ZKPodcast: Alan Szepieniec on Hash Functions & Supersonic SNARKs

Transcript

welcome to zero knowledge a podcast where we explore the latest in blockchain technology and the decentralized web the show is hosted by me Anna and me Fredrik in this week's episode we catch up with Alain opinions a co-author of the SuperSonics and marvellous papers we talk about his work on snark constructions and hash functions so today we're sitting with Alain ship in yachts who's a researcher at nervosa and

is also the co-author of transparent snarks and dark compilers the supersonics paper and the marvelous paper which specifies the vision and rescue hash functions so welcome to the show Alain thanks what I'm glad to be here and we also have Frederik hello hello I think I'm curious to hear a little bit about your journey kind of into cryptography and how you got involved in these like various topics actually the first story I can tell is when I started learning programming in C back when I was 10 one of the first programs I wrote was an encryption program with the hindsight of having the the PhD and stuff it wasn't a very clever encryption

algorithm but still it shows that I was interested from a very young age already when did I get seriously interested I would have to say that was at university when I started studying applied discrete algebra and it was just so cool what you could do and we learned how RSA works and I implemented RSA and it was it was really exciting science but aside from the exciting science aspect there's also the privacy aspect which I really like I think cryptography is in the intersection between exciting science and technology that

can enhance human freedom cool where did you actually study I studied in love them which for me was conveniently the closest University to where I was living or where my parents were living because when I went to university I stopped living with them it was the closest University conveniently and I studied computer science and electrical engineering for the bachelors mathematical engineering for the masters and that was really not very well linked to cryptography mathematical engineering is more about numerical numerical algorithms optimization control theory

machine learning but for my master's thesis I picked a cryptographic topic and that's how I got into cryptography intimately and then after my Master's I started looking around I actually I knew I wanted to do a PhD on cryptography and and I thought maybe it's time to leave Lowe's and but then when you look at the places where you can do a PhD on cryptography losen is maybe not number one on the list but certainly up there so I decided for the time being it's worthwhile to stay in lausanne yeah we had a Nigel smart on the show and I was

just thinking like there's a very convenient university to have close by especially if you're on the court ography path and Nigel had nothing but good things to say about the university and I can imagine that had I gone to another university I would have been more interested in another topic there there may have been some influence from the research group appealing to students in the in the master's program cool yeah it's kind of interesting to see how different universities kind of get their niches and did they establish their own vibes and and what they focus on but

imagine it is sort of an internal like once you catch on in the university gets good at something it's like a self-perpetuating kind of thing where now that department promotes to all the students that they should get involved with this like hell-like ecosystems kind of emerge actually it's also like this actually reminds me of how like music scene submerged I know this is a very strange comparison but like I'm from Montreal and I remember like few years ago there was some really good bands and then all of a sudden it became a hub everyone moved to Montreal to play in bands and I imagined this kind of thing must happen in universities where just a few really shining stars emerge and then around them there's like an ecosystem that

forms yeah I think that's accurate that's accurate it's a self-reinforcing circle so what were you studying when you did your PhD yet living when I did my PhD at Kayla's and I studied post quantum cryptography and and I specialized in multivariate quadratic systems so in most of post quantum cryptography you have a couple of branches of mathematics to choose from and multivariate quadratic crypto systems the idea there is that your public key consists of a list of polynomials of degree two but in many variables and in order to encrypt or to

verify a signature you just compute the value of the polynomial in a point and this point would be your plaintext or it would be the signature you just compute the value of the polynomial and that gives you since there are a list of polynomials that gives you a list of values and you check that against the hash of the document that you're signing or you send that as the ciphertext and then the whole clue for being able to generate a signature or being able to decrypt is to generate this initial list of public polynomials in such a way that there's a trapdoor embedded that that you only can exploit if you know the

secret key so that from the point of view of the attacker your public-key is just a random list of polynomials but if you know the secret key then you know how to invert it so that means that you know how to generate signatures or find the plaintext according to a ciphertext that idea of I mean we've touched on the post quantum idea I'd be curious to hear from you do you think it's very very urgent to create post quantum security systems today or do you think that it's still very theoretical and like post like post quantum computing is very far off so we have plenty of time I think the construction of quantum computers is progressing at a pace that is

independent of the progress of media reports about the progress of quantum computers so ok you have to ask a physicist who is really deep into the the field in order to assess where we're at in terms of quantum computers I don't trust the the media reports at all the times that I've spoken with physicists or that I've heard them speak they tend to be optimistic they tend to say we'll have something that's interesting for cryptographers within 10 to 15 years I think they may also be required to say

