13062026 CHAPEL STATUS OF QUANTUM

Hey guys, uh thank you everyone from for being here. Before we start, uh I think you know we have Solana representation, we have Bitcoin representation. Is there some Ethereum in the crowd which feels like they have uh some vague knowledge about how [ __ ] up Ethereum may be in the next years you want? Yeah, please welcome on stage.

Okay, so this is Mate Cari from the Foundation, right? Okay.

Not from

Okay. Well, you are an Ethereum. You identify as an Ethereum.

Yeah.

Okay. Cool. Okay. Okay, guys. Let me start with the first question.

Uh I will keep this very informal. Um in your opinion, which chain is the most [ __ ] up at the moment and why? Who wants to start?

Going once, going twice. No one wants,

you know, they're all [laughter] pretty much they all have issues of Yeah.

Yeah. Okay. They are all they they they all have issues of different types. Um I think you know people might be inclined to say Bitcoin because it's um there is no centralized governance that will just switch a trigger for everybody. Yeah, true.

But um Ethereum has such a high surface of attack, a lot of stuff to upgrade. Like Bitcoin has a relatively narrow target and problem. And I think that eventually governance will not be such a big deal. So Ethereum has to upgrade the protocol, has to upgrade transactions, consensus, data availability, but also all the ecosystem, you know, all the applications deployed on top of Ethereum. If they're [ __ ] up, Ethereum as a consequence also gets uh um attacked in this blast, you know, and we need to upgrade oracles, we need to upgrade bridges, uh you know, it's it's a big ecosystem.

Solana has their own issues as well. uh but uh yeah I would say Ethereum just because it's big and it's important and you know if some minor chain collapses you know also kind of whatever honestly

okay

uh do you Leo do you want to give an opinion about Salana here what are

so definitely we have a lot like a lot of problem because naturally Salana is designed to be speed uh for speed it's designed to be usable it's designed to be cheap uh naturally That's probably the biggest problem. So when we talk about consensus, we talk about like uh sending packets and in general it's like it still needs to be fast if we want to keep Salana great as uh as we as we all know right now. So probably that's probably one of the biggest issue that I that I would see uh on Salana. But at the same time like I think we have some parts of Salana that makes it kind of easier to to be quantum comput. So probably after I'm gonna gonna explain why.

Just a quick question. Why did you switch to BLS just now? Basically, that seems very

Yeah, that risky.

Yeah, that's the probably that's the the biggest problem about consensus and the fact that right now there are no uh aggregate like aggre aggregate signature for that are quantum secure. uh at the same times like consensus was like uh it zero proved that consensus could have been uh broken in some sense and so that's probably the most important thing that we need to optimize right now. Quantum day is definitely much more it's a very important problem but at the same time like it's not a problem that we should optimize right now if we have higher problems like consensus not being as good as it should for blockchain.

Okay. Uh Eric, can you give us uh a bird's eyee view of the civil war that is happening in Bitcoin around this issue? Like yeah. Uh so I actually think these other chains are lucky uh that they have a quantum issue. Uh Bitcoin is not so lucky.

And the reason that I say that Salana and Ethereum are lucky is because frank frankly if you've been looking around in the crypto space recently um chains they need something to do right now like with the DeFi uh slump and all the negativity having a mission and executing on the mission and saying like hey we're actually reaching quantum uh s postquantum safety and uh we're way ahead of Bitcoin like that can be something that the Ethereum community can use or like the Salana community can use. It's something that you can brag about and say you should move all your funds from Bitcoin to our chain because we are now the quantum safe one and they can do it right. They just got to come up with a road map and they got to it's it's hard. It's not easy. There's like Wolf Gang was saying there's a lot of migration stuff that needs to happen also for those chains.

they can do it and they can gain an advantage over Bitcoin by by embarking upon that and then writing very nicel looking blog posts and having nice animations when you click that it says that it's now quantum safe. So I think for them it's an opportunity. Uh for Bitcoin it is um uh so you asked which one was more [ __ ] I think if Bitcoin is [ __ ] then the other ones you know they're correlated the prices right. So if Bitcoin goes down goes down uh 89% because there's a quantum attacker then it doesn't m doesn't mean doesn't matter so much if some of the other ones are better equipped. They're going to go down as well.

