'Bunker Mode': Is Crypto's Cryptography Running Out of Time?

Transcript

buying directly from Ledger in this case would be the best way to minimize that risk, but that may bring about um other risks. So, there are legitimate reasons why somebody might want to buy from an authorized reseller. We've seen a lot in the past of various hardware wallet companies or or logistics providers for those companies getting breached and that leaking data. Some people might want the option of purchasing a hardware wallet in person in a store with cash uh so they don't have their uh personal data leaked on the internet. Another reason is even more basic than this why why authorized resellers are used in certain countries have um tough laws on the on the import and export of uh hardware wallet or cryptographic devices. So one such jurisdiction is

actually Vietnam. Vietnam you have to have a license to be able to import cryptographic devices. So um if if devices are being shipped from France as an individual buying that device it's is pretty tricky and you could get turned away at customs. So that's why they're there authorized resellers in in those jurisdictions. Ledger could have maybe what I would have seen that maybe a good idea is to tell people that when buying a ledger from uh a third party even an authorized seller to uh take if you can have a look inside and uh verify that the hardware is as shown into the manual that ledger provides because ledger actually provides in the manual of each device picture of the the inside of the

device how things should be but on the same page uh ledger O right that opening your device will void the warranty while showing pictures inside if you say at the same time that the warranty is going to be void if you you look inside the fact that this has been known by Ledger for a while uh should have at least triggered uh Ledger to uh issue some generic guidance so that maybe some customers would look at the device. We've seen actually a number of versions of the implant. Uh the very first version that was found was found late uh last year and was presented I think in May or late April this year. It's basically a board with some wires that connect to different point of the ledger. So it's very uh easy to see.

It's very unnatural and uh from that version we've seen versions that have an orange flex board which looks more professional but it's still a lot of work to install. The new version we're seeing have uh black boards. Actually, for the Nano X, the board will basically just fall into place. You just put it on the board, move it a little bit, it just clip, and then you just have to put some point of solder to install. And very clearly the the spy implant has been improved. And uh whoever is doing this is learning and making improvements and not just very small improvement but very giant leaps doing real research with uh a lot of funding to create those boards.

Not all potential encryption breakthroughs are equivalent. Something big enough that it's going to break almost all forms of currently usable cryptography, like public private key cryptography, has far bigger implications than crypto. Like, yeah, your coins are going to zero, but do you realize private internet communications are now impossible? So, we're back to like the 1990s where you can't put your credit card on the internet at all. Right? This becomes a totally different level of problem than the problem of hey we have some blockchain specific issues to deal with because in that case great ecommerce is dead and like email is no longer private. Those are call it step function levels of problems far above the Bitcoin blockchain. Right? And I know crypto people like to look at and

think about the crypto system, but look outside into the world at the implications of some of the predictions you're making and you'll realize this is a little bit like, hey, if stable coins break because the US Treasury defaults, it's like, hold on, if the US Treasury defaults, he cares about the stable coin. I also think there's been a big misunderstanding of information security in this space, which is to say people have looked at tools that allow them to self-custody or things that they sort of have a mental model of keeping the private seed safe that ironically rely upon a bunch of things like vendors you cannot really do diligence or devices that you can't easily take apart and understand. And this is where people have got themselves into trouble because hypothetically, just hypothetically, if you had created a MetaMask hot wallet,

which everybody will tell you is not safe, and just written the private key down somewhere secure, put it in a fully encrypted password manager, and then never transacted with that thing, nothing's been stolen, right? That is the answer. If you just stuck it in, I don't know, Proton Pass, you're >> I don't know. I think Joe Lubman's going to push back on that, that MetaMask isn't safe. Um, for sure. >> No, no, I'm saying that's the perception that hot not safe. I'm not agreeing with that, but I'm saying the meme was it's not safe unless you're using like a cold storage. And this to me is a misunderstanding of the security surface. When you're an individual, you have limited time and limited ability to verify. You should actually be oversolving for simplicity. If you want to do these things and that is not what people have been doing is we've looked

at political realignment. We've thought a lot about right left. What we haven't thought a lot about is young people versus old people because the argument is basically boomers are like we've been promised all these benefits. We need to get paid these benefits. Yes, the budget is large but just raise taxes, right? Cuz we need to get these things. And the counterpoint, you know, I hear this from my students is I wasn't even born when you guys voted these things for yourself and then you ran up a negative $440 trillion tab on this thing by running a huge deficit. Why the hell do you expect me to pay for that? Sounds like your problem. And I think the political parties are going to start having a reckoning of if you really start moving aggressively to defend benefits for the elderly. You are going to lose all of

your young voters because young people rightly are pointing out, hey, we weren't a party to this agreement. Like the 65year-olds don't get to vote amongst themselves to steal all of our stuff to pay for their things. Like we're not cool with that. >> Google's worth trillions of dollars, right? And they pay 250 a day, right? Now you know exactly what if if someone had exploited that um remote execution bug in Chrome and like you know and mass right across like the internet or whatever how much money in the market cap of Google would be you know evaporated right like a hundred billion a billion like so it's still you know it's weird that like suddenly there's this pressure of oh you're a crypto

company and we could have done this thing and exploited it for a billion or 10 billion or whatever, right? Therefore, you owe us $10 million when Google if they got owned would, you know, lose billions of dollars in market cap and shareholders would be harmed and and and they still are paying out 250k. It feels like a double standard a little bit, right? Like >> it does. And it also the other thing like when you look at it from a company's perspective, right, if you pay if your bug bounty is basically like limitless, right? or if it's scope to like the cost that it's going to cost you, right? Like to your market cap or whatever. The long-term impact or like how bug bounties sort of pan out is that eventually like no companies can afford

this right? >> I build all sorts of stuff, man. I have spy devices in my house. I replaced my Alexa with my own Alexa. So, there's a thing that's always listening and taking all of our conversations and >> Wow. >> Yeah. Yeah. So, dumb thing number one. Dumb thing number two, I made like a blood wallet that you have to like bleed. That took like a ton of hard work and it took a lot. This was the worst. It's like the psychosis loop of iterating with AI while it's like just one more fix, bro. If we just if we do one more fix, it's going to work. And I'm like over here like bleeding for this this wallet. I I'm making my own hardware wallets. Like I think DIY hardware is a thing. I'm going to be showing people at devcom to do that.