that by the budget office so my my cynical position is that we'll have something interesting to cryptographers between 20 and 30 years and 30 years from now we we should have switched properly to post quantum cryptography some people are skeptical that quantum computers could exist at all and I don't belong to that camp I I don't think that nature is malicious enough to deny us the possibility of quantum computing got it I think the main thing to be like quantum computers already exists right

so the main thing to be skeptical of is like to what size can can they grow can we make desktop quantum computer and like things like that because you know can we ever find the materials and and everything to make a quantum computer that doesn't require near zero Kelvin cooling and all these kind of things so yeah what you mentioned here the near zero Kelvin cooling reminds me of of just the sheer scale of the engineering problem because in order to control your qubits you have to have actuators that still operate at near zero Kelvin and well that's that's a classical

engineering problem you don't need any quantum mechanics to engineer these actuators per se in such a way that they're still operated operational at near zero Kelvin but it's just a problem that we've never encountered before so that's one of the reasons why I think quantum computers will come it's just going to take a lot more engineering than we know that we expect I think what we should do now is chat a little bit about your work on like your some of the papers that you've been co-author of at living like you did your PhD but did you then leave living and do a postdoc or

like because you've been involved with the transparent snarks from dark compiler paper so this is a paper that has been fish and Benedict bones and yourself as co-authors so were you doing that from Livan or did you do that after like what what how does that when did that happen so after my PhD which was in December of 2018 I was postdoc at k-11 for a very short period and then I started to work for nervosa and then a couple of months into working for nervosa I moved to Switzerland which is where my firm was set up and and well that makes sense for me to move here I started working on on the dark

compilers paper right off yura crypts 2019 I'm not sure when it was exactly anymore but I remember that I was still in love and at the time but I was already working for nervous so that's earlier this year I guess earlier this year yeah we had a we had a very rapid product development lifecycle there cool yeah that's great I mean there's so much research coming out right now what like what is I think for our audience we so we have I actually have a video on youtube of Ben fish presenting at least like a half you

know half hour presentation on this topic which I can link to but maybe you can share a little bit like what is SuperSonics what is this paper all about I think the best way to answer that question is to look at the the history of how this came about how it came about was at yura crypt I was discussing with people and and I was saying what nervous wants is really a proof system that's efficient to verify but has a public key set up where a transparent set up rather so there is no trust assumption in the setup but it should still be efficient to verify and in fact zero knowledge is

optional and it was clear from the conversations that I had at yura crypt that the stark proof system was the only one that came close except the the size of the proofs were still rather large or I think they they've managed to shrink them down quite significantly in the meantime but at the time we were looking at 500 kilobyte proofs and I was wondering well the only cryptographic ingredient there is a hash function which is really cool from the point of view of post quantum cryptography because we don't know how to attack hash functions efficiently on quantum

computers but well but what if what if you don't need post quantum proofs then maybe you can use a different cryptographic tool to reduce the size of these stark proofs so that was the question that I was looking at and then I was simultaneously looking at Ben fish and Benedict boon sirs accumulators paper which is using class groups to generate efficient accumulators and the ball started rolling from there I thought well what what if you start using class groups to do these polynomial evaluation proofs well actually what stark is doing is

it's showing that the polynomial that come is committed to has a sufficiently low degree but I was looking to enhance that protocol a little bit and then I came up with something but then I didn't know how to prove it and I didn't know what else you could do with it I had a strong intuition that you could build starks out of this protocol but I really didn't know how to proceed so I reached out to Benedict and and he recommended to bring then on board as well and then Benedict he told me how to how to prove a wrong actually Benedict proved the security straightaway where he saw early on how to prove the

security and that was cool and then then fish he thought ok let's think about this logically what or analytically rather what kinds of things can you do with a polynomial commitment scheme which is what the protocol achieves right you commit it to a polynomial and then the verifier specifies a point and then the prover proves that the committed polynomial evaluates to a given value in that point and then the answer to to Ben's question seems to be well we can actually capture a lot of

these snarks or rather we can capture a lot of the machinery underlying these gnar in terms of polynomial commitment schemes and then we can reuse the same machinery and compile it down using our class groups polynomial commitment scheme to achieve a new snark proof one that doesn't have a trusted set up but still does have an efficient verification so there are a couple of options there we can start from the machinery underlying the stark proof system or we can start from the

