ZK14 - The Quantum Question Panel

Transcript

Hello everyone. Hi. How are you feeling at the end almost the end of this ZK summit 14? How are you feeling? Feeling good. Was it good? Did you learn anything today? Um so we are here for the final session on this stage. Uh it's a panel with the topic being the quantum question. Quite vague, quite open, maybe a little bit on purpose. The format of this is going to be interesting. We are awaiting one of the panelists. Um so we are going to kick off with a little bit of an introduction to the problem space. I

feel like most of the people here probably do know why quantum computers could disrupt the cryptography we know and love, but there are people watching at home that might not be as familiar. And so I kind of want to go back to the like the reason why we're even having this conversation. What's the problem with a quantum computer for ZK? What's the problem with a quantum computer for blockchains for general cryptography? Oh, but first I should introduce who's here. So, it's myself and Nico.

>> Hello. Hello. >> And our panelist, one of our panelists for now, Justin Drake. >> Yeah, this is the highest moderator of the panelist ratio. No problem. >> Okay, so yes, that is the question. Why are we even afraid of quantum? What does it mean? What will it do? >> Absolutely. Thank you so much for having me in on this IRL podcast. Um so the the main issue with quantum is that um they can take public keys uh and turn them into private keys. So normally only the asset holder should be able to have the private key. But now anyone who has sufficiently large quantum computer can have access to these to these

private keys. Um but not only do the signatures break but a bunch of other things break. So uh for example the the snocks that we know and love that are pairing based uh things like graph 16 and plunk those break um and even relatively sophisticated infrastructure like the Ethereum uh data availability will will break. So that's based on on KZG. So for Ethereum we actually have in some sense one of the worst scenarios where we have three layers each of which need to be updated. At the consensus layer we have BLS signatures. At the U data layer we have KCG and at the execution layer we have ECDSA signatures. And all of these have to be

upgraded. >> All of them would break. >> All of them will eventually break. Yes. >> And that's a just the way you're describing a quantum computer. You're talking about it as though it exists today. >> Yes. >> But it doesn't like these aren't broken today, >> right? >> Okay. So they will be broken once we have a so-called croc which is a cryptographically relevant quantum computer. >> I see. >> And in order to achieve cryptographic relevance, you need to achieve a certain amount of fault tolerance. So you need to be working with with bits basically.

Right now we have analog quantum computers. Um and the error correction to get from analog to binary is actually non-trivial. And then once we do have fault tolerance, which we're basically almost there or even there, um we need to scale to sufficiently um to a sufficiently large number of of of so-called logical cubits. And for cryptography, we're talking roughly a thousand logical cubits. Um >> and where are we at? Like because the there are quantum computers today that are able to do something.

>> Yes. >> Yes. Um so >> I've actually never been completely clear on that. >> Yeah. So when you want to look at real quantum computers, you shouldn't be thinking in in logical cubits. Um it's just a layer of abstraction which is too detached from reality. You want to be looking at the nitty-gritty um you know so-called physical cubits uh that are the equivalent of transistors for for quantum computers. And there it turns out there there's different compilers to go from logical to physical and one of the big breakthroughs just you know in in the last couple years has been unlocking this compilation which is a 100 times more efficient than what we

had in the last few decades. Okay, >> please. >> Uh, yeah, sure. >> Okay, so I I am not an expert on the physics of this at all. Um, but I've talked to people who are um and they say that um number of cubits is not really the problem. Um because you can replicate a circuit. The the size of the circuit is not the issue. The issue is that um there are still engineering problems with the error correction, but when you solve those engineering problems, the number of cubits is going to explode because the the reason they're not making circuits that large

circuits at the moment is not that they can't, it's that there's no point. >> Oh, >> so maybe can we introduce a lot of the concepts here? So we have our logical cubits which is we know Shor's algorithm breaks discrete log. So that's written we need a certain number of logical cubits is add it. Then physical is what we can build. We have a translation from one to the other. What's error correction and why do we need it here? I I mean the the problem as I understand it is um still getting um it you you solve one set of engineering problems um and then you find another noise floor >> of course >> um and the noise floor is still um too high to make a a computer that actually

works >> um but I mean the bet of the the people who are working on this is that there will be point a point at which you solve the last engineering problem that is needed to make them to make them work. So um I mean that is why um I think that um I I believe the estimates that we need to be worried about upgrading all of our protocols within the next um well protocol evolution takes a long time so two years in order to prepare for >> an actual break >> a break in the next four years.

>> We should we should hold on timeline because I feel like there's going to be lots of opinions. >> That's a big question. Um, but just going back to what you were describing this history to the present, you had listed like an amount of I forget what the value um was, but it was like this is what we need to break cryptography. >> What was that again? >> A thousand logical cubits. >> Yeah. So, what do we have today? >> So, right now we don't really have logical cubits >> at all.

