Stefano Gogioso, Marc Kaplan, Sylvain Bellemare, Fabrizio Romano Genovese - QUANTUM PANEL

So hello everyone. Um this panel uh more than quantum cryptography panel will be a panel about the new frontiers in cryptography like in in you know the course of these days we saw different I would say esotic applications of cryptography. We are for instance quantum based cryptography. we saw a lot of like quantum money even quantum experiments and and stuff like that. Um we have cryptography enforced by hardware like in the case of like pfs.

So um I would like to take this opportunity and to use this time to basically discuss you know where cryptography is going. So um let me you know let's do a round of introduction and if you guys can introduce yourself and say what you do.

Uh hi I'm S Belma um research engineer now co-founder of a startup in a very early stage. uh for a past six years I've worked with uh in academia as a research engineer with uh IC3 headquarter at Cornell University but I spend lots of time with uh consensus protocols multi-party computation and then uh trusted hardware all in the classical setting but I have a quite serious interest in quantum cryptography as well so yeah that's it. Hi. So, I'm I'm Mark Kaplan. I'm the CEO and founder of uh Veric Cloud.

We are a company working on both hardware and software for quantum cryptography, communication, quantum internet. My background before that was quantum. I was working in academia for a number of years uh in several topics including quantum crypton crypto analysis on uh on classical cryptography. Uh but right now we're more focused on uh trying to you know see quantum technologies as a as an opportunity and not as a threat for for quantum well for cryptography in general.

Hello, I am Stephano. I am an Oxford academic and co-founder of Never Local with Fabitzio. Um we are dedicated to bringing new uh quantum cryptographic protocols into life and ultimately to develop and bring about quantum money as a new decentralized financial instrument based on quantum properties uh in collaboration with infrastructure partners.

Cool. So uh would you agree that basically the the kind of stuff we research on would be considered let's say a bit exotic for uh you know the standard cryptographer or cryptocurrency enthusiasts out there just like

I just I'm just like doing some statistic probing basically. I think well for me in the in the past let's say four or five years I've worked a lot with trusted hardware and which is actually increasingly used in blockchains but also outside blockchains like earlier I was mentioning like if you're using end to end encrypted uh messaging because now with the advent of AI so a lot of messages actually are routed to these trusted execution environments in data centers where they actually decrypt your communication to perform AI on it and then re-encrypt it. So there's a kind of like arguably a big security question mark there. And for some reason it's not so I don't know. I don't want to speak for other people but for me it kind of like bothers me a lot and the only thing I could think of is that how to solve that problem would you put you would put the the security key in a black hole.

So that's quite exotic I think

to answer your question. Yeah 100% agree even maybe more. So actually the the main motivation for creating the company in the first place is that with my co-founder uh we realized that all the companies working in this sort of intersection between quantum and cyber security were founded by physicists and they are doing outstanding work on the hardware side but they probably don't have the right mindset for addressing cyber like real world cyber security problems and that time you would go to uh crypto cryptography conferences and you know quantum cryptography was a joke for for good reasons for good reasons right so uh these guys didn't know how to produce a security proof or well they didn't really care about security in the first place I would say so yeah the the I mean we've seen like a more let's say solid grounds for quantum/cryptography appearing in the late well in the mid 2010 intense. Let's say people started taking these problems seriously and uh you know treating it as a standard mainstream cryptography which is uh you know when we when we started seeing this move it gave us this incentive to now work on the hardware software side sorry and start implementing the things that we knew could be or that we thought could be useful uh for real but uh but you given the time scale that I just gave you, I think you realize it's quite recent yet.

Yeah, I think uh I think it's fair to classify quantum cryptography as an extremely exotic field. It's um ju just to give a concrete impression of how exotic it is. There are maybe two mainstream cryptographic protocols that have been developed over what 30 years. uh there's a lot of variance and a lot of implementation specifics, but in terms of coming up with new ideas that are provably secure to the kind to the level that we would be interested in there there's a handful of of really new protocols and they all take time and a lot of expertise and so this is um it's a it's a niche field with an enormous open space in front of it. Um, I I think it will be less exotic the more it gets into mainstream cryptography, the more the infrastructure gets deployed and people can actually start deploying things, taking an interest in practical aspects.

But as of now, I think it's fair to say that we are still in a oh this is this is interesting, but I don't really get what the hell you're talking about stage.