machinery underlying the GG PR type snarks or we can start from the machinery underlying Sonic which is what we focused on at the time and it was obvious that from the point of view of optimizing for trustless setup the result was going to be an improvement over Sonic which is why we call that Super Sonic fortunately or unfortunately depending on your perspective right around the time when we wanted to publish the paper other people came out with plunk oh yeah which is similar to Sonic in the sense that it is a

universal one-time trusted setup and then other people still came up with Marlin which is also in the same category so we decided to say well you can compile any one of these three proof systems with our class group polynomial commitment scheme and the result is still called Super Sonic so technically Super Sonic refers to free slightly different proof systems so Super Sonic is also super Marlin and super plunk exactly got it so I'm curious like you say it's it's an

improvement on the system but is there a trade-off like what what am I you know in order to get the non trusted set up what am i giving away yeah so the proof size increases that's that's not so fun so for plonk I think the proof size is just over a kilobyte don't cite me on that one but the the nice thing is that the proof size is independent of the computation whereas when you drop the trust it set up then the proof grows logarithmically with the size of the computation so we're looking at proof sizes that are

about ten times larger than you can get with pairings that's one trade-off and then the other trade-off is we don't know much about the security of class groups these objects have have received very little study they've been known for a while but they were always thought to be outperformed by elliptic curves so nobody cared but that the big difference is that elliptic curves have no orders and once your order is unknown then you can do all sorts of fancy tricks so the Securities is a second trade off you you you would trade the security of pairing groups which are also up for debate

but arguably less so than the security of glass groups yeah we talked a little bit about this with Joseph in the briefs and vdf episode but there is you know an active area of study of class groups now and trying to optimize this trying to create hardware for them and all sorts of other things so I mean when you say it's it's a security trade-off well it's a trade-off and in the cryptography sense of like it's it hasn't been studied for thirty years kind of security not that we know that it has weaker security right correct although there is a qualitative distinction to be made namely that elliptic curves and I

should make an explicit exception for pairing based elliptic curves but if you look at regular elliptic curves the the type of elliptic curves that you can use in conjunction with bulletproof there we don't have sub-exponential attack algorithms so you can choose the the order of the elliptic curve to be twice to to the twice your security level and you won't be able to do any better than that and that's really cool but once you move towards bearing based groups or class groups they start having to deal with sub-exponential attack algorithms and you have to choose the the size of your priorities to be larger to take into account those attacks at the at the most

recent zero knowledge summit Alessandra key is a kind of helped to map out a lot of these new constructions and the framework that he used had been and I think actually been fish had mentioned to me a sort of similar thinking which was like thinking about these snarks or snogs as having a front end and a back end and where and I I don't know if I'm gonna remember this correctly but I think like clunk and Marlin might be living in the back end and the supersonic element lives in the front end or vice versa is something like they're basically optimizing on kind of two different fronts exactly and what you call the front end or the back and that depends on on your perspective but

the the key technical contribution of this paper is all the way at the end it's just changing the cryptographic stuff so in the end you have to choose between Merkle trees of reed-solomon code words that's the strategy employed by stark Aurora fractal or you have to choose for pairing based groups and that's what marlin long sonic ggp are do and we provide a third option you can do the same thing based on class groups and only the second option pairing groups comes with a trusted set up so I think to really understand this construction I

think it's really good to get a lot of background so as I mentioned there is this talk by Ben fish that I'm going to that I have on the YouTube channel PS I'm gonna be sharing all of these links in the show notes so please just check that out if this is interesting to you I'm gonna provide a lot of extra information there's the paper there's a talk and there's also talks on plunk and talks on Marlon and so then you can start to see how these things can all work together yeah it's a really I think it's a it's a very very interesting time for this kind of work and this papers definitely like a highlight let's now go on to a second paper that we wanted to talk about in this podcast which was the marvelous vision rescue hash function

specification paper so is there anything maybe before we start in on this that you think listeners should sort of keep top of mind or maybe do a little background research on to understand marvelous if you want to understand how the hash functions work you you really need finite fields and with that background you can start implementing the hash functions if you want to understand why they are secure well that's a different matter altogether you you definitely need background in linear algebra multivariate polynomials and so on but in the end one of the points of