>> Right. >> Okay. >> Um, >> this is important I feel. So we have proof of concept demonstrations that we can do logical cubits and we can do error correction. But um there's two things that really we we need. One is the quality of the physical cubits to be good enough. And this is measured in so-called fidelities. And what we need for practical error correction is 39. So for every 1,00 operation, you need your gate to work 999 times. um and um for most platforms now. So if you take trap ions or um neutral atoms or superconducting, we're now at this point of three nines of fidelity. So that in

some sense is is solved. Um, the other kind of big issue is so-called real-time decoding where in order to do the error correction many times per second, maybe a thousand times per second, um, you're going to be measuring these dummy cubits that will tell you whether or not there are errors. And then based on what you measure, you need to be applying real-time corrections. >> And this is a purely classical problem that needs to be done in in ultra low latency. And the engineering just hasn't been done yet. You need to use basically FPGAAS and and GPUs and um you need to develop these low latency decoders. Um and for some reason like the physics is

ahead of the like the quantum physics is ahead of the classical algorithms um at this point in time. >> The classical algorithm side doesn't need a quantum computer to be developed. >> Correct. like this can run on the hardware that we have today. >> Yes. >> Okay. >> Um and in a sense there's a little bit of an analogy here with ZK where you know real time proving was this very difficult thing to do and we got it and now you know it just there just needs to be some teams that do the same thing for real time uh decoding in in quantum.

>> Is that what those labs are working on? like is does Google have a team doing that? >> Yes. So, a lot of the teams are working on on on quantum error correction and and decoders, but a lot of the different teams are working on the the different physics for the so-called different modalities. >> Um, and I happen to have a favorite modality um which is the the so-called neutral atoms. >> And there's kind of two reasons why um I I really like neutral atoms. the the the first one is that um they have this superpower called reconfigurability.

So you can take two cubits and move them physically to be close to each other and then you can entangle these two. So if you have for example 10,000 cubits you can you know pick cubits that are far away and just have all toall connectivity and that means that your compilation from logical to physical is about 100 times more efficient. So if you have superconducting cubits where they only have nearest neighbor connections, so in a grid they're only connected to the four nearest neighbors, your ratio of logical physical to logical is going to be a thousand to one. So that you know that's what Darra was saying that um you know if you take uh Shaw which has a thousand logical

cubits and you have another thousand to one you're going to end up with a million cubits which there's no way you're going to fit on a single quantum processor. >> A single quantum processor can only fit roughly 10,000 cubits. So uh if you want to run straw for example on super conducting platforms you're going to have to do networking quantum networking. And this is a thing that you know we haven't really solved. Um so in the context of neutral atoms you don't need networking because you only need a th00and* 10 which is 10,000 and we can fit 10,000 cubits on a single neutral atom uh processor.

Um and then the other reason why I'm bullish about neutral atoms is that um it's much easier to get the 10 to the number 10,000. So if you look for example at at superconducting cubits today they can only fit a a few hundred um and you know part of the reason is because you they have all of these yield they have to fabricate the cubits and they have all these yield issues and as soon as you scale the yield basically goes to zero um and it's just very difficult. And then there's this other platform called um trapped ions where basically um you have these charged particles and they don't like being close to each other. They repel each

other. So it's very difficult to get you know 10,000 in a single box. >> So for the neutral atom platform >> um so you you were talking about physically moving the atoms from one place to the other. Um this is not something that we do in conventional um integrated circuits. So how difficult is that in practice and in particular how difficult is it maintaining coherence? >> Yeah. So um in 2021 um I believe it was the the Harvard group that showed um a Mario animation where there was um 16 a 16x6 grid. So 256 uh cubits um and it was just you know showing Mario moving

as as as a video. And so you can you can control the cubits extremely well and it takes just a few milliseconds to move them from one place to another. And um the decoherence that comes from the movement is actually well below um you know the the the threshold that you need to do error corrections that that's not the bottleneck. >> Okay. Yeah. Cool. So, so that a few milliseconds that would be the cycle time. But I guess for an algorithm like shore where you have an exponential speed up that well technically you have an exponential speed up for grover as well but but we're kind of it's just polomial in the security parameter. Um you don't need that many cycles right?

>> Yeah. So you need about 100 million cycles. So the expensive cycles are called like like well the expense the expensive gates are called tool gates. You have roughly 100 million of them. Each one will consume roughly um you know one millisecond or so. Um and then you end up with uh roughly 10 days of computation to to to run. >> Okay. >> I was just trying to work that out in my head. Yeah, that's about right. >> Um okay. Okay. So, we're going to do a little shift on this panel because we just had one of our guests arrive. Uh, hi >> Darra. If you want to do you want to stay?

>> Okay. >> Perfect. >> Yes. >> All right. I want to welcome Dan Bonet to the stage, the guest of my 400th episode as well. What an entrance. Hi. You just got off a plane. >> I literally just landed two hours ago. Thank you so much. >> Rushed over here as quickly as I could. >> Thank you so much for coming. Um, so just to bring you up to date on what we've talked about so far, uh, we were really looking at like, you know, what are what are quantum computers? What can they actually potentially do with cryptography, but what do you need in a quantum computer to actually achieve that? And then we were trying to figure out what exists today on the theory, but also what exists in practice. Uh, Justin

just introduced neutral atoms. uh we kind of started to give a little bit of the distinguish uh we started to distinguish between the different types of quantum computers. I did want to say something that I think we said on our show which is like when you see quantum computers in the news when you see the this thing with all these wires that is the superconducting version of quantum computers and what you were talking about with neutral atoms is something else. What do those look like?

