under that. You don't have to choose today between being prepared for quantum and having more

expensive signatures. What you can do is you can give users multiple keys. So you give your user an elliptic curve key and you give your user a lattice key and then you give them a hash key and if and when it becomes very very clear that the risk is too high. So for example, you've seen new research on lattises like I don't think you wake up tomorrow and it's completely broken. you'll you'll have a little bit of a warning shot. Then you can deactivate one on the network and the funds don't get stranded. So that's the number one problem to solve and it can be solved today. So today if I if I were to do one thing on Bitcoin today, if I had magic wand, it wouldn't be like implement hashbased signatures or anything like that. No, no, no. Just allow users to register a hashbased signature. That's

it. Just this one thing actually mandate that users do this for every single key. And then you have all the time in the world. You can prepare, you can do all of this, but give users a time to fix their key so that they can prove ownership later. >> Yeah, I think account abstraction, which you mentioned, I think is going to be just going to be a must have feature in the future where you kind of just don't know exactly what cryptographic schemes will ultimately not be, you know, not be broken and and then what will be the best for whatever use case. So, I completely agree that flexibility I think is going to be a mustave. >> Great. Um, maybe in the last minute here, uh, final verdict. Is quantum an existential threat to crypto? This is where I'm going to give my optimistic

take. Quantum mechanics can actually provide I think a different way to secure value and uh secure information. It can be a different basis for cryptography. I mean there's been some research around you know quantum key distribution quantum random number generation today. It's kind of toy like it's not very practical. Um but I think in the future as we have working quantum computers it's possible that quantum mechanics can become another assumption that we leverage to protect information. I think to me that might be what quant what what crypto looks like. integrates this to make these systems more secure because the nice thing about quantum mechanics is it's you know it's it's a not just a math assumption but a physics assumption like to the best that we know this is how the world works at a very very small level and so I think for that

reason it's potentially powerful >> I'll say that I'm an optimist so I view quantum as an existential opportunity but the one thing that keeps repeating in my head um with respect to quantum and with respect to uh AI is Bob Dylan's line. The winners now will later be last for the times are a changing. And I'm 100% convinced that the winners, some of the winners now will later be last because the times are changing in a way that even Bob Dylan didn't foresee when he wrote this in the 60s. So educate

yourself, learn, hedge, support the things, you know, the changes that are needed. As I said, if you want more resources, you can find them on quantum.starkware.co and uh reach out. >> Yes, I did an existential threat to uh to crypto. Uh I think most people will be able to upgrade in time and we also live in an age where software development is you know the cost of software development is al almost free nowadays. Uh but you know hardcore Bitcoiners like to draw difference between Bitcoin and crypto. So is it an existential threat to crypto? I don't think so. To Bitcoin it could be if there's not uh more of a reaction in the community.

>> Great. Thank you so much for your time this afternoon. >> Thanks R. Thanks.