this paper is that the security of these type of hash functions is still a very much open question so even we don't know how to assess the security accurately although we do have a couple of threads that we're exploring inside the paper what would be comparable like what what does the marvelous hash function try to be better then yeah maybe if we start out with just what are the objectives and I in the abstract of the paper I think you expressed this reasonably well but it's starting from that level what is it going for the first question is obviously why do we need another hash function right we already have shot two

and and maybe 10 years or 15 years ago we thought sha-2 was going to get broken but 15 years later we're still nowhere near breaking shot - so shot - is fine and then catch shock is fine as far as we know also and if you want something even faster than catch acting good then you can go to Blake too and that's fine as far as we know as well so why on earth would we need another hash function or another pair of hash functions and the answer is that when you want to implement sha to work at Jack or Blake inside of a zero knowledge proof or inside of a multi-party computation then the complexity of these protocols blows up and that's because

the specifications for sha to get shocked Blake they all use operations that are not native to any finite fields and they're optimized for CPUs essentially right exactly they are optimized for CPUs for Ram machines or for embedded devices for hardware it doesn't make any sense to to reduce the number of field operations with that metric in mind but when you're going to implement something in a zero knowledge proof or over multi-party computation you want to reduce the complexity of this protocol by as much as it is possible and then you want to shun all possible non native finite

field operations that research question was already raised in a couple of earlier designs there was low MC and there was mimsy and our designs fall into the same category so essentially instead of optimizing for CPUs you're trying to optimize for arithmetic simplicity and making these easy to compute in a zero knowledge proof exactly how how much easier are they to compute in a zero knowledge proof like what are the results in order to compute something stupid like a bitwise rotation over a zero knowledge proof you have to

express this rotation as a sequence of finite field operations which only gives you additions and multiplications and at the end this very simple operation turns into a very large polynomial and in practice we think the the difference will be factor a hundred or a thousand depending on which exact choice you're using for the traditional hash function and and arithmetician oriented hash function no is this at all similar to what Z cache did for their reasons an optimization of their zero knowledge proof where they switch from sha-256 to

petersen hash and that that was like one of the reasons there were a lot of reasons for the speed up in this upgrade but that was one of the main reasons but a petersen hash is not the same as as the hashes you're talking about but is it still trying to do that thing where it's like trying to simplify and optimize for arithmetic complexity rather than CPU complexity the objective is the same correct I think Peterson hashes well you can define them over finite fields as well but the idea is you take a sequence of group elements typically on an elliptic curve typically random group elements

without mutually known discrete logarithms and then you take your your message divided into bits and the bits indicate which group elements to multiply together that's arithmetic leave area ficient but this hash function doesn't satisfy all the properties that standard hash functions have like preimage resistance second preimage resistance collision resistance collision interact ability the goal in this paper is to is to create a hash function that provides the same properties as standard hash functions whereas Petersons hash functions you can use in certain contexts but you can't use in other contexts so it's a bit more of a generalist solution I guess correct but it is possible that

Peterson hashes will outperform our designs in certain scenarios got it would there be other types of hash functions that you would compare or contrast marvelous hash functions with well there are obviously you cryptographic functions like block ciphers and verifiable random functions and and public key encryption but I'd say it's the most similar to traditional hash functions like chateau except with this one they caveat that that the complexity metric is different you mentioned zero knowledge proves as an

application for this or context that you'd use it and but are there other applications is there other areas of cryptography where this property is desired there are the observation that makes general purposes your knowledge proofs work is essentially the idea that you can express an arbitrary computation as a sequence of finite field operations this is called arithmetic and it turns out that arithmetic is also the operating principle behind multi-party computations behind fully homomorphic encryption and there's even a fourth

example namely functional encryption although we don't have functional encryption for arbitrary depth circuits it still provides you additions and one multiplication these are all over finite fields so then the question is how do you express an arbitrary computation like machine learning over shared data sets in an npc setting as a sequence of finite field operations and the answer is exactly the same as in the case of zero knowledge proof so is there ever a case where you need to evaluate a block cipher or a hash function over npc we expect there is for instance if you're

going to run a machine learning computation over MVC and that you want to encrypt the results so that only one person can read it and and the other participants can't well you want to perform this encryption on secret data so you have to evaluate a cipher on secret data so you have to evaluate it inside of your NPC protocol another example is if you want to threshold eyes deterministic signatures so signature schemes like snore and ECDSA they start out with a commitment to a nonce which is just G to the power random number and that's actually the first component of your