So like we all live and die by the mothership. If uh because eventually all the other cryptocurrencies wants to become like Bitcoin, right? They want to be the big boss in the room. But if it's proven that once you get to a big big enough size that you're the big, you know, two-tonon gorilla and once you get to that size, you're no longer able to move around quickly for for uh dangerous threats. If if if that is the ultimate end state for any like consensus system that grows large enough then then maybe all cryptocurrencies are [ __ ] even if there can be nimble now when they're small.

So Bitcoin now stands for the grand test of fire. Can we take on this challenge and uh right right now the the the discussions climate sorry I can go on on this topic maybe forever. So I'm going to like try to keep it short. Uh right now it's not in a good it's not a it's not a great situation for Bitcoin because um we have a lot of people within the technical community of Bitcoin that do not really take quantum as a serious threat. You know there's it's very common among some of the actually actually smart researchers to say uh well no quantum computer has ever uh ran shores on a fall tolerant machine over the you know 15 bits or something like that.

So because they haven't seen it yet they think it's not going to happen and maybe there are like maybe it's possible that no one builds a fall to tolerant uh quantum computer that can run shores. Maybe it's possible, but you you can't design your your your uh world critical, you know, monetary system on maybe someone won't figure it out. Uh like you have to think that okay, well this is a real threat and what are we doing about it? The problem is that doing something about it forces Bitcoiners to meet the hardest existential questions in the Bitcoin protocol that we've ever had to face. And it's also one of those really complicated things where even if we decide to do something, we need to have like a migr migration window that's going to be like I don't know what's reasonable like 5 years, 10 years, something uh something within that range.

And we don't even know if we have that much time until quantum is here. So, Bitcoin is in a really bad situation from a cultural standpoint, from a technological standpoint, and also being the the the leader, the big gorilla where consensus is the most difficult.

Yeah, I agree on this, especially on the fact that users won't migrate instantly. Many people probably won't even know that they have to migrate. Um, Mateo, I keep say seeing every year a five-year road map from the Ethereum Foundation, which is different every year. So can can you give me a

I am not from Ethereum foundation so I can

know I think it's important to understand Ethereum what can say is a very big problem because it's very big and if you go on Ethereum storm map you can see all the part of the protocol have to migrate to go postponum it's really hard really complex but I think uh what the Ethereum community uh try to do now is uh tackle the for many different angles and for example the consensus part is one of the most critical part of the all the system on Ethereum and the stuff the Ethereum foundation try to build now it's very impress uh the linings the the ashbased signature for this migration is important because also uh try to develop zero knowledge proof better for aggregate signature it's not like aggregate because ashbase can be aggregate but is a way to tackle this problem and I think is the only one the only chain that do this and do this in public because this is another important part. Ethereum is a community that try all the time to um I am part of this community for sure for try to make it public discussion about this because it's not only one solution and uh the possibility to have this crypto agility and try to discuss and resolve problem together is very important and in many other chain it's like okay we pick this uh sign and that's it and we resolve this problem and this This is what you can read on X and stuff like this. But the problem are more complex. There are many researcher they try to do the best part to have this and and the problem is split in two main part. We can say three but the most important for me is the consensus.

They try to tackle using lin sphinx and the other part the execution layer using another scheme. for example, we try to develop something and then if we want to talk about this, I don't want talk about this because is I just go on this couch and try talk. So uh but uh the idea to try more stuff and see what is survival of the time it's nice and in bitcoin there is also uh some way for mitigate this problem but I think all the first step is try to create some crypto agility and see what is work on bitcoin for now uh it's like it's just uh st situation but we can Okay. Um I have a question for all of you. So uh we know that you know we have a lot of announcements from quantum hardware companies about their timelines etc.

Uh for people that are not familiar with quantum uh at the moment the quantum computing environment is heavily dependent on venture capital. All these companies are not revenue positive and they basically need investors to keep building. Uh so obviously you know marketing is very heavy on on everything like every time they publish a paper it's like boom we did the best thing ever. So my question is how much do you believe in you know the timelines and announcements that they do they they give uh do you have like a favorite player in uh the environment in the landscape and most importantly uh how do you filter if you try to filter you know [ __ ] and noise from true signals and if you can give some suggestions and tips to the people in the audience to you know if you have some for addressing this problem. Whoever wants to go first,

I mean the best way is to read the papers. Yeah. You have to put in the work.

