Ian Smith - Migrating to Quantum Safety: Risks and Advantages

Now put the slides. Yeah.

Okay. And I I would like to introduce our please introduce our speaker is Mr. Ian Smith is here. Uh he's a blockchain developer and advocate for quantum safety. Right.

We we are talking about that this morning. Uh at Quantum Ian leads uh the effort uh to to build a secure environment for web application in the postquantum world. So, a big applause for Yan Smith and the stage is yours. Thank you, Lucia. Thank you, Napolit.

Thank you, Ian.

Thank you.

Let's see what this button does. Hey, so I have a QR code for our Telegram group on this slide. At the last slide, there is also uh the same QR code again. and uh also my my personal telegram. If you join the the telegram group, you can download this slideshow and see links to all the other presentations.

There is an hour and a half version of this talk that is recorded and going to be posted to YouTube. There's an unedited version of it live right now, but we're going to trim this up. So here's the the main 45 companies that have been doing quantum computing for the last few years. There are probably 15 to 20 more that have started in the last 6 to9 months. Uh the total supply chain you're looking at basically uh 1,600 companies.

So, these little no-name companies nobody's ever heard of get bought out for tens of millions of dollars. They're part of the 1600. Here are the main, you know, potential buyers. Q Era on the top left just released the 3000 cubit system. Uh they put out the papers I think two weeks ago and two days ago it just started finally hitting the news.

uh this 3000 cubit system is fully uh fault tolerant but it is not uh able to do any computation because it's not using the same you know like completely capable gates. So according to McKenzie they're saying that the quantum risk begins at 2027 for RSA 2048. Um that would mean that elliptic curves at 256 bits would be vulnerable in 2026 and that aligns with uh the new algorithms. Every year the algorithms get better and better. Every year or two there's a paper that basically cuts the number of cubits by 10 to 100.

U and this has gone on since 2020. They originally said billions of cubits in the Microsoft Q cubit estimator. Now it's uh the lowest number although the number is a little bit flawed is 250,000 by uh optimistic shores uh followed second place by reje which is considered to be the most efficient u and then third place is shores algorithm clocking in at around 1 million cubits to break ECC 256 basically 1 million cubits. They can take the private key from the public key. And in web 3, that means that they can basically become anybody.

Now, people say, well, the banks are going to get, you know, hacked, too. Well, no. They've been working on this for five years. Some of them have been only working on it for three years, but they've they've they're well into their migration process. And uh the only things that have like well public keys that can be attacked are inside their network.

So you'd have to break into their their network and then get access to one of the public keys and then break in using that public key deeper into the network. There are this is really hard to read. There are some parts of this uh distributed system that are going to be hard to replace. The missiles and the jets both need to have post quantum cryptography in order for the missiles to hit the enemy jets. Uh and that challenge response is what makes them green or red on the radar.

The other part of this that's kind of hard to upgrade is cars. uh because there's lots of cars on the road and they don't have the systems in place yet. Qday is typically known as when quantum computers will be able to break cryptography. uh specifically the cryptography that you care about is ECT ECC 256 or 255 depending on if you're using u you know Bitcoin or lightning lightning uses 255 bits. So this allows the quantum attacker to become an impostor for anybody in the entire network.

Like boom, I'm Ethereum Foundation. Hello, I'm a bridge. You know, basically you can become anybody in the entire network based off of their public key being turned by the quantum attacker into the private key. to migrate this network. There's a lot of cash.

This is really hard to see. There's a lot of cash that's that's sitting inside the network. The big problem here is that if you if everyone tries to sell, there's just not enough cash. there's basically under 8% of the total value available as some kind of uh stable coin. So, everyone's going to just try to squish into the same stable coins and then withdraw them to their bank because even Tether will not be immune.

Someone can just become Tether's mint or become Tether's contract and suicide the contract. So, people are going to sell, liquidate, and exit as quickly as possible. And the problem with that is there's just not enough cache to squish into. So a web 3 migration looks like changing the math involved in three separate parts. The consensus model, the m the wallets and then the the ledger which is what I mean is the historical data, the previous transactions and the previous smart contracts.

Um, Bitcoin only has to deal with consensus a little bit. It's a separate system. The main thing that that Bitcoin cares about is the wallets. But web 3 has a harder challenge. They need to upgrade the the consensus mechanism as well as the ledger.