Okay. >> I I love it, dude. Just give the give the set up Linux. Set up SSH so your clanker can talk to your Linux. It can control your whole operating system. It's scary, but I let it rip. And then that thing has observability into my whole uh electronics bench and it can see things and I can plug things in. So it it can run the chips. It can see where I have the wiring and it could tell me how to you know do it better. Now if I was doing something nefarious of course they would like track that back to you know the fourth thing or whatever. >> Look at me right is the like quintessential example of this right?

They curated three cohorts of like 10 teams maybe right 30 teams to build consumer apps on this like real-time chain and and and like literally 95% of those teams absolutely wrecked them like abandoned the chain as soon as they got enough you know traction started making their own chains like all kinds of crazy right >> as a chain that's trying to build its own ecosystem if you're vertically integrated from like you know you're weirdly in this position especially for the L2s, right? Where like Ethereum is the bottom layer. You can't own that, right? So, you can't be fully vertically integrated cuz Ethereum is your basement, right? But above the basement, you have this whole house up until like the roof where like there's a party

going on and you have no control over it. And then they're like, "Actually, let's go down the street. There's a cool club. Like, see you later." And you're left with a empty house that's trash. And you're like, "What do we do here?" Right? >> What if your crypto could do more than just sit in your wallet? Nexo is a digital assets wealth platform where you can generate daily interest on your crypto or borrow funds against your assets. Today, Nexo serves more than 10 million clients. Find out more at nexo.com. One more thing, we've got a listener survey open. It takes just a few minutes. It's anonymous and it changes what we make next. Use the QR code on screen or go to unchanged crypto.com/servey.

The link is in the show notes. $540 million. That's how much concentrated liquidity sat idle in a given week in the first half of this year. Hi everyone, welcome to Unchained, your

no hype resource for all things crypto. I'm your host Laura Shen. Thanks for joining this live stream. Before we get into it, a quick ask. We're deciding right now what Unchained looks like next year. Whether we add a weekly recap show, what time we stream, what goes into Premium, and I'd rather hear it from you than guess. So, we're running a listener survey. It's anonymous. I read every write and answer myself, and everyone who finishes it gets a free month of Unchained Premium. Your pick. Um, Unchained Premium or bits and bips. Your pick. It's at unchainedcrypto.com/servey.

Again, that's unchained crypto.com/servey and it's open through November 8th. You can also scan the QR code that's on the screen. Thanks so much. This one really does help. And now we'll take a quick word from the sponsors who make the show possible. This episode is brought to you by Nexo, the premier digital assets wealth platform. Earn daily interest on your crypto or borrow funds all through one platform trusted by more than 10 million clients. Find out more at nexo.com. GEO restrictions to eligibility and terms apply. Not listening to Bits and Bips yet? It's our weekly crypto and macro market show with Rahm Alawalia, Austin Campbell, and Chris Perkins. Search Bits and Bips and subscribe.

Today's topic is which cryptography in blockchains is secure and which types of cryptography are not. And here to discuss are Alex Prudin, co-founder and CEO of Project 11, and Connor Degan, co-founder and CTO of Project 11. Welcome, Alex and Connor. Yeah, thanks. It's great to be here, and I'm very glad that Connor's here as a cryptographer. You know, I may pitch a lot of the hard parts of your question to him, but no, it's uh it's it's a dense topic, but I'm excited to cover it with you today. >> Yeah, likewise. Looking forward to the hard questions, Alex. >> Yeah. So, Project 11 has been at the forefront of this effort to protect blockchains from the quantum computing threat. And um that threat, you know, largely has been to the cryptography

that secures blockchains. And recently, Ethereum researcher Justin Drake tweeted that he thought the blockchain industry needed to also plan for what he called bunker mode, which he described as a controlled mass migration of assets to fresh addresses, i.e. addresses whose public keys remain hidden behind a hash. And the reason for that is due to advancements in AI when it comes to math. So now the crypto industry is facing kind of like two threats in this sort of frontier space. So explain what caused him to make this tweet and also um you know how he is viewing this threat and um Alex why don't we start with you.

>> Yeah sure. Uh, so on what Cosman to make it, I think, um, you know, I think Justin uh likes to spice up the dialogue in the industry every once in a while with uh with a, you know, quote unquote banger like that and he certainly did with this one. Um, but look, I think it's uh, you know, and we work with Justin and the Ethereum Foundation on on preparing Ethereum for its postquantum roadmap, but I think, you know, Justin, it sees uh, first off the progress in quantum computing, but also sees the progress of AI and math, right? So recall cryptography, certainly public key cryptography at least, is all based on effectively hard math problems or problems that we think are hard. Uh, frustratingly, we don't have like a proof that they're hard. We just kind of think they're hard based on the fact

that no one has solved them for a while. And so when OpenAI goes and drops like, hey, we have 400 math results or however many they dropped, but none of them are cryptography related, it gets everyone a little bit worried. And this extended even beyond Justin, by the way. I think Matt Green, who's a cryptographer I greatly respect, said, "Hey, you know, there's there's a small chance, but a chance we might lose public key cryptography that's based on all this math, you know, and so I think that's the that, you know, the math the the hardness of this math problem, you know, is really at root of what protects all of our systems and it can be, you know, the people worry that it could be broken like we kind of know that it could be broken by a quantum computer should one exist. What we don't know is can AI also

achieve the same feat?" And so I think that's really what drove in my opinion, you know, some of Justin's uh, you know, the the kind of the motivation behind his post. I don't know, yeah, if that makes sense. >> And Connor, how do you view it? >> Yeah, certainly can't speak to his motivations. I mean, as Alex pointed out, you know, Justin's on the forefront of this is is is very in tune to what's happening and and deeply understands the threat model. So, you know, I'm sure there's, you know, a huge amount of credibility there. And I think you know the the the it's an interesting tweet because I think it's it's a tweet in two parts. And I think that the first part is very reasonable.

