Charles Guillemet (Ledger) - Post Quantum Cryptography And The Future of Hardware

GM everyone. Um I'm going to talk about post-quantum cryptography and the future of hardware. And let's talk about a little bit about this potential doomsday. My name is Charles Guillemet. I'm CTO at Ledger.

My background is cryptography and security. Uh I joined Ledger in 2017. Uh in crypto time it's ages ago. Um and I discovered Bitcoin in 2011. Uh at the time uh friend of mine was mining with his own computer.

Uh so I studied uh blockchain technology and Bitcoin. And I thought it was an amazing invention, but I really didn't get uh why it was interesting. So I didn't pay more attention uh until I joined Ledger in uh 2017. For those who don't know Ledger, Ledger is the world leader when it comes to digital asset security. Uh we estimate that 20% of the whole market cap is secured by uh Ledger technology.

Uh we have sold more than 8 million devices across 165 countries. We also have a B2B uh solution in order to manage your crypto uh in security, but also allowing you to create your governance policies. Um I think like Bitcoin and Ethereum are really amazing technology uh thanks to their permissionless aspect. With Bitcoin, with Ethereum you can completely own your value. Um and it's permissionless thanks to two main things.

On one side you have the decentralized consensus, meaning that no one can prevent you to uh make a transaction and transact and chain, interact with different smart contracts. And on the other side you have uh self-custody. With self-custody you really own your crypto, you really own your value, and no one can prevent you to own it and to transact with it. However, when we when we look at the figures, uh we estimate that around 600 million uh people own crypto in a way or another, but only 30 million self-custody. And out of the 30 million, only 10 million in secure self-custody.

So this is really the state of where we are. Um however, I think like self-custody is really uh the core value proposition of blockchain technology uh because of this uh permissionless aspect. So let's go into quantum computer. So quantum computer are very different from uh classical computer. They are leveraging uh quantum phenomenon, uh superposition, entanglement, and interference.

And they are using qubits. And qubits exist in multiple state at the same time. Uh this is a very different uh concept than a bit. Uh they can be very powerful, but they are also very sensitive to noise, and that's why we run them near absolute zero temperature. What you can see on the screen is not a quantum computer.

It's a big fridge. The computer is uh the very small uh at the bottom of uh the photo. The rest is just a fridge to maintain a very low uh temperature. Quantum computer are not general purpose computer. Uh they won't replace most of the computer we have, uh phones, and so on, because they are very well suited only for a few things.

Uh they are well suited for uh doing physics research, uh chemistry research, and also breaking cryptography. This is what we're going to talk about now. Um we have discovered the concept of quantum computer a long time ago uh in the '80s, '90s. And at the time uh researcher invented theoretical algorithm, meaning that knowing we have a quantum computer, we could break uh cryptography. And there are two main algorithm.

On one side you have Shor, and on the other side you have uh Grover. Um and it really matters because um most uh digital security relies on the system uh and and you have like two main issue. Uh we have an issue for encryption because today we can do harvest now and decrypt later, which is a big issue uh because you might have secret that you want to have to keep secret for a long time. And you also have the problem for uh digital signature. The timeline reality is very difficult to assess um because we we don't know when or even if uh one day we will have a quantum computer capable of breaking uh cryptography.

However, I don't think I think I really think it's a moot point. Because we are using cryptography in order to have trust in the security of our system. This is what cryptography is. As soon as the trust is eroded, then we need to recreate this trust. So just going back to what we could do with a quantum computer.

So in cryptography you have three main families of algorithm, encryption, hashes, and signatures. To be honest, the biggest problem is encryption. Every every single communication, every single thing where you need confidentiality today is encrypted with vulnerable algorithm. That means that actors could could simply capture all the traffic, all the unencrypted data, hoping that one day they will be able to decrypt it. And there is nothing we can do today because the data exist, it's encrypted, but maybe we might be able to decrypt it.

For blockchain it's not really a problem because we almost don't use um encryption. We also have hashes. The good news is that hashes are not fundamentally at risk, which is good news. And finally we have uh signatures. Signatures are used to sign message, prove ownership over over your Ethereum, um authenticate yourself.

There are many different use cases. A signature is the cornerstone of cryptography today. And signatures are fundamentally uh at risk. What's the current state of quantum computing? So again, it's a long research cycle that started uh in the '80s.