Okay. So considering that we all agree that we are in a sotic territory um let's say esotic technology fringe technology always have uh a selling problem in a way it's like if you were to talk with you know someone used to traditional crypto to traditional cryptography traditional applications of blockchain what would be the prime example of the thing you do what it brings to the table like one thing that you can absolutely not do you know with currently available mainstream technology and that it justifies the kind of research effort that we are putting into into our respective research efforts

okay well I'll take the angle of hardware right now secure hardware I mean secure hardware is most of it is closed source so already and this is a really difficult problem not necessarily for uh research reason or but because the the economics the semiconductor industry is is very guarded but it's also something for whatever reason that people have not worked on that much es at least if I consider the consider the blockchain ecosystem so if we want to have verifiable compute basically right which a lot of projects are striving towards and when when there's hardware involved it's definitely is something that needs to be addressed. It cannot be ignored. That's

Yeah. Just to change it, just to mix things up. Yeah. Um well, there there's two things really in in the shorter term through cryptographic self- sovereignty. You don't need to trust the devices that you use.

That's not something that you can do with classical cryptography. uh no matter no matter how hard you try, there is a point at which you're trusting somebody to have made the device right. With quantum cryptography, you can at the end skip that step. Uh you can do something which is truly secure without having to trust anybody. But in the longer term, it's peer-to-peer true peer-to-peer digital value transfers.

That's again something that would require some kind of trust in infrastructure, trust in the devices, centralization, ledgerization. With quantum money, this will not be necessary. So that's I think the goal that that's what we bring to the table in the longer term.

Yeah, same answer. So just to rephrase it with my language, I think our job is easy because we can do things that are provably impossible to do with the with classical systems. Although so unclonability is uh is one thing of course now we know how to do it. It's probably impossible but it's been done in blockchain right but uh but the amount of effort that it takes you to do it in in quantum is negligible right so so it is really disrupted with disrespect

okay um now I I'll ask you more like detailed questions specifically about the stuff you do so I'll start with sane uh in your talk basically you presented poss And the main example that I saw is uh fingerprinting in a way. You get a unique fingerprint out of a chip, right? Um in TES you can you can do encrypted computation uh directly on board. uh how do you use like the PF fingerprinting device to do verifiable computation and in particular is there a way to extend like the PF way of providing entropy to like bootstrap some more like T universal hardware computation device.

So you mean how the puff plays a role in in the T So what I'm saying is in in a T basically you can encrypt a program pretty much every program you ship it to the chip

the chip computes on board the program and from the outside just looks like a black box and then it gives you output. Um, if I understand PUS correctly, they are mainly used to derive a fingerprint. But if you want to do encrypted computation on the chip, is it enough to make the computation secure and effectively make the chip look like a black box or it just guarantees you that the computation is being performed by a verified device? And if it's the the latter, how do we bridge this gap? Are there any ideas to basically make PUFS more powerful than they are now?

So okay so what the the puff gives here right this physically uncclonable function is a way to generate a key and to store the key in such a way that it cannot be known to any anyone. So including at the key generation time. So there's no provisioning when the chip is fabricated right there's no provisioning phase of inserting a key into the device. So it just gets intrinsically generated when the chip is powered up and there's no way for an external observer to peek in and to find this key. So now you can use this key as a root of trust.

So if for now we assume there's this sort of setup phase when the chip is made it it's made honestly right so it's a real puff and but the only problem it would be that you have a puff that is fake right but someone needs because if if you're not able to inspect the machine that is remote if we go back to this WhatsApp right let's say they encrypt our message and let's say they would say when they decrypt to do the AI analysis because we benefit from it so okay I want it say but they say, "Oh yeah, we we you could use the puff here as the root of trust that where it would sign an attestation describing what is the hardware and what is the software running." So the software now you would know, oh, it's only doing what I expect with my data, right? And it's re-encrypting it on the way out and it's not doing anything else. So this can work and now this machine even could be the in the hands of an enemy because they wouldn't be able to extract the puff key, right? The limitation here is that you have to assume that someone made or manufactured this chip honestly or that you have a verification phase that it goes through a lab or a set of labs where they kind of try to somehow they they if it was open source the idea is that you could do imaging technique on the chip such that you can check that it matches an open source design and then this lab would say okay this is a good and then they could then sign the puff key say okay this puff key is legit it belongs to the expected uh hardware now the puff key in a way gives you a bit like in a way the hash of the hardware you can't think of this this way but you need the problem is that you need that setup phase that's I don't know if that's clear yeah

so so the kind of thing you're envisioning is a bit like new PG so you have a committee of people people around that can verify and test that the key is original

yeah the best I can think in this classical setting, right? Because puffs are in a classical setting. You will with an open-source chip that has this puff uh root key, you it will go through a a committee of labs that would verify it that have let's say orthogonal interest. It's like an NPC, right, for verification. It's not really multi-party competition, but what I mean is a a threshold committee that let's see would require that the majority said, "Okay, it's a good chip."