I mean the the first part is sound advice. You know we we should be keeping these assets behind hashed addresses. Uh the second year you know Bitcoin or Ethereum exists with its public key exposed. It's you know it's vulnerable to quantum threats. This is something that project 11 has been you know showing the world for the last two years with our Bitcoin risk list which tracks the amount of Bitcoin that's not stored behind a hashed address. Um so you know the first part of the tweet you know storing your ass beyond a hash address is is wise and and you know it's a reasonable security measure to take. Not all users know exactly how to do that and there's, you know, that's a bit of a problem there. But I think, you know, that first tweet was that second piece Okay, you know what? We're having a

technical issue. Um, it looks like Connor, for some reason, you are no longer connected to the stream. I can hear you. I'm assuming Alex can still hear you. Um, so I'm not sure what happened. Maybe try leaving and coming back. And in the meantime, I guess Alex and I can continue this conversation. So, um, one of the cryptographic elements that Justin called out as being potentially at risk, uh, just from AI, not even from quantum computing is called ECDSA, um, elliptic curve digital signature algorithm.

like just so you know this is like one of those terms I've heard so much over the years in crypto and then yeah I kind of eventually realized okay I don't actually really know what what this means um and and but before you answer why don't Connor why don't you go ahead and try to um say something to make sure that we can hear you >> hello everyone did that work >> okay great yes you are now back back in part of the stream so that's great >> great >> um and So I was ask I was talking about how Justin noted that ECDSA is especially at risk and um realized I have heard this you know over the years in crypto but I never really you know figured out exactly what that is. So um

could one of you explain what this is and why it's so important for securing blockchains? >> Yeah, absolutely. and and you know uh it's I think you're you're far from alone on you know not understanding this aspect of of blockchains and and cryptocurrency. I think it's very commonly misunderstood but it is also critically important. I mean so ECDSA stands for the elliptic curve digital signature algorithm. So the sec let's start second half first. It's a digital signature algorithm which is basically a way for you to authenticate or prove that you are you or you are the controller of this account, right? And so really what a block all a blockchain is is a is a sequence of signatures and intents on a ledger that's kept across a number of computers, right? So when you

send me Ethereum say you're signing a message saying I'm sending Alex or the address associated with Alex, you know, one Ethereum say one E, right? the only so so that's a digital signature algorithm generally elliptic curve is just describes the mathematical kind of structure around it now the reason why I think you know people may have heard of other public key cryptographic algorithms like RSA and that's you know there's ways to construct digital signature algorithms out of different assumptions but elliptic curves are used because they're very very performant they're very small they run very quickly on a very constrained device so they're kind of like the goldilocks of cryptography which is why they've been deployed basically everywhere. This is like the one universal piece of tech

that's in effectively every blockchain. Some elliptic curve based digital signature algorithm to basically prove you are who you are. Now AI going back to like how does AI break this? Well, ultimately these these digital signature algorithms are all based on this concept of what's called a trap door. Like and the idea is that basically it's a mathematical function that is very very hard to compute. But if you know one one secret input, you can compute it very easily. And this concept implies some kind of structure. So there is some hidden structure to this scheme, right?

And so you know ultimately what people worry about with an with AI is like could the AI somehow find this hidden structure. Now we actually know that a quantum computer running shores algorithm can exploit the structure that exists using some various quantum specific techniques. But the question with AI is you know it's kind of the unknown unknown. Could AI also exploit the structure that we know is there? >> Okay. Yeah. He said elliptic curves feel especially vulnerable to super intelligence curves carry rich structure with room for fancy tricks like school froenius pairings. So okay I have no idea what that means. He said by contrast hashes are designed to minimize algebraic

structures. So explain, you know, what what it is that he meant by that about hashes that make them so vulnerable and sorry curves and why hashes um it's you know in his opinion are stronger. >> Maybe Connor you >> Yeah. Great. I mean I I find myself saying this more and more uh these days but I think as a cryptographer I wanted to have one very very quick disclaimer. None of these schemes are broken today. And I think the debate that's kicked off in the last two weeks, you know, 20 days or so, you know, I've seen all sorts of crazy takes uh across X, I think it's very important to say to the best of our knowledge today, elliptic curves are safe. The lattice schemes that are postquantum are safe, the hashb schemes that are postquantum are safe. That will

change and it should change. And as as Alex's point, we know that elliptic curves will break. They will definitely break to quantum computing. It's just a matter of what date. AI is the reverse. We kind of already have the machine that is attacking these curves. We just don't know if it will break them. So there's a little bit of a kind of converse in the attack model, but as of today, there is no known break on elliptic curves. So Bitcoin, Ethereum, which currently run on elliptic curves today and won't be migrating for the next minimum two years, they will be relying on these uh elliptic curves until then, they are known to be safe today. So just big disclaimer um want to make that very clear. There is no known attack. the the the what the what Justin's tweet or I guess what the at this point the wider

