Future-Proofing Ethereum | Christopher Tam, BTQ | ETHTaipei 2024

all right thanks guys for for coming out a few friends should have probably made a more exciting title on on the uh presentation but thank you guys for showing up so really appreciate it um I recognize a lot of faces here there's some new faces uh I assume hands up if you're building in ethereum fantastic great great great and hands up if you just own ethereum bags you own some ethereum there we go okay fantastic fantastic so we're all interested in the future of ethereum so let's talk about what that looks like in a world with quantum computers so to set the context some facts about Quantum Computing as an industry it's a nent industry but it's growing pretty quickly uh just in 2023 there were over $0 billion do of uh government investments into the technology uh and this is up from2 billion in 2022 the scary part I think is that China dominates uh this funding with about two3 of the $30 billion in 2022 and uh China isn't the most open with their technology as opposed to the West um which is more for open science so that's an uncertainty and what we do have from the public data that that have been released so far you know there are many estimates but uh one of the papers from the French national research search lab last summer pointed out that it'll take an estimated 126,000 cat cubits to break 256bit elliptic curve cryptography which currently underpins our crypto systems in ethereum and just most blockchains how does that look in terms of timelines uh there was also a survey to Major Quantum Computing uh research companies and labs and they're estimating for example IBM is estimating they'll have 100 ,000 roughly maybe a little less but they're aiming to have 100,000 cubits by 2030 so we could plausibly feel that within perhaps a decade from now we would be within this kind of the hot Waters of needing to transition to pqc this is also top of mind for not only for companies but also governments uh the US White House has put out two executive orders on initiating uh Quantum initiatives and also transitioning of their government agencies and also trying to transition American companies to postquantum or they're called calling um yeah postquantum cryptography this has also been talked about by Major media Outlets that doesn't necessarily add signal to the noise but at at Le it at least gets the conversation started so let's talk about it first what are quantum computers very natural starting point well these are computers that act on what are called cubits it's kind of their fundamental it's like they're equivalent to our binary bits these Q bits are able to be held in a super position of states which means that they can be in a zero and a one at the same time and they are and one one or more cubits can be entangled into uh a state where essentially if one collapses it gives you information about another Cubit and Quant computers use this use the combination of these methods to solve problems exponentially faster this isn't every but unfortunately it's a problem it's it's they solve the math problems that are most critical to our cryptography so the way I like to characterize it and and think about it is we currently sit in the middle of two walls that are shrinking in towards each other on one side we have accelerating Hardware where companies are putting more and more research and development into building Advanced quantum computers and we're also getting advancements in the software side and the algorithm side where you know 10 years ago the number of cubits required to break elliptic curve cryptography was in order of magnitude more than it is today and who knows what what will happen in the next 10 years so this is all to say that Quantum Computing affects or it threatens our private Keys specifically in blockchains many of you will know that every blockchain account consists of a private and public key and essentially the private key derives a public key from for which you sign transactions uh and those produce digital signatures which are then checked against your public key and the idea is that you're supposed to be able to move from a private key to a public key but not the other way around and unfortunately quantum computers break that that assumption via Shores algorithm which is the Quantum algorithm for finding the discrete logarithm which effectively kind of breaks ECC so what is postquantum cryptography simply put it's the same type of cryptography except that it's just more secure it essentially it handles uh problems against attacks that we understand quantum computers are able to execute so we can think about these postquantum crypto systems as being the exact same you know the exact same topologically or or kind of functionally they just use different math problems underpinning them in order to have better security so let's just say we are able to just Implement postquantum cryptography and reclaim the safety of our private keys that would be very much ideal and then we would be done with a situation but unfortunately it's a little bit more complex than that because the algorithms used to generate public and private Keys become much more expensive so these three algorithms on the right these are the US government uh soon to be standardized algorithms and ecdsa is what we use right now and we can immediately see that the smallest n standardized algorithm is 10 times the signature is 10 times larger than ecdsa so ecdsa is 66 bytes for the signature uh Falcon is 666 and this grows even more towards uh dilithium and sphinx measuring in the few kilobytes so that's obviously a problem for blockchains every transaction is signed every block is signed now we want to pass them around to a massive validator Network and every one of those needs to be needs to sign off as well so how do we combat this issue well first focusing on the problem so the bis the bank of international settlements uh they conducted some research on essentially the impacts of postquantum cryptography on blockchains and what they meas they measured it through the the lens of duration of end to-end payments and through per second and they found that quum safe algorithms um especially using yeah using Post Corner cryptography has much higher uh end payments uh almost five times larger and then two orders of magnitude lower throughput so this is a huge huge problem for scaling blockchains something that we've done so well I guess with the vulnerable crypto cryptography today but something