and they don't have they don't have incentives to collude. But basically you need to bring a economic security model. Another way to quickly say some people have proposed even way past even not just with a puff but that root key you could make it that it signs uh that it owns bitcoin say or whatever cry a very expensive amount not that key but let's say you could embed in hardware a key I don't know I'm getting lost but but the point is like you could bind it there's a bond right there could be that it it owns a lot of money and so whoever is making that chip would have the incentive so that the key cannot be extracted. But yeah.

Okay. Thank you. Uh Mark, what are the in your opinion the biggest bottlenecks uh bottlenecks against the adoption of the quantum internet at the moment? What is that is preventing us to get there both like technologically, socially, politically? Um there are a few ones.

Uh I what I can tell you is the status today and what is what are we trying to do to to you know perform like further steps toward the adoption. Um so the status today in Europe is that there are several deployments of quantum communication networks at the uh national level. Let's say it's mostly test beds but it's a it's a very good start. So it's um telecom operators are doing it and so for example in France we have so Paris has a three node network. Why three nodes?

The first thing is that you need so you can use optical fiber the same fiber that goes to your home but you you need to dedicate your optical fiber for that. So you cannot use um you cannot you know multiplex quantum and classical signals without the within the same infrastructure that so as long as you remain in dense uh metropolitan areas it's fine there is a lot of fiber down there the fiber can be spliced it's fine but if you want to uh I mean if if you need road work in order to put new fiber then the costs are skyrocketing Okay. Then the hardware itself is expensive. Um it's usually few hundred of KS uh for the hardware for deploying the the hardware. And last but not least is the applications.

Again the only application that we have today at an industrial level is quantum key distribution. uh and this is the only thing that you can purchase from uh from um uh suppliers uh at the moment right whereas if you've been to the talks today and and yesterday you can see that there's a lot of work in progress using QKD quantum key distribution as a um as a building block for building new cryptographic tasks. So um but but it's not yet in production. Yes. So I think these are the three things.

First you cannot reuse the the existing infrastructures plus you cannot reach long distances. I forgot this one. Then the cost of the hardware and and the the lack of applications mostly we try to address all of them let's say within one of the the project one of the more on the research side. One of the projects we participate in is the quantum internet alliance which is supposed to cover all these aspects or all these bottlenecks addressing them with different solutions. Right?

To increase the distance you can use you know quantum memories you can use quantum repeaters which are not yet out of the lab. Right? It requires heavy funding for uh applications. you can, you know, gather smart people in a room and make them think about trying to derive new applications and so on and so on.

Okay, cool. Stephano, what is the end game of quantum money in your opinion? And basically, where do you envision quantum money 20 years from now? And at the same time, what do you think is the closest thing that we will achieve in the quantum money field? So short and long-term vision.

How short? How short? Like six months or five years?

Both.

Oh, okay. All right.

Give us a spectrum of things that will happen.

Five years and 20 years? I'm going to start with the 20 years one because that's the fun one. Um so the the ultimate goal of this is um fairly ambitiously to replace most if not all of the current uh digital value exchange infrastructure which in short we we will try to replace blockchains as a store and exchange of value because it solves the same problem. Quantum money solves exactly the same problem that blockchain solve in a different way with once we have in 20 years time the infrastructure the technology complete with a lot fewer compromises and it does it better. So the end game is to have peer-to-peer digital sort of value that doesn't require ledgerization centralization just based on quantum principles.

Uh you carry it in your pocket, you pay with it. Uh you can pay anybody in front of you with it. um not going through banks, not going through miners, validators, none of that. So that's the endgame and it's fun to think about that. It's good to have that as sort of the north star.

That's what we try to achieve. Um the reality is that a lot of the infrastructure and technology necessary for that doesn't exist today, will not exist in six months. What we could have in five years going a bit shorter is potentially enough infrastructure to start doing this for institutional value transfer purposes on short time scales. So, think banks, think financial institutions, think casinos, think anybody who has an interest in transferring value in a peer-to-peer way without the overhead of centralization ledgerization will be able to use this as long as there are local fiber optic networks that can be used to transfer the quantum states. This has already started as as Mark was saying there are some challenges but there's also quite a lot of opportunities and five years sounds like a reasonable timeline to start having applications in that sphere.