community is hinting at is cryptography different cryptographic schemes are built in different ways some require quite complex maths to to kind of get that um functionality that Alex just spoke about around this kind of onewayness this trapdo function i.e. I know some private key that I can sign a message. You can verify my message but never get my private key. And that onewayess sometimes requires a lot of maths. H that would be equip for elliptic curves and for latispace schemes. There's quite a lot of algebraic structure, quite a lot of algebra algebra um within these schemes. On the other side of this, you've got hashes. So hashbased digital signatures use what are called a hash function at its very kind of primitive level. Hash functions are are not built off this algebraic structure. They're inherently random. They they kind of act almost like random machines. H you pass it some

data, it gives you some random spits some random data out and you can build these digital signature schemes purely off these hashbased schemes which is what Justin is proposing we should do or that bunker mode tweet is proposing we should do. The reason being is because AI is very good at solving maths problems. OpenAI just solved a couple of hundred in one tweet and one GitHub repo. uh we are seeing this mathematical super intelligence begin to to to kind of ripple through the communities and one thing we we are very aware of is is AI is incredibly good at finding where humans are bad at maths where we haven't been able to solve maths problems where we've made mistakes AI is deeply able to understand these things reason about them and then ultimately if if your cryptographic schemes are built with bad maths and AI can find a hole in that bad

maths it can break the scheme and and we've seen this I mean this has happened in the last two months we've seen two schemes one called hawk which is built off lises another called a which is a different type of crypto system but still requires quite a lot of structure and algebraic structure internally. Both of these schemes have fallen to an AI attack. Uh one was just you know I think $100,000 by anthropic and they're able to break one of these postquantum schemes that was not being used in production but will certainly be considered by uh considered to be used in the next couple of years. So there is definitely a bit of evidence to say that these structured schemes are going to suffer with this AI. Um and and it's largely just because of the inherent mathematical kind of assumptions underneath them that us humans are

probably just not as good at anymore than these AI machines. But I think very importantly these schemes are safe today. The schemes that we've seen fall um the ones that the two I've just mentioned they've fallen for different reasons and none of them you know we shouldn't necessarily project that onto the schemes we have. We shouldn't project it onto the NIST standards that that exist today the postquantum schemes that we can migrate to. It's a little bit apple to oranges to say that all schemes with structure will fall because AI is here. However, I think the conservative approach which Justin is is alluding to is well, let's just use schemes that have no mathematical structure at all. And and for him, what he's saying is let's move to to hashes.

Not not terrible advice. I think it's a little bit more nuanced than that. And then I think what we've seen in the last couple of weeks is anyone who's built lattice systems is coming out saying use lattises. Anyone who say, you know, spent their life work building hashes is saying great, let's use hashes. So, we're seeing a little bit of a knee-jerk reaction. And I think there's a little bit of noise going on. But most importantly, these schemes, all of those schemes that I've just mentioned are safe today. There there is no known attack on these, but as I said, that will change and we expect to change over the next couple years. >> Yeah. Yeah. We'll get into the timeline in a little bit. I did want to dive in more to that tweet by John Hopkins cryptographer Matthew Green. There were actually two of them. The first one

started, I think we might lose public key cryptography. Um, which yeah, so again, I'm I'm not an expert in these things, but I knew that that was a big deal. And then he clarified, well, encryption specifically. And then I was like, okay, again, I don't I know enough to know that that is huge because that applies to so many even non-crypto things. Um, but go ahead and explain what what he means by those and then explain how those things would manifest in in blockchains like what what the threat would be if if it turns out that those are no longer usable.

>> Yeah. So you know there's like um yeah there's a you know academic and theoretical cryptographers have like all these different kind of u base set of assumptions about the fundamental mathematical truths of our world that imply to some degree what type of cryptography is possible or not and I think you know two of two of the the mo the ones you may hear on X is like cryptomania and mini crypt and like it's not really worth it to think about what these are other than to say it's like what form of like you know like what is ultimately the limit limit of the information you can protect with cryptography. That's the idea. And so uh what Matt was saying was basically like hey for uh for key exchange asymmetric key exchange so it maybe just requires a

quick explanation of how encryption on the internet work works like TLS is basically runs on this concept of where you and I establish a connection and then we share a key via you know either this protocol called RSA or an elliptic curvebased scheme. In this case, ECIES, the EC is shared with uh ECDSA, right? So, you basically have this elliptic curve-based way to share one key that then the rest of the conversation is encrypted under, right? So, that the key that the conversation is encrypted under is totally safe in a postquantum world and honestly to the best of our knowledge in an AI super world. But, you know, it's that first step. It's like how do we share a secret that requires this algebraic structure and unlike signatures. So importantly, as Connor

just highlighted, we kind of have like lises and there's ways we can make signatures out of these algebraic structures, but we also know we can make them out of these hashbased or, you know, hash functions, which as Connor also expertly explained, you know, they're kind of just like random jumbles. So, it's hard to get any pattern out of it. Unfortunately, there is not an equivalent technique for sharing a secret. we don't have the equivalent like hashbased way to share a secret and therefore derive a shared key and therefore have encryption between the two of us without physically coming together and like exchanging a piece of paper right and so this is you know so so that is where I think you know particularly around you know algebraic structures being vulnerable to quantum or AI this is I think what Matt is expressing the concern about because

ultimately you can always solve the signature problem by doing hashbased signatures but you're not going to be able to necessarily solve this shared encryption problem. Now, where does this apply in blockchains? Not too many places thankfully because most blockchains don't use encryption as you pointed out. Now, there are a couple of exceptions to this, right? In fact, like privacy preserving schemes like for example Zcash uh effectively do rely on this encryption encrypted notes, right? So, there is a bit of encryption inside of there, right? And other privacy preserving schemes as well use this. And so ultimately you know there is kind of no way to replace that the the aspects of those protocols as they currently exist with any kind of hashbased thing