signature and it so happens that this should be random because if the adversary can guess it then he can forge signatures but once you sign two different messages with the same nonce then you lose your secret key so you should make sure that you never use different nonces to sign different messages and a very straightforward solution there is to just take the hash of the document that you're trying to sign and concatenate the secret key before you take the hash right you take the hash of both and that's your knots that's a perfectly valid solution it generates deterministic nonce which from the adversaries point of view is as good

as random except that only works for a one party computer when you want to spread your secret key across multiple parties and you want to apply the same trick you want we still want to get a deterministic nonce so you need to compute the hash of the secret key concatenated with the document or the document concatenated with a secret key so you still need to compute the hash of secret data and you might as well use one of our ciphers to do that cool and this is definitely like signing things in MPC is like a hot topic and thing that everyone wants to

do now that seems pretty relevant rekt what are those ciphers that you just mentioned noir and ECDSA are signature schemes Schnoor has been around since 1990 and I think it was patented really really soon after publication and then ECDSA was standardized as a way to get around the patent but it uses essentially the same mathematics it generates really small public keys and generates really small signatures that's that's really cool and because of the

patent I think Bitcoin had to use ECDSA when it launched but the patent has since expired but we're still stuck with ECDSA on Bitcoin which is a shame because snore signatures are better because they allow you to do fancy things like signature aggregation and stuff like native multis things and not having to go through Bitcoin scripts to do a bunch of stuff exactly it's funny that like Schnoor signatures on Bitcoin has been this hot like it's been a point of discussion for so many years now and

like for a while it really looks like it was going to get in and like they were going to get it and now it's just like now it you know bitcoins not gonna do anything at all yeah it's it's a shame yeah I I think it's it's indicative of the whole selling point for Bitcoin in the first place which is that it's supposed to resist change it's supposed to be difficult to change that's why I can be reasonably confident that my money will still be there in 20 years it would be far more disconcerting if they could change it out of whim because then where

do I put my money do you think the original this is like sort of a side tangent here but do you think the original idea really was that conservative like was that built into it from the start to be like we're gonna build this thing and then it won't change like this is something hotly debated yeah it is hotly debated and and if you look at the very early days there there were plenty of changes that the first few emails sent out by Satoshi are literally bug fixes or announcing bug fixes and and a lot of those bugs were consensus critical so yeah the the protocol did change but then it really only changed in the

beginning and and not really that much afterwards or at least afterwards we've only seen soft Forks which aren't really Forks I don't know III I'm not Satoshi and I'm not in his mind either or their mind or their mom actually so the question that I had before was a little bit more about your ciphers can we dig a little bit into these into the ciphers that are actually within the marvelous hash construction right so I think the best way to explain this is to follow the historical evolution of events in

the beginning there was a yes which as I'm sure you know was developed in lovin then there was stark ware who had also an amazing crypto system but something achieving something completely different and they wanted they wanted a hash function that was efficient for their proof system and and they looked at shot two and they looked at a yes and and they decided well maybe there's another option out there that we don't know of or maybe we can actually design something that improves on on these metrics so they reached out and they reached out to love them and Toma and

semen co-authors on this paper started working on an improvement over AES called jarvis jarvis is the block cipher and then you turn it into a hash function called Friday and the idea is we're a yes uses a state consisting of sixteen field elements Jarvis uses a state consisting of one field element but in the end the evolution is still rather similar right it's it's inversion operation applied to all the field elements followed by some linear operations and repeat that don't forget to inject the key and repeat that simple

process enough times to thwart all attacks and they wrote a really good paper showing that it really does thou'rt all the standard attacks in traditional cipher design so that that that was actually received very positively even by the internet people started implementing Jarvis without being prompted to and they started asking where they even started implementing this over prime fields even though it had been designed only for binary fields so there was there was clearly a big demand for this but then

it got broken or broken told my disagrees and there is some some discussion to be to be had about the exact complexity of the attack because we don't know how much memory it will take and maybe the memory ball neck will will make the attack impossible but still there is an attack that the designers hadn't foreseen based on grosvenor basis and if you follow the reasoning of the attack the projected complexity is far smaller than the projected security level this is what's the name of this attack I don't know if the name is the attack if the specific

attack has a name but it falls into the general category of grosvenor basis attacks okay we can get into what Grosvenor bases are and what they do later on from my PhD studies I happen to have seen Bergner basis attacks in the context of attacking public key cryptosystems so Tomer and semen and brought me on board to advise on the next member of the marvelous universe and the we brought on Abdel who's an expert on npc and then we had so many questions for Elly that in the end we thought it's a good idea to mention him as a co-author in the end he wrote some