Um and the progress was has been steady. Like there there is no like today like we don't have any uh clue and tomorrow we have a quantum computer. It's a steady uh progress, quite slow. Um I'm in in the crypto cryptography world for more than 20 years, and that's 25 years that I hear that in five in the next five years we will have a quantum computer capable of breaking cryptography. However, there is a more momentum today.

Uh there are massive investment in the field, and we can see different progresses. You have uh progresses in the theoretical uh algorithm. Uh this is what Google presented uh yesterday. The their paper simply improve Shor's algorithm. Shor was initially uh studied specifically to break RSA, but in blockchain technology we are using elliptic curve cryptography, and there was not so much research on how to use Shor for uh breaking ECC.

So that was quite expected that we could improve uh Shor's algorithm in order to tailor it uh to break elliptic curve cryptography. And this and this is really the result that Google uh presented uh two two days ago. Uh the number of qubits required for breaking uh elliptic curve cryptography is lower than uh initially uh expected, initially thought. On the other side, uh we are also making progress into uh building a quantum computer. However, we we are we have we have still plenty of challenges uh for building such quantum computer.

And one of the challenges is to scale it. I have a large number of qubits, and this is what is necessary to uh break cryptography. And the more you have qubits, the more difficult it is to maintain the the quantum state. So this is part of the challenge we have, and both side are progressing. And now we are also seeing like uh big investment for uh like a hyperscaler with IBM, Microsoft, Google, uh uh AWS.

And as I mentioned, Google is uh very active uh in the field. In terms of investment, as you can see uh on the charts, uh the investment are um increasing maybe exponentially. Uh they have been multiplied by seven uh in the in the past uh by 10 in the past seven years, mostly uh in the US, China, and EU. It's completely like it's really a uh commercial competitive advantage, but it's it also become a national security topic. So that's also why there is so much investment uh in this space.

Again, difficult to say uh how how far we are from breaking modern cryptography. But as I mentioned, we would need a quantum computer with large number of qubits. I mentioned millions, but uh Google proved that it's only 500,000 uh to break uh elliptic curve cryptography. Uh but we are still like uh order of magnitudes magnitude away. Uh today we are more able to uh build around uh uh like a few hundred to around 1,000 uh qubits.

So this is more where we are and the scaling is not linear as I mentioned like adding more cubits is can be exponentially more difficult. However, all of this is a moot point. We don't really care when if a quantum computer will appear. Now we can see there is this progress into building this quantum computer capable of breaking cryptography. So now we have doubt the trust in the cryptography is a little bit eroded.

So that's why we need to move towards the solution. And the other good news we we have solution. The solution is is post quantum post quantum cryptography. So post quantum cryptography is a type of cryptography that is specifically designed to be immune against a quantum computer. This has been invented this has been invented in the 70s, 80s.

It was heavily studied when Shore and Grover algorithm were invented and we have these tools. Also, we also have standard the NIST which is the National Institute of Standard and Technology which is a US organization that are creating plenty of standard including cryptography standard has standardized the different algorithm in order to have post quantum cryptography. They also design a timeline where every single system in the world should move towards PQC. And this timeline is the two 2030 and 2035 for most systems. And the the big challenge today is really the migration because we have cryptography everywhere and we need to move all the system towards post quantum crypto.

So again the NIST recommendation is the full migration by 2035. We have the standard and now it's really a matter of coordinating and migrating. Unfortunately, there is no one standard there are a few of them. For encryption again this is where the risk is the biggest globally not for blockchain but globally. And for this there is no big discussion the decision is settled.

We know what algorithm to use. There is not so much drawback in terms of implementation. So now it's really a matter of implementing it. This is called ML-KEM Kyber. Not very difficult to implement.

Now it's really a matter of doing it and fast because every single data that is encrypted today might be decrypt might be decrypted tomorrow. So moving towards PQC for encryption is is not not a question anymore. And for signatures there are different families of post quantum crypto signatures. And two main families on one side you have hash based post quantum signature and on the other side you have lattice based signatures. Hash based have a few benefits.

The biggest one is that hashes are very well known and studied for years. So we don't have doubts on the security. We know how to handle them. We already have plenty of implementation. On the drawback side it creates very large signatures.