or anything without structure. Um so that's I think where like match tweet is most applicable is really around the privacy the privacy protocols you know but ultimately again in this in this case that's mostly we're not talking about stealing assets necessarily we're talking about retroactively revealing activity that happened. So, I guess depends on your definition of bad. I mean, they're both bad, but like, you know, ultimately I think I if it were me, I would rather my assets not be stolen, you know, in the worst case as opposed to like, you know, someone being able to steal it. >> All right. So, in a moment, we're going to talk more about the reaction to Justin's tweet, but first, we'll take a quick word from the sponsors who make the show possible. What if your crypto could do more than just sit in your wallet? Nexo is a digital assets wealth

platform where you can generate daily interest on your crypto or borrow funds against your assets. Today, Nexo serves more than 10 million clients. Find out more at nexo.com. If you like this show, there's another one from our network you should be listening to. Bits and Bips is our weekly market show. On Mondays, Rahm Alawalia, Austin Campbell, and Chris Perkins chat about where crypto and macro collide. It's sharp, it's fast, and it has its own channel. Search Bits plus sign BIPS and subscribe.

Back to my conversation with Alex and Connor. Yehuda Lindell, the head of cryptography at Coinbase, disagreed with Justin and tweeted, quote, "To my understanding, there is no evidence whatsoever pointing to a break of decades old hardness assumptions like elliptic curve cryptography." Then he said, "Just throwing out AI is doing amazing math, so elliptic curve hardness is in danger has no logical basis whatsoever." So I'm curious where you stand between Justin's stance and Yehuda's.

I'll go first. Uh you can throw me the hard ones. Um I I think the Okay, so to to to to kind of go back on the previous question you asked Laura about, you know, the attack on elliptic curves. Um you know, will elliptic curves break? Elliptic curves have stood a very long test of time. We've been using these things in production for many many years. They've been protecting assets like Bitcoin and Ethereum since the very beginning. As a result, they are the most tried and tested schemes in production. They are the only cryptographic schemes that have a trillion dollar asset honeypot that if you break them, you get the prize. You know, you steal the bitcoin. Um, and that's that's, you know, that's how these cryp you know, that's how blockchains work. If I can hack your private key through breaking the crypto the crypto the cryptographic

assumptions, I can, you know, win the prize. That that has acted like an amazing honeypot. As as cryptographers, there's no better way to really test these schemes than putting a trillion dollars behind them and saying if you break this, you win the jackpot and you can take the money. So they they've stood up massively to the test of time. The the big question now is is AI going to find something that us mere humans couldn't couldn't find in these schemes and and and that's what Justin is alluding to that hey there's there's a chance that these schemes will fall when AI super intelligence comes online and spot something that no human would ever gonna is ever going to spot. Yehuda's response is you know there there is no evidence there's no evidence to this.

These schemes have been around a very long time. You know merely saying that a scheme is going to break isn't necessarily very helpful. And and largely that is true. I mean, it's quite rare for a cryptographer to go online and and say something as direct is a scheme we're all using in production today to that that keeps Bitcoin secure, Ethereum secure, the entire internet secure, bank secure is going to break without much evidence. So whether there is evidence and there's, you know, Frontier Labs are sitting on a break, whether you know the quantum labs are sitting on breaks, obviously we can't speak to that. We just don't know. But without that evidence, it it it's going to cause these sorts of reactions.

You're going to have the likes of Yehuda come back and say, "Hey, okay, well, hang on. you know, we need to cool the jets here a little bit. You know, you know, you you who at Coinbase needs to be able to say, okay, well, this, you know, kind of we need to tell everyone this isn't necessarily true today. We don't have direct evidence of this. Yes, it's a possibility. And I think we should all be open to the fact that this is a possibility. And and we'll get into how we can deal with this as schemes break. And you know, my my take here is schemes will break. We will see lots of schemes fall over the next five years, both to quantum and AI. That's good. And and there's a net positive here for cryptography if we do, you know, and how we can think about building these

systems knowing that these schemes should break. and we'll always have new schemes to migrate to. But I think what Yehuda is pointing out there is without the evidence. It's kind of like the way science used to be done is, you know, you produce a paper that says here's the break and now we can all read that. We can all make our assumptions. We can all, you know, understand that and then share the same knowledge. There's a little asymmetry here. Saying it's going to break but not really showing any sort of data was one of the main push backs that this tweet got. Um, I guess Oh, yeah. Go ahead. I guess the the only thing that I thought when I read Yehuda's tweet was just Justin made the point that the the develop the developments may have occurred but they're being held back for security reasons and other

reasons. So I thought that's what Yehuda didn't address that there could be very reason very good reason that this could have happened but they're not saying anything. So I was like, okay, he keeps saying there's no evidence, but Justin's point is that like they don't they wouldn't they may not want to reveal that. >> And and and and that there's a non-zero chance and and that's that's always going to be the case. This is the asymmetry we deal with in security engineering. You know, you don't know what your enemy, you know, the the attacks your enemy holds because their best game theory is not to tell you. Um, I guess when I refer attackers here, I'm I'm saying AI Frontier Labs and and the reason, you know, a huge part of the like the conspiracy around this was when when OpenAI released the 300 or so math

problems. There was there was gaps. It went like, you know, problem number 44 and then it went to problem number 47. So, everyone was thinking about what was problem number 45 and 46. And this led to this spiral of was that a cryptographic problem that they had to remove last minute? They forgot to update the numbering system that they used in their list, you know, and maybe it's just bad. you know, I've typed lists and forgotten numbers before. Who knows? So, there's a little bit of that. But, >> well, and this is this is also true of quantum by the way. We actually know this is the case. Like, we've been told by quantum labs that they are not publishing certain results because they've been told not to or because they're choosing not to for, you know, for for reasons that they don't want to