So neutral atom quantum computers are in an enclosure of roughly one cubic meter. Um there's no fancy cooling. It's just lots of lasers and lenses. Uh and in the middle there is this very small vacuum chamber which is maybe one cubic centimeter. And then within the vacuum chamber you have these atoms floating which are like roughly one cubic millimeter. Um, and uh, one of the cool things is that it's mostly off-the-shelf optical equipment and the the total cost of the machine will be a couple million dollars. When you compare this to the superconducting platform, you know, each of these wires that you talked about, there's at least one per cubit, actually

multiple, and each wire costs about $1,000. So, if you need a million cubits to run shore, that's billions of dollars just in the wiring right now. >> Wow. >> All right. The difference is it's much faster. So the super conducting cubits are exactly faster computers than the neutral atoms but they have but they have other problems like connectivity and so on. I don't know if you already talked about >> we well I think Justin you listed the things you liked about neutral atoms >> but I don't know if we shared these sort of disadvantages. >> Yeah. So neutral atoms are like great at everything except one thing which is the the cycle time. They're about a thousand times slower. So for Qday you know what will um mark Q day I think more likely than not it will be something like

neutral atoms and unlikely to be superconductors but in the long term we want our computers to run extremely fast and so that's very bullish the the faster platforms there is another disadvantage of neutral atoms which is the so-called fidelities so there's some platforms like trapped ions that achieve four nines and if you go below three nines significantly below 3 then you you gain a lot. But neutral atoms have three nines and that's you know good enough for error correction. >> Cool. >> You said floating. Um this this seems like another fundamental difference from conventional circuits.

>> Yes. So you have these optical tweezers um which are basically beams of light where the atoms like to uh stay where where the light focuses. And um there's different types of of of of tweezers, but one of them is is called a bottle where basically you um you surround the the atom with light and the the atom is kind of repelled on all sides uh by by the bottle. Um >> all right. So let's now that we've done this primer on quantum types of quantum let's bring it back to cryptography and breaking it or not like there have been the idea of a postquantum cryptography

was presented many many years ago I think actually who first was working on that was it like the stark team >> there are many there are many paths to postquantum cryptography >> um I mean there's like five or six different paths So you can't you can't really say when exactly >> when it is. Okay. >> I think sure as soon as shor's algorithm was introduced people started thinking about what do we do >> and they started to make this >> microphone closer. >> Oh sh microphone close. Okay. >> But okay so yeah like what do we like there's there's a question which is the hot button question I think here.

Actually there's two questions. One is do we think there will be quantum computers? Do we need to be worried? And the other is when if so and so on this panel I think I actually we so we worked really we were talking to a few of you I don't know in the audience we were trying to find someone who really didn't believe that quantum computers would ever exist and we actually didn't find that person you might be here but we didn't get a chance to talk to you um we will open up the floor after so if you do feel that way we want to hear it but we were looking for someone to join us on this panel who was very like beerish who felt that quantum computers will remain in theory for a long time that we

can rely on the cryptography we have today on this panel today I just want to check do do any of you believe that do you think that quantum computers will never happen >> so my position is that um we have to assume that they will actually that's been my position for a long time but um we we have to upgrade update the protocols anyway. I I also believe that they will happen, but that that almost isn't relevant for cryptographic engineering. We need to update the protocols.

>> Okay. >> Um and it turns out that we get simpler protocols because they just use um symmetric cryptography um more often. Um and so we should use this as an opportunity to simplify. If I take Zcash as an example, um so Sprout is a lot actually ironically closer to being um uh postquantum. It's just the proof system that um is vulnerable, not the the thing that you're proving. The the cryptography um uh of the payment protocol is just based on um hashpry images. So um and then when we went to

sapling in order to optimize it we there was an observation which I think comes from the Coco paper um that um actually doing elliptic uh curve cryptography um over the right fields um right fields and curves um is very efficient in circuits. So we took advantage of that um and we needed to because the the throat circuit was really inefficient. Um but at that point we didn't have um uh algebraic hashes that we were confident in. Um so that was the reason we why we went to um elliptic curve cryptography within the circuit. Now that we have things like Poseidon um so despite the recent uh crypton analysis of um Poseidon 2 um Poseidon

1.1's fine just just use it. It's fine. >> So now that there are hash functions you would >> yeah probably >> and so now we know how to do um a lot of fancy cryptography um just using symmetric primitives um and we we don't need them for payment protocols. We don't need them for a lot of other things. So we should go back to using that in the the postquantum world. Um we still do do need um kind of semi structured things like um latis space cryptography. Um but it it's >> I I I don't think we'll miss um elliptic curves and RSA and discrete log over

finite fields. I this is quite this is surprising to have Darra here saying this because a few years ago you didn't feel that way and of the people here like were you the most bearish >> up until recently? >> I was quite bearish but also I um contributed to Sphinx um the which became Sphinx plus which became um SLH um DSA which now standardized. Um, so I I obviously was thinking that this is something that we needed to worry worry about, but I was quite skeptical that we would even be able to get to the first step of Shaw's algorithm, which is create a a uniform distribution over

cubits. This makes me want to ask now like is there anyone in this audience who does not believe that a quantum computer or who does not think a quantum computer will ever truly exist that it will remain in the realm of theory and it's okay to put your hand up. Actually, I do feel like I need to address that to be honest because uh these are just opinions. At the end of the day, we don't really know, right? I mean, quantum computers are n years away from an for an unknown value of n. Whatever opinion you hold, you could be wrong.