that we'll have to address in the future so how do we go about this well we've we've we've confronted the scaling problem before forign blockchain and we did we did that through the use of snarks so let's think about how we can construct snarks in order to solve this postquantum cryptography problem there's two kind of General ways to construct snarks you the first is using a polinomial interactive Oracle proof plus a polinomial commitment scheme and then you can do a linear probabbly probabilistically checkable proof plus some sort of pairing based crypto um but we know that any pairing based crypto is vulnerable because it uses elliptic curves so cancel that o we can't use that the next options that we have is looking from this family over here the polom IOP plus PCP this consists of an polom IOP plus a polinomial commitment scheme and within the Pol the family of polinomial commitment schemes we can't use any of the discrete log based or the pairing based because those are also Quantum vulnerable so what we're left with is essentially much smaller range of snarks that we can build those that consist of iops plus IOP based polinomial commitment approaches there's also the possibility of using Starks as well uh Starks are hash based uh so they don't fall to these they're they're Quantum resistant plausibly uh and something just to keep in mind here is that uh the Starks that we use today are while the cryptography is Hash based uh they they follow roughly like starkware for example uses 80 bits of security uh whereas we need to be up we' need to get up to 120 roughly to be Quantum resistant um and so that would be 50x uh almost a 50x GU larger proof sizes and also costs for doing Starks today so this is all to say that Quantum safe snarks and snarks and sorry Quantum safe snarks and Starks are possible but we just need to figure out a good way to build them so that's kind of the idea for for what we're trying to to think about at btq we'll just take a moment to think about how we all got here perhaps like I came from Canada have some of my colleagues from The Hacker House who came from India and the US and the Netherlands and in pretty much each one of our countries I think we all want to see blockchains play a role in our in our in our lives so we really want to touch on every level of the tech stack when thinking about uh when thinking about postquantum blockchain applications so let's start from kind of like we'll start from like the lowest level talking about blockchain consensus and how we can make that Quantum secure or at least one idea to make it quantum secure then we'll move up to like the actual blockchains that we use and then we can talk about some applications so one of the ideas that we've been playing around with at btq is something called Quantum proof of work uh this is essentially the same nice kind of proof of work uh consensus that that Bitcoin I guess created and uh and ethereum started off with and what we're trying to do here is figure out a way to allow people to come together and understand and essentially agree on a set of transactions in a block using Quantum algorithms rather than Quantum vulnerable cryptography so kind of putting ourselves on the same playing field as quantum computers the basic premise like today's Bitcoin proof of work uses Shaw 256 in order to essentially prove that you spent enough um essentially you you cons you performed enough work in order to validate this block and so that the analogy here is finding an an energy efficient Quantum hash function and it turns out there is a way to do this using a Quantum problem it's called a coar grain boson sampling problem you can think about this as essentially one of those uh fair games so it's like a game at a fair where you have these pegs and kind of goes down in a triangle you drop in a uh a ring and it kind of pings back and forth ping pongs and then it lands in one of the kind of buckets at the at the bottom well a CO grain boson sampler does this with uh photons and instead of kind of having these Rings you have these beam Splitters and these beam Splitters are able to essentially kind of Rand randomly distribute the uh the photon left and right and so what you end up with at the bottom is this kind of random apparently random configuration of where the photons have landed uh except it's it's actually it's actually very easy to verify because it's it's just a Quantum problem so the the most important properties of this is that it's actually easy to compute on Quantum devices it's hard to compute classically so you can't have anybody spoof it yet it's still easy to verify on the computers that we have today so everyone can participate in verifying a block so what we did is we took a look at like the traditional proof of work and then essentially just tried to replace the aspect for which the this this proof of I guess yeah the the vulnerable cryptography um is is used so just as as normal a transaction is created in the network and it's broadcasted to the network and included into a block and then that block is enter around to all these different monitors to uh to ver to generate a proof of and or sorry to um to perform proof of work of and verify and we essentially replaced that with this boson sampling problem where this block uh essentially contains its header will Define the permutation for all the different um kind of the the configuration of the boson sampler and the final permutation kind of the the the the probability distribution will be essentially then defined by the block header which is defined by the by the transactions within it and so Quantum miners essentially try to try to estimate this and once someone has found what they think is the right distribution uh they send it back to the network and everybody's able to verify it and yeah life goes on as normal so it's just the same proof of work but just swapping out Shaw 256 with course uh course grain boson sampling and what we found was this is actually far more efficient than the than like do doing like hash functions um it's almost 100% cheaper uh it takes a few hundred uh watts to perform uh this this problem uh Which is far less than the uh few megawatts that it currently takes in in Bitcoin so we think this is a really nice and and interesting problem and and we're trying to uh um yeah we're trying to to build some some prototypes and get this out into into production next we have this idea for uh for what we're calling layer Q which is this Quantum Canary Network for