create panic, right? So, we know it's the case in Quantum Labs for sure. That's a fact. I think though like one thing that I want to add to this I think I agree with everything Connor said but let me add a dimension here I think to make this tangible for people in crypto and explain the motivations from the perspective of Justin as a protocol designer and from Yehuda as a cryptographer of the biggest US-based quantum company. Okay. So Justin's concern is thinking about the longevity of Ethereum over 30 to 50 to 100 years. I mean all of us I mean Laura you were there people who live through the ETH1 to ETH2 transition remember how painfully long that took and how difficult it was right these are decentralized systems it is very very difficult to upgrade them this is not like your phone upgrades an OS kind of

thing right so you know this is I think why you're seeing this reaction from people like Justin but I think articulated well by Justin like we need to minimize any kind of possible theoretical risk that might exist in the future therefore we need to do hashes need change when we get that on the on the right. That's that's I think Justin's perspective and I think there's there's a lot of I mean that's very valid. On the flip side, Yehuda is responsible as a cryptographer at Coinbase. Yeah. You know, chief cryptographer at Coinbase for billions of dollars right now at this second coin like it is his name on the line, right?

And so you can understand why he's maybe got the view that like maybe we shouldn't throw away the only thing that we know has worked right now and go into bunker mode, you know? And I think there's elements of truth to both, right? I mean, and and this is, I think, the nuance point that Connor is trying to articulate. It's like on the one hand, we do need to move for sure because of quantum and we need to think carefully about where we move to because we don't know what AI might bring, right? But on the other hand, we don't we we shouldn't rush this and, you know, and throw, you know, and throw everything that we know is good away. Unfortunately, there's no easy answer here, right? the the the hard answer is that like yeah I mean anything could break at any time and your money is on

the line if it does right ultimately our only defense against that is proactively preparing for all eventualities risk to risk mitigation and there's this term that you know we can come back to if you want but I mean this is like been referenced a few times this concept of crypto agility right where it's like you don't put all your eggs in one basket yeah maybe hashes are going to break for some reason or maybe lattises is okay we have some backup plans Right. And this is really I think the answer into this world where this inherent uncertainty and and you have different kind of interests pursuing different goals.

>> The last piece on that I think you know sometimes it's it's it's great to light a fire under the security ecosystem and say okay well let's you know let's let's pressure test this. let's make sure we are ready because it takes someone to kind of set the cat out amongst the pigeons and say let's go let's have this conversation because if it's going to make people take the postquantum migration seriously and and now the post AI migration seriously the better and I think to Alex's point what I what I enjoyed about that the whole debate that took took place over the last couple of weeks was it it got people talking about it um whether for the right or wrong reasons is a different question but I think it it really showed okay we're not ready for this you know if there is going to be these black swan events

where AI will break crypto schemes um We need to be ready. We need to have that conversation in the open. And that's and that's that's a breath of fresh air. When we first started project 11, it was taboo to be talking about quantum's impact on crypto. And and now what we're seeing is it's becoming mainstream. It's becoming John Hopkins, Yehuda. It's becoming Justin Drake. And that's that that's welcome. You know, I'm happy to be to, you know, that we finally, you know, ripped the band-aid off on the conversation. >> Yeah. I'm just going to describe some of the other reactions and then we'll we'll move on into uh some of the other issues here. So, Dankrod Feist, formerly of the Ethereum Foundation, now at Tempo, tweeted, quote, "Ephalyptic curves are broken so that any exposed public key leads to compromise. And it's not by white hat hackers who save everyone's

assets first. Your coins are going to zero." Having them in bunker mode is not going to help you. They're still worth zero. Him Kashio Dragonfly tweeted, quote, "Some people respond, yes, but if ECDSA were to be broken, so society would have much bigger problems than just blockchains. Think of banks, TLS, certificate authorities. Blockchains would be the least of your problems." But Hib said, "You should not take that as consolation. Banks can recover. TLS can recover. Certificate authorities can recover. They can recyc everyone and switch to a new cryptographic standard.

We blockchains cannot recover from a failure in public key cryptography. In a worst case scenario, anyone could compute anyone else's keys, meaning anyone could take anyone else's money. We wouldn't know who owns what, and we'd have no way to prove anything. That's no longer a currency. That's a graffiti wall. We would have to throw the entire blockchain in the trash and start over. Um, I'm curious like if you are on one side or another here. Um, I don't want to spend too much time on it, but I just had to get these comments uh into the podcast.

>> There's a lot of juicy ones. Yeah. Um, no, I I think I I actually agree with this, Steve, with with one important caveat. Um, look, I think blockchains can recover. I mean, we have to remember like go back to the beginning of Ethereum when someone accidentally fat fingered a bug and you know the re-entry bug and smart contract and everyone just decided that didn't happen in our version of the world and we like went back to you know a former block and this was of course the Ethereum eat classic fork and like you know that was obviously socially very disruptive but Ethereum went on to become the second largest blockchain right so I think you know ultimately there is this social fall back right for this for these decentralized schemes Now, would it be incredibly disruptive if you know AI or

quantum would tomorrow were to show up and you know start you know stealing everyone's money and there would be you know kind of this everything gets thrown up in the air absolutely it would. But I don't think it's necessarily going to be the end of blockchains assuming again there is some kind of cryptography that we could theoretically apply in some kind of new fork or new universe that we restarted. But I agree with Hib entirely in that I I you know we we've gotten kind of the sentiment that he's that he's arguing against a lot at Project 11 with quantum because people are like oh it's just like the kind of this doomsday mentality where it's like oh well it's like the earth will explode if a quantum computer comes online. It's like no that's not how it's going to work right and also practically speaking you know I