And do we really want to bet the world finance financial system on an opinion that could be wrong? And so, I totally agree that it doesn't really matter at this point whether these computers will exist or not. Uh the fact that it's a threat and the fact that it erodess trust in the in the blockchains means we have we have to adapt. I can tell you that one of the things that's most depressing to me is if we make the shift and we move away from our beloved elliptic curves and uh move to far less efficient systems and then 100 years go by and still quantum computers don't exist. I think that will be a crazy depressing world to be in. So if we make if we you know so if we make the shift we do all this effort to trans to transition all the blockchains to

systems that are harder to use for me harder to teach. Uh it better >> that's the real issue. >> That's that's that's the real issue. It it better be that quantum computers are real and they're coming. Otherwise what the heck? >> Okay. I I'm I am more optimistic about this world where we never get um quantum computers, but we have all of the complexity in our protocols because as as I pointed out we add complexity in some places and we remove it in others. So it's it's it's all actually a bit of a wash. >> Uh Yens, you just put your hand up. I'm wondering maybe would we be able to switch places?

>> Oh, >> do you want to join >> or do you want to just ask a question? I I will gladly I will gladly yield to Gen. >> This is an unusual panel to start. >> Why don't we keep going? >> I I hope somebody else will will also have. So, this by the way is a bit of a throwback to a type of panel I used to do which was called the park bench panel. We didn't necessarily start this panel with that idea, but this will be a hybrid. We might talk more about that anyway.

>> Yeah. >> What is your what are your thoughts here? I think I think my my question is is so like okay suppose quantum computers come about what is actually going to be the impact right >> suppose quantum computers >> yeah quantum computers >> quantum computers yeah >> yes >> postquantum computers it's just so ingrained in you know my wiring >> um so but I'm I'm wondering so like what we should think about the consequences right because as I see the space we have like shor's algorithm sure that can do things we have algorithm and then we don't have that much more is my understanding right so >> actually that's not quite true we have a lot in fact there's a whole website it's called the quantum algorithm zoo it's

actually worth checking out >> there's a huge number of algorithms that we have uh it's true that a lot of the problems are sort of algebraic in nature so this this stuff is very good well you know these things are very good at solving problems that have periodicity built into them yeah >> okay >> so they're kind of algebraic in nature But there's a huge number of problems that we can solve with these. >> And would you say that they're so like different in nature from from what Shor's algorithm can do as it like derivative of that? >> Yeah. Yeah. Yeah. They go quite beyond shores algorithm is pretty simple. Uh it's been 30 years now. These algorithms have actually gotten much more complex and I mean they're still solving sort of computational number theory,

computational algebra uh style problems. Uh but yeah, it's worth checking out checking check it out. the the quantum computing zoo, quantum algorithm zoo. It's a really cool website, >> but I guess shores and grovers, those are the o are those the only two that are relevant for blockchains. >> Grover is not relevant. It's really it's really uh only shore. Gro Grover is not relevant, you know, just to I hope everybody understands this, right? I mean, so Grover gives you a quadratic speed up with a huge constant. >> The constant dominates the quadratic speed up for all real real life real real world problems. The problem has to be unrealistic for Grover to become uh asmtotically practiced.

>> So is Shore the only one >> that affects cryptography >> that affects not cryptography but blockchains this like blockchains that we popular ones? >> Uh that's a tricky question. I mean so it could be that tomorrow somebody discovers uh a lattice algorithm a lattice reduction quantum lattice reduction algorithm and then all the blockchains that rely on MLDDSA and Falcon >> could also >> would be would be in trouble. >> Uh so we don't know. I mean right I I would say the field of quantum computing right now is really at its infancy because we don't have a computer. So that the number of people it's like you know the number of people who were writing code before computers existed you could count on one hand.

>> Yeah. Yeah. Because that's what that is that's a it's an algorithm that would only work once a quantum computer exists. >> Exactly. And you were saying there's this page full of all sorts of algorithms like that. But in >> but we haven't really we've only begun once the algorithms once the computers exist now there will be you know everybody and their and their and their uncle are going to start designing algorithms for these things and then that's going to unleash a lot of ingenuity creativity and I think that's kind of where the applications will come in. >> I did not realize that was the framing. This is very helpful.