So you have to learn, you have to read the paper, learn, study, understand what it means

or ask Lord to uh summarize it for you.

Reliable that who you trust and you know you can trust and there are no conflicting interests. But yes, the best way is to really read the peer-reviewed research. By the way, there are also companies that don't publish as much as before and that's maybe also a signal. So, you know, we cannot rely only on public signals anymore. And uh there is that.

Of course, you you shouldn't believe just all this u marketing on applications that will revolutionize data science or you know efficient supply chain without any proof of that. And it's very very important to think about applications because this research will need effort and will need money will need funding and there must be ideally one would have some low hanging fruits in terms of application to fund all this very very deep uh you know investment. Um so yeah it's a little bit obvious what I'm saying but you should read the the papers

read the [ __ ] manual

and uh if you want to look at road map it's good you know to check if they ever you know uh these companies ever respected their previous road maps and you know some did actually pretty pretty well and some others not at all like complete BS

okay look at that

so I actually like the fact that a lot of people like saying Qday is coming just because it put pressure on uh on the right people to just like step up and figure it out. At the same times like uh for us in general for I don't want to talk about uh Salana but in general for for us as people that build on chain uh it's uh it's very important to not prioritize the marketing. So it's like it's very very good to know that that could happen. At the same time it's like make your product worse to make it quantum safe right now is probably not the best solution for for all these application even because as far as we we all know yes crypto has a problem market fit but at the same time it's like still trying to find it. So trying to optimize for problem that are not here yet.

But at the same time having a lifeline uh Solana uh was cited in the Google paper because uh blue shift my company actually developed the the first quantum signature on Salana that it's available right now. So the the VM is safe right now from quantum attacks. There are a lot of parts that actually are not safe yet and uh we'll need to work on it. But at the same times like somebody wants to make their asset quantum safe right now they could do it. It's an optain.

It's not very efficient. It's not perfect. At the same time, like it's something that if anybody fear that quantum is here, they can still do it.

Okay. Um so I I I hear these conversations all the time on different quantum panels where people are trying to give their own Q day date. So the the point is that bunch of people sit here and they say, well, I think it's around 2035. And someone says, well, actually it's sooner than that. 2029 and what what is the point of having the conversation?

What is the message that is trying to be conveyed to the audience? The message is that we're supposed to say, well, we think it's like 2030 and then what people are supposed to get into their minds is that okay, well, we need to be ready before then. But that that is uh actually a mistake that that is uh grossly uh like misrepresenting the challenge that we have here because it's not it's not it's it's not about you get a bunch of nerds together and you take sort of the average of when they say that a quantum attack is most likely to happen and then you think okay we got to be ready before then but that's not the time when we have to be ready. We have to be ready there's there's two things. So what we should be talking about is like when do you think there's a 1% chance that a quantum computer destroys Bitcoin and Ethereum and Salana and all that stuff.

When do you think it's one or maybe 5% chance? Pick your number or half a percent chance then then that that is when we have to be ready like are we going to risk the entirety of the cryptocurrency protocol because uh you know we we we didn't think the risk was like high enough. If it's 20%, yes, we have to be we have to be migrated before like do that 20% chance, right? Um and then we also have the migration windows to think about. So like if we if if we say okay Qday is most likely to happen 2035 and but then we also agree that by 2029 it's actually a really significant risk.

Then when do we have to get started? Well, then we have to get started last year uh with with the migration or or two years ago with the with the migration. So, uh like the only thing this discussion is doing is like by which date will we know we're irre irrevocably [ __ ] beyond saving and uh what and what is the usefulness to that of that number for us? I don't think it's so useful. I think it's more useful to say well I think we should be I I think that it might happen like 2029 20 2030 that that that is when I'm starting to get scared and of course then we should prepare now on on this by the way I had a blog post for a couple years ago the cool thing about thinking probabilistically is that then you can literally plot what you should do so if you assume for instance that the probability of today follows a normal distribution distribution which you know it's a an hypothesis I would say let's say three standard deviations to be sure you can compute the cumulant so basically how the probability increases over time uh and then you can you know weight this cumulant for the with the market cap of the coin and you can literally see okay I have to spend this much money every year for instance on research and the cool thing about it is that you can literally talk with skeptics that say I think the possibility is like 1% % uh you know before 2029 whatever say okay 1% for Ethereum is like $40 million in R&D uh and that is literally weighted on your own belief and your own risk assessment not mine which you know so yeah I I agree with you and um I I think we should you know prepare and factor enough time before