pieces of texts that have undergone very little evolution since but them have engendered evolution on the rest of the text so it was once again a collaboration between people of various expertise and and the clue here is that we revised the design of Jarvis substantially to produce vision and rescue mm-hmm vision like Jarvis works over binary fields rescue works over prime fields vision and rescued these are the ciphers this is in the paper are these these are inventions basically

with this construction yes okay your naming is all starting to have a trend also I looked at the notes it seems like this is all Marvel comic references so it is from our perspective so obviously is the stark proof system which in the end was the the first and foremost goal for optimization semen is the comic book experts I I don't really know the origins of the names but I do like the names it's it's all just dawning on me where's Stark where comes from got it

yeah this time I've been I've been totally clueless that's great but at some point we had to generate coefficients by expanding a short seed using cat shack and the short seed is winter is coming oh that's different different one that's a different universe altogether cross series here crazy so the kind of these hash constructions and in even Stark we're approaching like the university and all of this is this part of the Starks hash competition because I know that they're looking for these new hash functions and that there is some sort of evaluation going on

maybe I don't know if the competition is the right word but my understanding is that they also reached out to Luxembourg the University there and they were also developing stark friendly hash functions and they are the ones that attacked Jarvis so there is a friendly competition going on between lovin and Luxembourg in that respect so in the end we came up with the marvelous universe of hash functions and they came up with the Hades universe Hades paradigm for constructing start friendly hash functions and then Starck

we're decided well we don't really know how to assess the security of all these functions let's just create a competition and and then we can we can support the argument for security by saying there's been a bounty on these hash functions for this long now if nobody was able to collect the bounty that means that nobody was able to break the function which means it has to be a secure function cool so you mentioned just earlier this Grosvenor basis attack and that there was sort of a larger topic behind that can you explain something more about that sure cribben airbases attacks are based on gerbner

bases which are the polynomial algebra equivalent of vector space basis in linear algebra so in linear algebra your vector space is spanned by taking linear combinations of basis vectors and the clue is that the coefficients in this linear combination are taken from your finite field in polynomial algebra you get to take polynomial Combinator so the coefficients can be taken as polynomials and this generates something more general than a vector space this generates an ideal just as every vector space has a basis and multiple basis in

fact so too does every polynomial ideal have a basis and in fact multiple bases and the useful basis in linear algebra is obtained through reduction to row echelon form and there is an analogue in polynomial algebra which is essentially computing the grosvenor basis the crognard basis is essentially the same as reduced row echelon form and it's very very expensive to do unlike linear algebra computing the grosvenor basis is prohibitively expensive it depends on all sorts of things all sorts of things that we don't know it depends on how you

model your attacks so what you do is you specify a list of polynomials and then you run your grosvenor basis algorithm and then the grosvenor basis algorithm spits outs spits out a solution except how long does it take for the grosvenor basis algorithm to run that's a very big open question and we have a couple of ways of arguing this in in the paper but in the end the truth is we just don't know nobody knows and and that's that's a very important question and as a result it's difficult to to estimate the security of arithmetic oriented hash

functions so one thing I want to say is I didn't realize when we invited you on here how much the topics that you have touched on and covered and worked on kind of intersect with like other works from guests we've had on before or topics that we've been kind of mulling over on this podcast this much so it was really really great to have you on I just want to say thank you for sharing all of this with us and I know that we've only just scratched the surface on a lot of these topics I think a question that I would have for you is where should people go if they want to dig in more on this stuff maybe even specifically on this marvelous hash function universe well there's the marvelous paper which is on ePrint and it has a couple of references

and for a lot of questions that are still open I'm afraid there are just no references because that's that's what it means for a question to be open so that's yeah you're basically saying go study cryptography and help us solve it exactly and if you or one of your listeners are interested in maybe coming to Switzerland to work in a secret laboratory of cryptography research then go ahead and drop me a line no cool all right we'll put some links in the show notes for anyone interested all right yeah it really has been great I mean for

me some of these episodes where we focus more on cryptography is is a treat for me because it's not something I get that much of in my day-to-day so I love it thank you very much for being on the show thank you very much for inviting me it was my pleasure and I'm really happy to see that this formerly arcane field of science is is getting getting people excited even people who aren't inside the the field and think those your knowledge podcast is one of the reasons why that's happening so I'm happy you guys exist and to our listeners thanks for listening thanks for listening