>> Yeah. So I can I can think of one other thing that's quite different in a in a quantum world. Um there was this uh beautiful work of of on commitment schemes right where the classical definition of commitment scheme is that you can not create a commitment then two different openings to that right and where it's actually a little different in a subtle way in the quantum world because um you can imagine creating a commitment somehow in an entangled form of two openings and then you measure one of the openings and you reveal that later on but Then so like by the non- teleportation theory of quantum theory that means that the other opening is not

accessible anymore. So you can so like which is really weird to think about right it's a very subtle way that the classical way of thinking about commitment schemes fails. >> It doesn't work there. >> It doesn't transfer. Um >> there's a lot to say about that but do you want to maybe no we we can we can move on. >> Okay. Um, so I will put the question again out there. Are there people who don't think that there's going to be quantum computers? >> You >> have a remark?

>> Yeah. >> Is it going to come up here? >> I don't I don't know. >> I guess. Yeah. This is the hot seat. >> I wasn't planning on this, but uh >> this is what this panel is now. Oh, it's nice. >> So, it's not really my opinion. It's actually the opinion of Sarah Rash. He's a French physicist who won the Nobel Prize in 2012. And in 94, he wrote a paper called, I think it's quantum computing, dream or nightmare, in which he basically explained, oh, by the way, he got the Nobel Prize for developing methods for measuring and uh manipulating individual quantum systems.

So, he knows what he's talking about. And in 94 he wrote this paper saying basically that we would never have a a useful quantum computer. I don't know if his opinions has changed. So my question was whether you know if his opinion has changed since 94. So in 1994 um which is the year that Shaw was discovered there was a whole debate uh and the debate basically was around the quality of the cubits. In order to run shore, you need really really high cubits, high quality cubits with fidelities on the order of like 10 to the 10 to the minus 10 or 10us 12 or something. And no one believes that you can do that with natural naturally

occurring uh cubits. And then what happened two years later in 1996 is that people discovered error correction. And actually it was Shaw who came up I believe with one of the the the first first schemes. And then in some sense that's partially settled the debate where you know you can take these imperfect cubits and you can com you know compile them in in a way into bigger clusters such that the cluster is one virtual logical cubit. And so I think you know this opinion from 1994 was pre-error correction and it probably has been revised since.

But I actually I bet I I I will go along. Let's continue with with the thought. So there is a group of people who object to quantum computers ever existing. And the argument is well our understanding of quantum mechanics is wrong. Yeah. And so nobody has ever done experiments with superp positions of so many particles. And it could be when we start to scale up the experiments all of a sudden we discover new physics and short shorter equation breaks down. you know uh quantum mechanics is incorrect. Yeah.

>> Rather incomplete maybe rather than incomplete. Uh incorrect maybe incomplete. >> Yeah. Yeah. That that that could happen. And I can tell you if that happens for example there's a paper that just was appeared last year that says the universe only has finite precision. So therefore uh quantum mechanics is only correct up to certain precision and not beyond that. Uh if that turns out to be true then shor's algorithm will never be implemented. The cool thing is we learn new physics. Yeah. And this is like a once in a century discovery of new physics. So this is like a >> migrated all of these systems. Dan, >> we just m Yeah. Well, then we can migrate them back and BLS gets to live again.

>> You have physics to teach >> because you you have you want BLS to survive. >> There you go. Yes. Exactly. So actually it is it is a I have been thinking about this quite a bit actually. Like what happens if we do the migration, we wait a hundred years and a quantum computer doesn't appear. Do we migrate back? I mean, how long do we have to wait before we migrate back? >> Also, won't all of those the types of cryptographies, the efficiencies like there is progress on all fronts like it it's possible that they start to match the Olympic cryptography come back. By the way, that that's not to say so I should say by the way my my thinking has changed quite quite a quite a lot and that I used to be quite a skeptic about the the the the uh construction of these of of the

computers just because of the very slow progress that we saw like with NM NMR methods don't scale uh other methods are noisy um I have to say with uh superconducting was a big step and then these neutral neutral atoms that has kind of changed my mind with you know both Justin and I have been talking to a lot of the physicists who are building these um these systems. I can tell you the conversations they freak me out. Like this stuff is is real. You read you read the papers, you know, they're uh running computers for many hours, maintaining coherence for many hours across a large number of atoms. Uh this these machines are not difficult to build. You know, one group says it's off-the-shelf equipment. Another group

it says says custom equipment but relatively simple. You see there's like over 10 startups now going after neutral atom architectures because they're so easy to build. It makes sense that um startups would go would go down that path. Uh you see Nvidia actually by the way I don't know if you brought this up but quantum error correction interestingly is a hard classical computing problem. Yeah, this I don't know if people understand this. One of the bottlenecks in building a a shore quantum computer is actually the classical computation that has to be performed to do the quantum error correction. That is uh right now the the gates operate at millisecond rates. The um quantum error correction that or

atomic is is reporting operates at seconds per gate. This is a classical computation. The classical computation is slowing down the quantum computer. So Nvidia actually got into this game and they are they said ah you know we know something about speeding up classical computations. So actually they're hoping that this is a new market for the GPUs basically running error correction for a quantum computer which I think is pretty interesting. Th >> this is a constant factor engineering problem it's fine and this is going to >> yeah I agree I agree if the only problem is classical computation we'll solve that. Yeah. Uh that that I'm not worried. I was just right now there is a compute problem and so it's interesting to see uh how things are are progressing there. So I'm actually you know maybe I was playing devil's advocate and yes

maybe we will learn new physics and shores algorithm will never be implemented but when you talk to these guys when you see the scale of the experiments they're doing what was it the last one is 10,000 cubit 10,000 cubits. >> Oh oops forget I said that. Yeah, forget you forget you heard that. >> 10,000 logical or logical physical. >> Yeah. >> Um the the other experience I've had um that um kind of has moved me towards the um quantum computers are likely possible is the experience of being wrong on AI.