ethereum L is essentially a set of software components and libraries uh really trying to just kind of focus on replacing ecdsa with some sort of quantum resistant digital signature algorithm for this we chose Falcon Falcon being one of the the again like the N standardized digital signature algorithm with a smallest signature size and what we did was we constru we essentially kind of for um the ethereum monor repo for their the ja JavaScript library and then used um and then kind of implemented Falcon in JavaScript we also created transaction definitions that use these Falcon signatures rot a a provider which allows these uh transactions and wallets to interact with d apps and then also did uh did AG like signature aggregation on it so something akin to BLS signatures where you're able to aggregate over multiple postquantum digital signatures then we also Fort I see some gu guys here we Fort gu and uh created our own uh Falcon gu client and all of this is working towards what like what vitalic included in his last uh road map which is this kind of quantum safe snark or or Stark future for ethereum and so one of the ideas that we can start playing around with is having these like Quantum safe backups of our wallets for example by using account obstruction we can simply swap out the wallets that use ecdsa or I suppose more so we can take a wallet swap out ecdsa with Falcon and there you have what's plausibly a Quantum resistent wallet and perhaps the idea would be that everybody has one of these Quantum safe wallets and treats it as something like a savings account where they keep most of their tokens and uses kind of conducts their dgen defi trading strategies from their checking account which is ecdsa still we can also try things like doing Quantum safe multisig wallets where you have a Quantum uh I guess yeah a Quantum wallet or contract and you need the approval of that contract in order to make any transaction and so this is preventing any Quantum adversary from simply driving your private key and then initiating a transaction from your wallet to theirs so at least they would need to be have to have to be able to break both the quantum resistant and Quantum vulnerable vulnerable uh wallets in order to to do so and then another idea is potentially having this kind of U kind of playing off of like the state eth and the rap eth ideas where you can stake your to stake your eth and then kind of continue to to perform or like earn yield on on defi um doing something with uh with kind of layer cue where perhaps you store your tokens in this Quantum safe uh Network and then you're still you still have access to all the traditional trading strategies uh in ethereum and and the L2 ecosystems cool and finally moving on to the last kind of more like highle application which is perhaps one of the one one of the applications that will affect all of us uh which is quantum money or or essentially Quantum safe cbdcs so Quantum money isn't a new idea at all it's essentially this uh it was yeah first proposed in the 1970s and it's just this idea that uh you have these digital Bank notes that can't be forged by a quantum computer and this is a huge interest to the US government and pretty much every major country who's experimenting with cbdcs um and because they've already kind of publicly acknowledged that Quantum Computing is a huge threat to their to their financial cyber security industry um but essentially if anyone is is going to be working with digital transactions and digital currencies they need to be thinking about Quantum attacks so we can think about digital signatures as a as as the equivalent of a security thread on today's Bank notes so you know when you get like a $100 US bill you hand it to a shopkeeper they might look at it through the light and check it has this seal on it they're trying to verify that this hasn't been forged and this that this has been issued by the central bank or or the minting press and we can think about digital signatures as playing the same kind of role when you send a transaction to somebody on the internet they can verify using using your digital signature that maybe it was signed by both the central bank and it was signed by your private key to make sure that it was legitimate so in this idea or in this scenario we would simply have this kind of signing utility that for every for every digital currency that's kind of minted you simply sign this using post Quantum cryptography and then verify it using uh yeah the same kind of traditional verification methods we use but the idea is just that we want to be Quant yeah Quantum proofing all of these cbdcs and yeah this kind of comes full circle uh this idea was proposed by Peter Shore who also invented shes algorithm the very algorithm that threatens the cryptography that we use and uh yeah and I guess it just speaks to the kind of the nature of the problem it's kind of if you're going to be have if you're going to have quantum computers you also got to have Quantum Quantum money so the key takeways is that Quantum Computing could be the biggest R rug pull of of blockchains uh and upgrades to Quantum analoges are imminent so we should be starting discussion now and is it even money if it isn't Quantum safe so thank you very [Applause] much my name QA time does anybody have questions it's scary any questions Quantum Computing scary guys any okay is there any blockchain that is more prepared than another to against a Quantum Computing yeah there are a few Quantum resistant blockchains um qan Network ailion which is kind of like a um like a Monero like a Quantum resistant Monero um so there are teams who are working on this uh I think ethereum is just such a big beast that nobody's really been able to replicate ethereum to to be quantum resistant and so I think that's probably one of the largest kind of or most interesting problems because we've already developed all of the kind of like it has ethereum has the network effects and it has the economy to to reflect that um and so transitioning like you know our current industry to you can kind of Imagine like our current uh framework uh to to be Quantum resistant in ethereum is probably most interesting and challenging task but um yeah I think there there are ways to do it and and seems like is also thinking critically about this so all right thank you good presentation by the way thank you very much any more questions for Christopher okay thank you Christopher thank you and now we are going to take a break for 30