Also it's mostly stateful. We have limited hardware support today. So there are plenty of drawback for hash based signature. For lattice based cryptography lattice based signature the the benefits are really the size of the signature the performance as well. It's more performant that than hash based one.

You also have hardware acceleration that's coming. On the cost side it's a little bit newer. There is a it's a little less studied. And now in the Bitcoin community Ethereum community and different blockchain community there is this debate on where we where we go. Do we choose hash based or ML-DSA lattice based cryptography?

And it's it's unclear. It seems that the Bitcoin community prefer hashes. For Ethereum there there are plenty of discussion. I think a few months ago the foundation was more leaning towards lattice based cryptography and now we are more discussing around hash based. But for the rest of the world most of the system will implement ML-DSA lattice based cryptography.

So as I mentioned now we have to transition every single cryptographic system. And that will be a lot of coordination for telecommunication, defense, finance. Like we have cryptography everywhere. Like that that will be if we follow the NIST timeline we have like nine nine years to create to do this migration. But nine years to update every single system in the world is not that much.

So we we need to start right now. And for classical system there is the big advantage. So there is more cryptography because there there is cryptography everywhere. But there is a big advantage like the the CEO of Google can say by 2039 we migrate everything. We will do this this and that and that's it.

And this is what they said. When it comes to when it comes to blockchain the difficult part is not the migration itself. It's more to reach the social consensus. Like what kind of algorithm do we choose? What does it mean with with the size of the block?

Because if the the transactions are bigger it might take more space on on the blocks. What do we do for previous addresses because that means that your Bitcoin or your friends on Ethereum blockchain would need to be moved from your your ECDSA address to a post quantum one. So that means that every single user need to sign a transaction. And what do we what do we do for the the coin that are not moved? So there are plenty of questions to settle.

And the difficult part is really to reach the social the social consensus. And that might be extremely difficult. And this is really my main message today. As as a community we really need to push and decide quickly settle what's the direction settle the timeline and do this this migration. Again for encryption so at Ledger we are working on the on this topic so this is the same.

The good news is that we have an operating system that can be upgraded. So the operating system is essentially a big cryptographic toolbox and the operating system will give you sys calls in order to get this cryptographic services. And what we are going to do is to add this new cryptographic primitives. For encryption as I mentioned for blockchain there was almost no use of encryption but internally at Ledger we are using encryption for different things. So we are going to enable this post quantum encryption primitives.

And for signatures we are going to do the same. And this is something that we are working on. As I mentioned we really prefer lattice based cryptography because you have a better hardware support and better performance. So this is something that that we the decision that we are driving for for blockchain to choose ML-DSA type of signature. Timeline is is a little bit uncertain because quite often I I'm asked when Ledger is post quantum resistant.

Ledger can be post quantum resistant but if the blockchain aren't aren't not post quantum resistant it's it's it doesn't solve anything. So we are working with the blockchain in order to drive this transition. And at the same time you also have so with post quantum cryptography we have mathematical guarantees that the these algorithm are correct and are giving are immune again against the quantum computer. However, when you implement them you enter into a new world where you can have vulnerabilities different attacks that can be software attacks, hardware attacks. And this is what we are doing with the dungeon internally.

The dungeon is our internal security research team and they are doing different implementation and trying to make them as secure as possible because the math can be correct and secure. If the implementation isn't then you don't solve any problem. Also we are preparing the future of hardware at Ledger with a new secure element that will enable the acceleration of the support for this post quantum crypto algorithm. But there's this is the future of hardware. We also have to support the devices that we have today.

Just as a conclusion um today we have cryptography that can that is a little bit challenged by quantum computing. The good news is that we have post quantum cryptography. And again cryptography is a mathematical way to provide trust into the security of the system. I don't know when or if we will have a quantum computer capable of breaking cryptography. But again, it's not important.

What is important is to create to recreate the trust that people have in the security of our system. So that's why we really need to move towards post-quantum cryptography. And for us, in the blockchain ecosystem, there is there is this challenge of creating the social consensus, um aligning on what's the roadmap and the timeline. And we really need to to act fast, settle this, and create this transition towards post-quantum cryptography. Thank you.

[applause]