Um so I I made the prediction in 2000 that we would not have um computers passing um chewing tests until 2050 at the earliest. And clearly I was wrong. Um and so that experience of being wrong on a a long-term prediction about um technology um has made me more cautious about um things like quantum computing and a lot of experts seem to think that this is going to work. So um I don't know the physics well enough to contradict that.

Um and the fact that that fits in with um we have to upgrade the protocols anyway. Um yeah, I think it's fairly clear what we should do. >> Actually, I want to make one more point though. >> So, okay. So, this was we talked about this in the show, but I want to bring it up to this audience and see the reaction. I do worry that there's a bit of a rush to postquantum and that rush to postquantum is really quite dangerous and there's an example I want to give actually two two points I want to make. Um the example I gave I like to give I don't know how many of you have heard me say this already but let's just say it's a hypothetical example even though it's not. Um this company come came and told me that they want to move to postquantum

today their classical keys live inside of an HSM but the HSM does not support support MLDDSA. So what do they do? They take their keys out of the HSM and do the MLD MLDDSA in a in a CPU in the clear. The minute you do this, you are way more likely to be attacked by a regular hacker than by a quantum computer. Yeah, that's the result of a rush to postquantum. So, I want to caution people about the rush to postquantum. The correct action in my mind there is don't take your keys out of the HSM. Go lean on your HSM provider to provide MLDDSA support as quickly as possible. Yeah. This is why Google sets the 2029 deadlines so they can lean on the on the hardware providers to say

because of you we are not meeting our deadline. Yeah. So you better get your act together. That's the first point I want to make. The second point I want to make about the rush to postquantum is even if you set 2029 this is a bit for you Justin. Even if you set 2029 as your as your target deadline. Um this is a bit delusional because because uh just last month last month actually Intel came out and said that their processor is going to be postquantum only in 2030. So you might have migrated your system to be postquantum but the processor you're running on will accept microode changes signed by a pre-quantum signature until 2030. So yeah there's so just be be careful. This is a this is a

very complicated process uh and we should not rush it. >> It it it is reasonable for your attack model not to include um adversaries who have physical access to your processor to upload microode updates. Well, actually I guess it doesn't require physical access. >> Sure, we can start defining postquantum however we want. >> Yeah, >> just a note there was Oh, there perfect. Okay, we have someone coming up who had a question and then Nico, you had a question next. Yeah, I wanted to maybe reframe your question in a way that might get more people in the audience to raise their hand, which is on the complex complexity theory side of things, which is uh we don't really actually know if from a complexity theory point of view, quantum

computers are actually better. I mean, we don't really know like if P equal NP or not, right? So, from that kind of lens, uh there's a chance that there is a polinomial time algorithm to solve some of these uh cryptography questions and we just haven't found it yet. Of course, we don't actually know the constants. Uh, but this kind of like is like a ties into maybe like some greater problems in computer science. I >> I have an answer. I have opinions. Um, so what we're really doing when we move to postquantum algorithms is we're getting rid of all of the dependencies on discrete log. Um, that that's for most systems that's what we're doing. um that works just as well against um a

classical discrete log algorithm as it does against a quantum computer. Um and I always frame it as um kind of we're fixing this protocol against a discrete logbreaking adversary. We're not specifically um uh uh protecting it against a quantum computer because as you said um Gro Grover's algorithm is basically irrelevant. You should choose your um key sizes um long enough, but you should do that because of multi-target attacks, not because of of Grover's algorithm. >> Okay, fine. So, there's one more switch, I think, and then we're going to wrap up our panel, but there is actually there is sort of the timeline question that

hasn't really been answered. Your favorite. >> Oh, but just very briefly, since you mentioned the risk of the rush to postquantum, >> yes. Is there also any worry about rushing to latises when we don't know enough about latis assumptions? Hash functions I think we've seen for a long time. But yeah, >> uh Justin, do you want to take that? in the hashbased world like we should we be rushing to pose on um and hopefully we won't be um and you know we're looking at all the alternatives and we're trying to do as much due diligence as possible um on the latises I think there's like

a real question as to you know whether so we do know that I guess there the assumptions are about 30 years old right so a lot of mathematicians have have looked at them but because there hasn't been an incentive to to break them to break real world systems maybe would you know it's just not not not not battle tested on the on the other hand the the the Merkel signatures that we're we're looking to to deploy the the so-called XMSS where the M stands for Merkel these are 50 years old um and um they're extremely simple and I guess one of the comments that that Dan made is that you know the cryptography that we're deploying is more complicated well I'm hoping that it's in some sense less

complicated at least in in certain parts. Um but yeah like one issue with the latises is that you have to be an expert in order to set the parameters. Um and there's also as Dan mentioned there's a possibility that we will find uh a quantum algorithm to break latises. There's also a possibility exactly or classical one. So if you want to build a system that is likely to last you know decades and centuries I think hash just a personal opinion hash functions are the way to go.