Uh, especially for proof ofstake systems. Now, proof of work is only secure for Bitcoin. Uh, anybody else whose proof of work can just get attacked with a credit card. So consensus is an agreement on reality. The question of what transactions are being processed.

Uh I've flagged these with more asterisks based off of how hard it will hit and hurt your ability to perform these operations. So the one that is the worst is going to be the transactions themselves. When you look at modern transaction systems, they are combining signatures into a single aggregate and they can process one signature that's the same size as all the others and they know that all 1,00 uh signatures are all valid. There's no postquantum replacement for that that scales. I think the low the best is an N log N instead of an 01.

Uh if anybody here has background in computer science, basically it's going to take a while and you're going to have megabytes of data. So there's no replacement for that system. There's like no way that something like lightning could exist. So in terms of u wallets, this is a little bit more complicated by recent Ethereum innovations. They've started to remove the public key off of the ledger and started putting it on essentially trusted systems or semi-rusted systems.

They've taken a central responsibility and made it a distributed responsibility. So now instead of a central cryptography, they now have edge cryptography. they now your your phone may be postquantum but your relationship to the uh validator that's processing your transaction may not be and it's their systems that determine your cryptography. So you could have a postquantum phone on a postquantum network talking to a postquantum chain and this validator in the middle is like oh you have to use ECC 256 you have to use you know like SEC P26 K1 and that is a problem because now they can no longer centrally manage it and they're treating this as quantum safety but it is not. It is now edge vulnerability.

It just pushed the responsibility and the weakness to the edge. So the the big issue for the the wallets is that it doesn't matter how you store your wallet. It could be buried in your backyard and it's still vulnerable as long as you've ever done a transaction and expose that public key. Uh for Bitcoin, this is basically like all of the forks of Bitcoin as well as the main chain. So, the recent 80 bill or 8.

5 billion dollars that was taken off of Bitcoin via 80,000 Bitcoin, that could have been a public attack or a uh quantum attack on a public key that was exposed on like Bitcoin Cash or Bitcoin Diamond or Bitcoin Platinum or Bitcoin Gold. And uh if it was just if they've never done any transactions on those other chains, well then it would just be a random number uh that would be the only possibility. But anything that's exposing your public key anywhere is enough to erode the security to a quantum attacker. This is financial impact. And the main problem here is that the bridges need to upgrade both sides of the bridge.

Uh let's say that you're bridging between Binance Smart Chain and Ethereum or let's say Polka Dot and Binance Smart Chain. Polka Dot has a migration plan to make Polka Dot quantum safe by 2030 or so uh or mostly safe by 2030. The bridge would have to be upgraded both by Binance Smart Chain and by Polka Dot for that bridge to actually be safe. Otherwise, it can be attacked on either side using the other side. I can publish fake transactions.

I can announce new coins and just publish them through and then claim, you know, billions of dollars on the Polka Dot network even if the Polka Dot network is postquantum. Uh Vitalik's plan for quantum safety is to rewind the chain and then destroy all of the public the private keys for transactions. So you would have to use your seed phrase as your ability to prove that you can do a transaction. Uh so Vitalik's plan would eliminate the weakness, but it also break the chain. it would destroy all of the bridges, all of the DAPs, and all of the um the consensus essentially.

And then anybody who has a custodial wallet, anytime they have any kind of temporary wallet or an exchange-based wallet, those all just get essentially deleted. Uh and so the the amount of Ethereum will probably plummet because just most of it will be unspendable. Now, when you're looking at the the ledger, one of the things that you're you're worried about is the admin keys of every smart contract in history. And there may be some smart contract that, you know, most everybody moves to quantum safety. Maybe some of the users don't, but one of those admins did not migrate their to their postquantum wallet on that contract.

And so there's a record of their exposed public key and a record of their old now insecure or, you know, soon to be insecure wallet. And so the quantum attacker could replace that admin and then upgrade the smart contract libraries to then have an attack uh basically a rogue uh library that steals everybody's money whether you're quantum safe or not. And so anybody who interacts with any smart contracts online, well, you have to be sure that every admin is is fully upgraded and fully secure and hoping that it wasn't the attacker that migrated to quantum safety because the attacker could easily replace the admin by migrating their wallet. uh if if there you know if you're talking about a migration under fire. So Zeke there is no secure zero knowledge system.