yeah another thing I think is important to understand what is mean the Q day because uh if something happen I think it's not something it's like an on off uh it's like uh we maybe see moving some wallet that uh there is not moving asset for year what what is the the the fact that is okay now is the Q day because I think when is happen public okay this is the the worst Q day but I think is starting happen before the the program is really uh public. So it's it's really hard to see uh where is the moment we have to uh to change all the stack and and what we can do uh now is try to make uh system for quantum delay system. We we have a paper on bitcoin on t with something similar on ethereum. uh it's like uh is an ether we we don't need we don't need when when this stuff happens we we can uh see clarity this part so I think the best part for uh every protocol every user try to uh create some vault that are postquantum just for example have some PQ like on Solana on Ethereum there there is a lot of verifier public for verify uh PQ sign bitcoin is hard. Yeah, I know.

But there is some other method for for example easy method for uh uh just stay secure because if for example you move your assets to a wallet that not to spend nothing you are secure because you not expose your public key it's more hard because there will be okay but the idea is uh if you don't touch your money you are safe and another important part I think for now we don't make uh uh the panic on for selling We we need also to inform the people there are some strategy easy strategy just to move funds to wallet that not spend nothing and uh and try to migrate a little by little but uh when the Q day arrive um we don't know when is this day so it's like uh we we go step by step and

yeah in general I agree so it's It doesn't have to be a Q day. The capability can change a lot over time. You know, maybe at some point someone is able to do this extraction in one month. It's not the same attack vector than doing it in 9 minutes. And also, yeah, you shouldn't think only about the timelines but also who gets this capability first.

That changes you know when you are trying to understand what is the attack uh you need to know who has this capability and yeah we don't know.

But the thing is it doesn't have time. So the good news is that um there's a lot of work to be done and there is such a good organization and people coming together. I wouldn't call it summ centralized by the way because it's clearly open like people can come and propose and do stuff. Uh but uh there is good organization I would call it there are people who are good at organizing and inspiring and putting people together which is good. So it is working very hard to do this by 2029 and uh yeah their five years road map by the way at least the last years is con consistent.

now

rebranded from a beam chain to lean ethereum but the issue is there

they don't have a road map it's a stroll map because it's more more big

but it's a beam chain still and beam chain was seen as so no why do you have a five years road map we cannot wait we have to be faster but actually there is a lot of work to be done to the upgrade and uh fix Ethereum honestly it will happen I'm confident

and also using approval stake is a problem for uh the agreed senior all the stuff is really a problem. For example, for the consensus, Bitcoin is more secure than Ethereum.

Okay, I want to ask a last question to close the panel. So, um many of you have talked about cryptographic agility. Uh one problem that we have is that uh elliptic curve based cryptography which we know is vulnerable has been battle tested for more than 30 years at this point. So it's a very proved um cryptographic suit to use. Now obviously we are switching elliptic cryptography for something else which sometimes as in the case of like kyber lithium etc latisbased crypto is more experimental.

So in the traditional world the way to mitigate the risks of adopting something that is not you know as battle tested elliptic curve cryptography is that you run uh the cryptographic primitives side to side. So for instance, you take a certificate, you encrypt it with elliptic cryptography and then you wrap it into a latisbased signature and then you have to break both to make sure that you know to to crack it. Basically uh in many blockchains this is unfeasible because it gets too heavy like we know that uh problems with like the lithium on chain are exactly that if you want to you know have blocks uh with the same number of transactions you have today the blocks become super huge. So basically you have to commit on something very early uh which may backfire very badly. How do you see this problem and what are you know the strategies that you know you think may work to to solve this?