>> Yes. Yes. >> Um yeah I mean you can do hash signatures. Um the um what was I going to say? So >> I have something to say. Can I can I >> um one So has anyone worried? So you talked about these quantum algorithms. Is there more focus? Okay. Okay. Let me try to frame this. If there is the assumption that quantum is coming, will people focus more on these quantum algorithms instead of the classical ones that could break existing systems? Like will we almost get like a mind share problem if everyone starts like if if

everyone buys into quantum >> quantum algorithms uh they are a super superset of classical algorithms. >> Okay. >> So if you're designing a quantum algorithm by definition you also or rather if you design a classical algorithm it will that's also that's also a quantum algorithm. But I'm almost wondering if the mind share goes too far into quantum and isn't then reusable in this classical sense. >> This is more like a social question like >> I mean the the attention >> random random thought >> the attention sorry to interrupt the attention on um kind of postquantum cryptography that's how a lot of the isogynes based systems like um like got broken. So um and they were broken not

by a new algorithm but because people hadn't noticed that there was an existing algorithm that broke them. That that's a bit of an oversimplification and it doesn't apply to all of the isogyny based schemes but that that's a brief summary. Um so yes there will be more attention on um the algorithms that are being used in uh the the assumptions that being used in postquantum cryptography. Um that's fine because um latises um the there's actually a lot of dependency on um latismian in conventional um cryptography because um it kind of uh ll the the um the main algorithm used to break um latis

problems is also you used in um sort of classical cryp analysis against various things. So um yeah, advances in those algorithms aren't just going to break the um postquantum stuff necessarily. >> Uh the oh other thing is um hybrid. So um basically if you're doing um >> did you say hybrid? >> Yeah. If you want to upgrade your um protocol to um postquantum encryption say then you should just use um X-wing which is a hybrid of uh ML cam and um uh um ECIS basically which is what is

deployed on the web. But by the way when uh Intel said they're going to become postquantum they mean they're going to implement MLDDSA in their processor. And so, you know, if your processor for security depends on the security of MLDDSA, you're kind of lattis based regardless whether you want to or not. So, we're going to have lises in our lives at any any rate. >> Would it make sense to talk about timeline? >> The reason The reason I want to talk about timeline is because you're here, Justin, because I feel like you're one of the most bullish people I know. I asked I I kind of quoted you Dan today to Justin. I said, you know, Dan says

the 2029 date is more coming from the security teams, not from the physicists. And you disagreed. >> Yeah. Well, as as Dan mentioned, we've been talking to the physicists recently and um there's been a lot of developments in the last few months. Um but yeah, if you rewind the clock uh to uh October 2025, I was actually on the bearish side of things. Uh but what happened in October 2025 is that we organized this uh postquantum workshop in Cambridge and we had this uh guest invited speaker who happens to be um a quantum entrepreneur and he basically totally shifted the Overton window. He said Shaw is going to be coming between 2030 and 2032 and everyone in the room

was like and he he's had this prediction for 15 years now >> and it basically hasn't changed. He just he just says, you know, you have this exponential growth. You just, you know, draw the the lines and it it kind of lands there. And >> you know, by the way, Khi disagrees with that. So the prediction market will will give you odds against uh before. >> Yeah. Interested. >> Dan Benstein's prediction, which he's also had for 15 years, um is consistent with um that one. >> Um okay. So where was I? Yes. So in back back then in 2025 my odds of there being a quantum computer by 2032 was about 1%.

I kind of gave him the benefit of the doubt. It was a possibility. And you know in our context 1% is quite a bit right because we're securing you know half a trillion dollars. Um but then um in February 2026 I got you know early access to draft from from the Google paper. And here my odds went up dramatically to about 10% by 2032. And then when the p paper was published, it was it was this concurrent publication of the oratomic paper with neutral atoms. And I've basically spent the last month and a half learning about neutral atoms. I've been obsessed. I've watched all the YouTube videos that you could find. I've read, you know, a bunch of papers. I've I've had conversations with

like half a dozen experts. And now I believe that by 2032 there's a 50% chance that we'll have a quantum computer. >> 2032. >> Yes. But the thing is that 50% chance is just way too high like we have to upgrade before then and I have this notion of the effective Q day which is you know the the working date that we have to have in mind by which you know the sufficient chance that a quantum computer could arrive and you know roughly speaking is let's say 10%. And I I believe now that there's a 10% chance that in 2030 we'll have a quantum computer and and therefore we have to upgrade before then. Hence the 2020 2029 timeline.