think one thing that that that has didn't miss mention that I think is is um you know special about blockchains and this cuts both ways is that the cryptography on blockchains is like the closest thing to money where you know or it's like the closest to the monetary application of any of those other use cases like yes you can authenticate to log on to your bank but if I like am somehow able to crack the public key or the private key for your encrypted session with your bank Laura like typically your bank like if I try and wire all the money out your bank is probably going to call you and be like hey are you sure you want to you know there's like other things right whereas in like Satoshi's Bitcoin if you have Satoshi's private key wherever they are there's no one bank is calling you no

minor is calling you like it's just going to happen right and so the the fact there is basically no safeguards between safeguards is a quote unquote here uh between like being able to sign a message and send the money uh is both a feature and a bug right it's what enables this to be permissionless it's what makes it different than a bank, but it also means that these things can be once they're broken, there's like really no wall between like, you know, you and catastrophe potentially. And you know, I don't think it's it's not a bad or good thing. I just think it's the reality of this architecture. >> Yeah, I find the um view that oh well, everything's going to be effed anyway is sort of like the nihilist view. Um so I agree. I'm sort of on the hive side that

we should try to do something. So let's now dig into these details about these different types of cryptography because that's kind of where I saw a lot of arguments. So um Justin said exiting bunker mode safely will require postAI cryptography. My inclination is to go allin on hashbased cryptography and avoid structured mathematical assumptions entirely whether from curves, lises or isogynes. I'm assuming that's how to pronounce that. I'm taking a stab. Um he said a single battle tested hash eg from the Shaw or Blake families yields plausible post AI security. Then we saw AI a16Z AI6Z A16Z recently tweeted uh what it called

so it it it tweeted um the case for lattises and then it had a little screenshot of a critique of hashbased structures and Ellie Ben Assassin of Starkware quote tweeted that sorry this is like quote tweets upon quote tweets and he said strong disagree lattises have juicy mathematical structure ripe for AI to attack and the succinct versions based on module SIS don't know what that means but you can explain to me >> are too new oh it's a type of lattice >> it's a lattice thing yes >> okay he said and this is these have only been around since 2012 he said I recommend waiting another 3 to 5 years for AI to kick the tires before entrusting serious money with it do your

own research stay safe and Vitalik kind of seemed to agree more with Justin he tweeted for signatures and proofs we already know how to go hash only. The bigger challenge is for public key encryption which is kind of to Matthew Green's point and this goes far beyond blockchain secure communication anonymizing protocols lots of things need public key contain any of the terms that you remember from there like like I think the the probably the main one so we kind of talked about hashbs but um the curves latises isogynes probably would be good to define um anything else that you remember that you think is important for people know go ahead just explain uh how those differ from hashbased.

>> I'll let Connor answer this, but Laura, we really should just have an AI agent just spit out a glossery of terms from this episode between Furbinius and module SIS is just like it's very rich with cryptography jargon. Uh anyway, Connor, go for it. >> Yeah, we need some sort of AI subtitles. But okay, so the the the core of that whole argument comes back to the the you know, as Alex said at the very beginning of this, these diff different cryptographic schemes exist. So different flavors of the same thing. You know, you can multiple tools that all do the same ultimate goal. So for at the user level, you want to be able to sign a message that says, I Connor, own this Bitcoin and I'm moving this Bitcoin to Alex. Right? So today, I just I want that to work. I just want to be able to

press my send button on my wallet and I want the Bitcoin to move from address A to address B. At the moment, that is done by elliptic curves. So that is what the entire 99% of blockchains use is elliptic curve cryptography. And this is one of these mathematically rich schemes. It requires, you know, somewhat complicated math under the hood so that when you click that send button, you know, your your computer runs some mathematical equations and those mathematical equations effectively produce this digital signature. Lattice is the same idea. So, a curve and a lattice, they're both kind of these, you know, abstract shapes. Uh, but that's because that's what they are. They they kind of have these kind of structured shapes in in a in a mathematical world.

And lattice is the same idea. You know, you click send and you're using a lattice scheme. All this complex maths happens on your computer which eventually says, "Hey, here's a digital signature that proves Connor owns this Bitcoin and he's moving it to Alex's address." And the same goes for Isogeni. It's all this complicated maths. The you and and the point that the that that Justin's referring to and we'll get into the A6Z response is that hashbased digital signature digital signature schemes don't have that maths. They are they are more just about, you know, creating randomness in such a way that still proves that Connor owns that Bitcoin, but it's not doing any fancy maths under the hood. It's actually just jumbling around all this information in such a way that I can prove I own this Bitcoin, but it's not doing kind of fancy mathemat, you know, complex

mathematical stuff that you need a PhD in to really deeply understand. And the whole argument boils down to what Justin refers to as any scheme that has this complex math constructions underneath the hood are more likely to be broken by AI than these hashbased ones which rely purely on randomness. And these hash schemes that he mentions, Shaw 2, Blake 3, these are those, you know, effectively random functions. Take data in, split random random data out. Whereas the the mathematical structures are built on this kind of pretty complicated mathematics. That is the core of the argument. AI has a bigger chance quote unquote of breaking these mathematical based schemes than it does the ones that require less structured math.

>> And let me jump in if you don't mind convers like at this point listeners may be thinking like, okay, cool. Well, why wouldn't we why wouldn't we just use hash functions? Cuz like well, yeah, if they're less structure and that's less risk, then like why would we ever use a lattice? And I think it's important to point to point out that NIST, the National Institute of Standards Technology in the United States has standardized two postquantum schemes, a lattice one and a hashbased one. The lattice one is actually their primary recommendation. So NIST is saying use the lattisbased signature scheme. Now why would they say that if you know it's true that there's structure and maybe AI to break? Presumably, NIST is thinking about this in a 20-year timeline too.