Um 6 months is very short term uh and a lot more challenging. We will not have any quantum money applications in six months. But there are a lot of things that we have to do on the way to quantum money. There's a lot of advancements in quantum cryptography that have to be brought about and so something in the six months to a year term is new ways of democratizing quantum cryptography. That's the main challenge with this with this field is that it's so hard to get anything even simple done.

Luckily, we are we're not physicists. We are computer scientists and mathematicians.

That's why I agreed to come here.

There you go. And so we come from a we come from a tradition of building tools that do hard things for us instead of trying to do them by hand. And so what we will see in like a year's time is a is a fairly radical change in the way that these protocols are imagined, built, created and proved secure where we will have more and more automated tools. We we would say compilers but you can think of them as programs or however you want. um that will help us develop new protocols that exploit this infrastructure so that the infrastructure can get more investment so that it grows more and in five years we can start having more quantum money applications and it's a positive loop.

So it's a bootstrapping phase basically

it's the hard yeah

bootstrapping phase. Yes.

Okay. Okay. So guys, give us a sneak peek of your uh research effort in particular. Are there any latest development in your respective fields that you are particularly excited about? like something that you know came out say in the last 12 24 months that really made you think oh that's the that's really you know something worth noticing and communicating to to the world where wants to go first have to think about the answer go

do you want me to go

um yeah so there's There's um on the quantum cryptography side and therefore as a side effect on the future of quantum money side, there's been quite a lot of developments over the last two years in terms of the kind of cryptographic techniques that people use and talk about. um these idea for example of using intermediate obuscation techniques or enclaves to simplify some of the really tricky assumptions that have to be made in quantum cryptography is not something that was considered before it's a fairly new idea mixing IO with quantum cryptography is not something that was necessarily a mainstream thought although some of it was done in papers maybe five six 10 years ago um but it's now it's getting popular and that means that there's more young researchers who get into their career as quantum information people or cryptography people who say oh I will tinker with this approach that is a gamecher this hybrid this hybrid approach not just using purely quantum effects but mixing some of the modern technology uh from the hardware and from the mathematical side in cryptography classical cryptography with the quantum side side of things is one of the most exciting developments I think.

Okay, maybe um higher level it's not really like new results but what has happened to me a year ago was actually blockchain people coming to me and telling me that they were interested in our work. So that I find very exciting. Um and I'm I'm they you know now I'm convinced that if there is anything to do you know if there is anything interesting to come out of this this work this line of work that we're pursuing the blockchain community will be a good catalyzer for that you know I don't come from that I don't come from blockchain I'm not a web three person but I'm starting to learn about it and now so the effort that we need to uh to start also and it's it's far for I mean it's it's not something difficult um theoretically but is to provide infrastructure for that right so to find a good alignment between you know I told you about these research projects in Europe people are building these infrastructure they're testing things and they're you know very much willing to go beyond and uh try new thing maybe some of uh and and a community that is willing to invest its time and energy and money into this new infrastructure. I think creating this alignment is what has happened to me like the most exciting thing that has happened to me over the last 12 12 months.

Nice. Uh yeah over the past year or so there's for the in the context of this uh trusted execution environments these TE's that are used in the blockchain space uh there's been some interesting developments where there's some ongoing research now that to develop an open-source uh version of these but it's obviously a very long-term project and but right now what's going to happen in the next uh two three years that there's a core component the root of trust basically a signing component which is with a puff that will be fully open source so I think this is ongoing right now I don't know how much of it is public so but uh this is a new recent development is quite good I think at least it will give us a bit of a reference at least of what can be done because you know just to quickly say there's a it's an open question a bit in hardware security whether you can have secure open-source hardware because the closed source uh aspect is used as a defense mechanism in a way right for the attacker to not know where things are is a way a bit of a security property but so this is debated so now that ongoing effort will try to prove that no you can have a secure open source hardware Yeah.

Okay. And talking about attackers, I would say this is the last question because then we are over time. Um, in traditional cryptography, a substantial part of hacking is either you know figuring out some gap in the maths or most likely looking at code implementations and finding vulnerabilities in the way cryptographic libraries are implemented. uh in this you know different kind of like forms of cryptography there is a substantial hardware component. So my question is how does hacking look like in your research field?

What does a hacker do? We know that there are people trying to hack QKD equipment sometimes with success for instance. So if you can you know if you know if you can describe uh a few hours in the daily life of a PUF quantum hacker.

So they look very much like classical hackers that have and crudies. No I'm I'm not joking. I'm thinking about so there is this guy who created the field of quantum hacking called Vatim Marov. And so what he I mean it's a fascinating field right. So so he He's been attacking mostly quantum key distribution systems, right?