>> So that's that's a a security analysis that drives the 2029 number which I think is exactly also what the Google security team did >> 2029. Yes. My I I interpret the 2029 number to say let's talk about Google not so much. The Ethereum Foundation is actually on a good path, but for Google for them to transition their entire infrastructure to be postquantum is a crazy hard task. They have to replace a huge number of their hardware devices and it's a crazy hard task. It's most likely they will miss their 2029 uh target. Um but even if they miss it by three years, you know, we're 2032, maybe that's we're still safe. if they set if they stuck to their 2035 number and they

missed that by three years, now we're getting into pretty dangerous territory. Yeah. So, I think this is part of the reason why they decided to set 2029 as a as a goal. And I think for the Ethereum Foundation, it's a great number, too. >> There there's also the time taken to deploy infrastructure, which as I said before, people always underestimate. So, it's not just blockchains that have um a potential governance problem that makes um upgrades take years. Um it's PKI. Um it's HSM as we've already mentioned. Um so, yeah, estimate three years just for people to get their act together.

>> The thing that that I'm a little worried about is the public here is 2029 and they say, "Oh, wow. We're going to have quantum computers in 2029." No, that's not I don't think that's the message. the messages, the upgrade, the transition has to be done or at least we should shoot for 2029 so that if we miss we still have a margin of safety. It doesn't mean that 2029 is the date when we're going to have a quantum computer. Yeah. And even even the well okay fine maybe some physicists are aggressive about 2029 but even many of the people we talked to are you know they give low odds for 2029.

>> Will we see signs along the way or is it going to be a one shot? Okay. And that that is a >> you know there's also the famous question of why have we not factored 21? You know I think those those kind of all those are >> two different mixed together. Oh okay. Yes. >> Maybe maybe we should well should we talk about 21 or should we talk about that we're going to see signs? >> Go ahead. 21. >> So 21 21 is not an easy problem. So when you when you write shor's algorithm for factoring 21 that's about 200 gates. Yeah. Today we we can't do 200. Actually, I I guess they said that maybe even without replenishing they can get roughly to 200.

>> Well, you need error corrected gates which we don't really have in real time now. >> Well, we that's my point. I mean, we we Okay, so they talk about replenishing, but that definitely 200 gates we have to do error correction. So, the first thing is you have to get error correction to work. Error correction only started working in 2024. So, this question of 21 was like irrelevant before 2024. Um, yeah. Now that now that things are starting to to to work, 21 is coming within scope. In fact, it's interesting that they were saying they might be able to do it without replenishing um which is uh still with error correction but without replenishing which is interesting. It's just that that's like not they're not interested in doing in doing that. Why would they factor 21?

That's like the the question they always ask. Um, so right now it's kind of not it's maybe on the boundary, but within a year or two the circuits will be big enough to to do that and hopefully one of the teams will actually do that. So that will put that uh debate to rest. Yeah, I'm frustrated by these papers that say um we things like um I can factor this um faster using a VIX 20 than um using a simulation this quantum algorithm. Um it's it's it's a silly argument because the problem is getting c um error corrected cubits at all. Um and then Shaw's um algorithm is polinomial time. So um everything goes very fast after that point.

>> So will there be signs along the way or will we suddenly have >> do you want to say to the mic? >> Oh sure. So will there be signs along the way or will we suddenly have error correction uh factoring way bigger numbers than 21 and breaking all our cryptography? I'm not the person to answer this. Um, but from what I can tell, it's now just engineering. So, you know, I I used to use this Mo Moore's law model to try and predict like when like the reason I used to say 2040 is you do a Moors law calculation and you kind of get 2040 and I mean after talking to these to the physicists uh to again and again, they all seem to be of the opinion that Mo's law is the

wrong model here. It's not this stuff doesn't evolve linearly but it evolves in jumps. It's like human of flight right there was one day where humans couldn't fly and the next day humans could fly. Uh so this stuff evolves in jumps and as a result Mors law is actually not a good model. So predicting has now become very difficult. Um uh and then will will we see you you're asking also will we see progress that that actually is a very touchy topic. um let's just say the fact that the Google paper had a zero knowledge proof in it rather than the actual circuits suggests and they're very clear about that that there might not be as much transparency going forward as we have seen in the

past. So it could be that um I don't mean to >> I don't know I'm not not sure how to say it. I'll say it anyhow because that's what that's that's what they're telling us basically. could be that like five years go by where we don't hear of any progress, but that doesn't mean that progress isn't being made. >> And even when we do hear progress, that progress could be stale. >> Well, on that note, uh this is actually I've been getting signs for the last 15 minutes to I have five minutes each time. So, I think it is probably a good moment to wrap up. we also brought you back onto the panel so it was a full circle. Um I want to say

thank you to all of the panelists, spontaneous panelists for joining us. I want to say thank you to this entire audience. Uh thank you for coming to ZK Summit and joining us for another edition. Yeah. Thanks so much. Oh yeah. And we're not quite done yet. We actually uh just sort of spontaneously as well decided to grab a few drinks at the bar uh on us. So there is a tab. Please enjoy a few drinks in the lobby and we'll get a get a chance to continue our conversations. Till next time.