That's true today and that's going to be more true under a postquantum world. Uh there was recently some attacks announced against any hashbased system. So there's essentially no ZK starks that are secure and there are uh the ZK snarks are using elliptic curves. Um there may be a postquantum ZK that comes out that essentially uses a ring signature or ring learning with errors something like this in order to have a circuit that's postquantum that performs the ZK math. Uh it doesn't exist yet.

Uh there's been been noise on this area, but it it no one's come through with a breakthrough yet. Nothing's ready to be tested for 5 years, and there's nothing in testing. So ZK right now is is horribly insecure. There's over six papers that all detail different uh attack vectors and uh an analysis of the architectures are finding flaw after flaw after flaw. So ZK is is broken today and uh in in two or three years.

So migrating the value would be good. It would be great to move everybody's uh assets from a elliptic curve to postquantum cryptography like a lattice. I'm CEO of Quantum EVM. Uh, and I'm, you know, I'm advocating that everybody move to new cryptography and we've replaced all of the math in our network. Uh, this is something that everybody is going to have to do.

Uh, and the idea would be to migrate all of the mathematics and then remove the old stuff to remove the vulnerability. And we're we're partnering with quantum cloud computing so that you can run uh basically like AI as a service that you can tokenize. Well, we're going to have the same thing for quantum and we have to discard all the old cryptography. Here are the quantum resistant networks and here's that QR code. questions.

Sure.

How do you differentiate the quantum AVM uh from others layers that actually are fighting and trying to be quantum resistant? What is your main pecularities? So I have a a list of about 60 different networks that claim to be quantum safe. Of those, this is the entire list that is actually quantum safe by reading their source code. So the first one is that we're we're not lying.

Unlike Hyera, they're just flat lying. They use TechP6K1. They use AES128. They claim to use RSA and they claim to use uh AS 256. So the second one is that everybody else on that list doesn't actually run any kind of EVM.

There's no smart contract language at all.

Questions? Other questions?

Okay, wait.

Oh, we have one.

Yeah, sure.

Okay.

I'm sorry. uh I think the most the the risk begins when when I'm speaking about this in public, I say the risk begins when the attacker said that they're going to be ready, which would be 2027. Um and that's uh the algorithms keep going down. If they have another algorithm improvement and any one of eight companies meets their their targets, then it's possibility of 2026. Uh the worstc case scenario would be that you could run cubits sufficiently on uh emulators and then you would just be able to use 40 terabytes of RAM on a mainframe which would mean did it you know as soon as somebody does that work right I usually don't say that in public but I mean there's your your your you know moderate case uh oh and oh no oh no we are so doomed because you could just rent at that time

who has oh we're there

is there any concern about like postquantum primitives themselves being insecure like say falcons based off ntru which some people are a little skeptical about um or anything like that people have these weird assumptions trying to make snarks

it's weird because most of the people who work for NIST used to work for the NS NSA and the NSA has this history for the last four some say five because they were slightly involved with ANIE of every time they release a public private key cryptography system they release it with a back door uh they've done that consistently every single time since RSA essentially so the the problem here is that we don't know if they've come up with an attack uh Falcon I would definitely say don't use Falcon Falcon Plus is a maybe. Uh all of the new ones in the new round like SQI Sign, we have to wait for the evaluations to occur. Their Falcon was supposed to be announced and launched in 2022. Every year since for the last three years, they've said, "Well, next year it'll be a standard soon. It'll be a standard soon."

So, uh anybody who's using Falcon right now, don't touch because they're going to have to remove Falcon uh and replace it with the actual standard. Um, I like Daniel Bernstein's uh position where you should not generate errors that allow the attack the other party to see parts of your private key. So I would say that NTRU Prime is more secure than Crystal Stiththium based off of that known vulnerability and known attack. uh we know how to break lattis uh lattice cryptography and we can break it up to 200 bits. The private keys that they're using are like over a kilobyte.

So uh yeah, there's weaknesses, but we it's good that we know what they are. Did you want more detail? We can probably talk after if you want more detail.

Any other questions? No. Well, a round of applause for Ian Smith, please.

Thank you, Ian. This is for me. Thank you so much.