Some attacks, let's say some attacks use very classical properties. You inject light in the system. There is some back reflection and here you can you can see you can deduce what's happening in the in the system, right? And of course I mean then there is this traditional game of uh mouse and cat, right? that you can patch it and then further attacks and so on and so on but also uh I mean Macarov didn't invent the field I should so the one that invent the field is ho actually and ho also showed things that are much more quantum so we know that the hardware that does the photon counting for example if you send very bright light it completely changes the mode and you can use it for I mean it's extremely subtle.

So what I mean so this whole thing is it comes under the name of side channel attacks. I mean these are side channel attacks. These are attacks on vectors or uh physical um in inputs that are not covered in the mathematical model and some of them are very very traditional very classical uh and you can uh you know demonstrate them but but some of them use really heavy quantum theory. I mean Hunglow is a probably one of the best quantum physicist uh in the world or quantum information scientists and So they really consider the quantum effects. It's not only just, you know, hacking the hardware as a classical hardware uh hacker would would do it.

Cool. Sane,

okay, I can add to that because actually I was I'm not a hardware engineer, right? But I attended a a little workshop in early June in in Belgium on side channel attacks.

Okay.

Yeah. So yeah, this is interesting, right? Because I think computer scientists and software people we at least for me it's hard to think oh what what can you do but let's see if you take a phone or a chip right because it it it generates heat or electromagnetic waves and so on and power. So these are side channels that can be used to actually extract keys and break the security of a system. So yeah, the tools to do that though are very different, right?

They have things like an aoscope and other tools and then for more advanced hacking on hardware, people use these microscopes and to image chips and so on. So I'll just say one thing here because that's bit I think it's not a new concept but it's a bit maybe I mean I think it gives a pointer right that information is physical right that's a paradigm of quantum cryptography right I think from what I I've understood no right so uh so basically if information is physical right or and vice versa physics is also information then as soon because you have some secret information in hardware. Yeah, you you you can you can hack it not just via the information gateway but via the physical gateway. So yeah, that's um I think there's a lot to learn there basically.

Yeah. Yeah, I agree.

Right. I I I'm going to go last because I'm going to be the one who gives a completely unreasonable answer and Um the the answer from the the quantum cryptography side of things as in the device independent quantum cryptography side of things is that you do not hack the quantum cryptography side of things. There is no way to do it. The point of device independence is that what's in the black box that's it. That's mathematically proven to be secure.

What you attack are the preconditions. So you attack the interface, you attack the classical computer that produces the input, you attack the local sources of randomness, you attack the communicational restrictions that have been imposed. Um, you try to go around all of that, but that's that's the that's all you have. the really complicated quantum hardware side of things where you look at it and you don't know whether it's been done right, whether the amount of light is subclassical or classical, whether you can inject something into it that you cannot attack. But it's very hard to produce device independent security proofs.

They are not they're not something that you can do by hand for anything larger than the simplest of protocols. But it is the ultimately that it's trying to take away all of the available attack surface from the technologically challenging part. But the interface remains and that that's where you go and that's where you try and intercept things or change the outcomes or uh m tingle with the structure. That's that's the attack surface but it's pushed to the outside. That's the that's the point of doing device independent cryptography.

Okay. Thank you very much.

Can I can I just

Yeah, sure. One one more thing is that what worries me more is the community of people or hackers trying to attack postquantum cryptography. So classical cryptography that is supposed to be resistant to uh quantum attacks. The reason for that is that so to write these attacks you need to understand classical cryptography and quantum computing. So if we were invited all the experts on the field in this room the room will look empty right it's like five or 10 people uh in the world working on these problems and they are supposed to solve well or to save the information society and bitcoin and so on and so on.

So this is this is much more worrying to me.

Okay. Uh as a last observation uh that I wanted to make and then we close. Uh expect more attacks in the future. I think that one of the reasons why there aren't a lot of attacks on this quote unquote novel form of cryptography is because they are quite expensive at the time. To be a quantum hacker, you need to buy QKD devices in the first place, which means 100k at least just to play with these toys with the risk to break them.

By the way, uh with the US, I think it's the same. You need very refined oscilloscopes, maybe even an electron microscope with is expensive stuff. But probably when this technology will be will become more widespread and available and prices will necessarily go down because that's what economics tells tells us uh then it will be more you know more people will get to play with these toys and and break them. Okay, cool. I think we are done and thank you everyone for listening.

Thank you. Thank you.