Yeah, I I think there's a pretty good uh solution to the problem. If you if you if you imagine that the way we move to postquantum safety in Bitcoin is that we uh we have a Merkel tree. In this Merkel tree there are multiple paths of spending your bitcoins. Uh so instead of having like there's one branch that is quantum safe and there's one there's that's ECDSA and then then you plan to sort of deactivate the ECDSA path when Qday comes uh instead of just having a postquantum like only uh let's say now it's a it's shrinks shrimps or some lattice based or isogyny based instead of having one leaf that is just that you also have ECDSA on top of that then you don't actually have the issue that oh it's know much much bigger because adding ECDSA to like a hashbased scheme is like adding what like 10 extra uh 10 extra uh bytes that needs to go on the chain. So I'm I'm in big favor of like hybrid schemes where you where where you layer the security so you don't throw out DCDSA to add uh hashbased or isogyny based or you you layer them on top of each other.

It is a little bit against the design philosophy of Bitcoin because we never do um security in layers like that before. Uh but I think in this situation it's definitely the right choice and I'm hoping that that's something that's going to like grow in in terms of like grow in in favor within the community. Dan Bonet talked about it on a podcast recently and uh you know Dan Bonet is like the mentor of many of the uh other people like the Andrew Andrew Pstra who was the chief research officer of Blockstream also Benedict Bunt and uh also um uh Robin Liners is a big like quantum bear which I think is quite funny.

Yeah, I agree. And uh honestly root is very nice. So

yeah, [laughter]

it works very well for this purpose and you you want to give people optionalities and um yeah, you don't need to prescribe a specific um protocol for approval of transactions. Give people optionalities, give them options to do hybrid who keep using really for me that the big question for Bitcoin will really be lost coins and that's the only point where

I can imagine chain splits.

We'll see. Ah well yeah the the thing is uh what to do if we want to freeze uh all the P2P or burn P2P all the P2P K coins including 1 million Sabatoshi coins that's going to be a big question and there is no easy solution. So you know when people tell me is it more of a governance problem or a technical problem I hate this question because how do you measure exactly but normally when you have a governance question is because there is a big technical question or a problem that cannot be really solved and uh the problem here is that there is no way around it um lost coins they will either be quantum mind or they will be

some someone proposed also this approach of not freezing the coins completely but just allow them to spend uh very little at a time and then the idea is that you can still withdraw the coins but you cannot flood the market with them.

Yeah. Rate limiting.

Yeah.

Yeah. Hourglass.

Yes. Exactly.

That's that's a reasonable proposal but it still feels like a compromise.

Yeah. It is.

It doesn't feel like the solution but you know maybe that's the best we can do. So yeah.

Okay.

I think that what we don't have to canonically choose one signature. Naturally, some signature are better for certain use cases. Some signature are more are better for others. Uh the coupling for example the seek verify by not saying we're not going to use ED2519 but we're going to use for example A. It's or like whatever signature anybody wants to do it.

I think it's a more reasonable approach of like saying we're not going to put all the eggs in one basket. We have multiple contributor. we have multiple people that can work on at the same problem. If we make the SK verify broad enough, we can have like multiple concurrent signature that are on chain and we can disable the one that are not safe anymore when that happen. Naturally uh for for Salana the uh currently one one idea is uh using a just because it's 555 bytes so it's it's still pretty small uh seems to be extremely safe.

Uh and so the the next goal is just like make it faster. Uh make sending packet faster. Uh scale the the ingress, scale the algoress and just like at a point hopefully uh we're going to like it means that we just need to do a f 15x on performance to to just like keep parity with what we have right now. I I think the approach to uh start using ashbase there is the more uh secure because the primitive cryptographic is uh ashbased so it's easy is simple have some problem is slow but you can uh change the angle or you use your sign part uh so the idea is not just to use different design but also try to use in a different way. We we try to do this also Ethereum try to do this because you the idea to have zero knowledge proof or aggregate consensus it's something huge but uh the primitive is secure because it's just ashing and uh if you try to layer more stuff uh together one uh on another I think the the stuff can crumble because maybe you are just uh ST to the HDS.

So it's like you can do because it's cheap but uh if we try to think about this maybe we don't do the the step forward to try to create something more secure. Um for me using uh new sign is nice but uh there is not the proof of time and the proof of time in cryptographic is important because we don't joke like Antonio say to me sometimes we don't have to joke with the cryptographic the cryptographic is important part so uh we need also uh to rely on primitive that more secure dash base is the more secure for now

okay I think we are out of time. Uh, thank you very much for this panel. Um,