It's a standards body. So, the issue is ultimately as follows. So, well, there's two issues. One is performance. Hashbased cryptography is bigger, slower, worse along many performance dimensions. That's exactly why effectively NIST, you know, with like has standardized and and has said that MLDDSA, the ladis based scheme should be preferred, right? Because there's not as many performance trade-offs. you think about and again NIST is thinking about the internet and you know it's a internet's a global distributed system so that that's that's obviously a concern as it is for blockchains the other so so I think that that that the performance piece is certainly one aspect the other aspect is we we can't just think about the cryptography in

terms of these signatures we have to think about how they're used let's make a tangible example Coinbase or Fireblocks Fireblocks when you like you custo your assets using Fireblock You're not just signing a message. You're doing a complicated multi-party computation protocol on top of this elliptic curve signature that involves a, you know, it's like a separate whole thing that helps keep your money secure, right? And so the nice thing about math and cryptography with structure is you can build all the scaffolding around it like MPC. The bad thing about random hatchmath is you can't because if you could, well then it wouldn't be secure at all, right? And so again, this kind of ties back a little bit to the Yehuda

Justin thing. You know, Justin doesn't have to worry about that, but Yehuda definitely does, right? I think Yehuda's last company before it was acquired by Coinbase was an MPC provider, right? So this is so these these things, you know, there's no such thing as a pre-launch here. That's I think really the upshot. And what does this mean for blockchains? It means that we're going to enter a world where we're going to leave the world of monolithic elliptic curve security and we're going to enter into a multi-polar world where some people are going to choose isogynies because those trade-offs make sense there. Some people are going to choose lises because those trade-offs make sense there and some people are going to choose hashes and that is from like a cryptography point of view and from an infrastructure point of view especially completely uncharted

territory. But it's I think in my in my view it's the thing I'm shest of. It's unavoidable in light of these the known unknown of quantum and the unknown unknown of a press. >> Yeah. Um just to call out uh Yehuda's other comments, he said there's also zero evidence that elliptic curve hardness is more vulnerable than hash function hardness. In fact, historically hash functions have been more broken than than elliptic curves. So I'm curious like do you agree with him or do you agree more with Justin on that point?

>> That part's true. Um so historically speaking we have we have retired more hash functions than we have standard elliptic curve functions. Um we have found more breakages in hash functions than we have in these elliptic curve schemes. So >> and why is that? cuz I does it I I'm curious cuz what I was wondering actually when you guys kept talking about the randomness of hash functions I was like how do you actually know it's actually random like because there probably could be a hidden thing where like to the human eye it looks random but that actually a machine could figure out it's not so like am I right in thinking that's why >> that I you asked one of the deepest questions of cryptography >> you're uncovering that is like yeah >> made a lot of cryptographers nervous

yeah that made a lot of cryptographers very nervous. That is an that is an inherently impossible question to answer. And as us cryptographers, we we tend to we we we we tend to eventually just assume that it's random. But there there the point about is it truly random? Will will AI be able to spot patterns? That that is a huge issue and there's no good way of knowing it's random because how can you know it's random if it's >> Okay, great. This this now gives me even less confidence. Like I thought that was like a weird question that I was wondering but now I'm like oh actually so all the security that or all the confidence we have in hashbased functions depends on this one kind of obvious question >> and and that's largely where the functions break. Oh sorry very quickly.

So that's largely where these hash functions have broken in the past is we found ways that they're not as random as they're meant to be. We found ways to detect you know okay can we detect that this output is truly random or is it come from this hash function? And if we begin to spot those patterns, we have to retire that hash algorithm because it doesn't meet kind of the stringent requirements of being a secure hash function as a result. So, so Yehuda is completely correct. I mean, this is and this is well known across the industry. We've retired multiple versions of hash functions over the past, you know, 30 40 years. We have not retired elliptic curve cryptography ever. Um there is, you know, so you know, if you're to do a scoreboard of which has been seen to be more vulnerable, it's not the perfect

comparison, but hash functions are definitely losing the debate against elliptic curves. I I think though and this is like Alex just mentioned this but you know that the whole debate you know both sides are making good points but but I think there no one really knows which are going to break you know if we knew that and maybe some of the AI labs do and there's an asymmetry of information but we don't know which ones are going to fall for first but I think the issue is it's kind of the wrong question um you know which cryptographic scheme or which hardness assumptions you're going to go for is is fine but it's the tip of the iceberg and and this is the problem if we get caught up in this debate and spend the next six 8 12 months months trying to have an ego

battle on Twitter of are we going to use lattises or hashes or any of this conversation. You know, we don't what we don't want is distracting away from the fact that we do have real work to do and and deciding the signature scheme is only one of the 50,000 questions you have to answer yourself if you're going to migrate these schemes and and this is really the the only danger we have here is we can you know cryptographers and you know I guess engineers in general love being philosophical and debating these things in theory but really what we have is we have these looming threats. both AI and quantum are are real real threats to to cryptography and to crypto alike. You know, we need to begin that migration process and I think the sooner we can get past some of these debates, it's going to be somewhat

helpful. >> And I think and again like to Connor's put to like to put a fine point on the on the point Connor just made is that you know we need to assume anything could break. >> Yeah. >> That's like that. I mean I think that's just again like go back in history hash function hash functions have broken you know asymmetric schemes have broken all you could point to any any you know number of of pieces of evidence that show that everything could break and I think it's true anything could break and I think it's just a philosophical kind of chain mindset change where it's like hey we just need to basically plan for the worst and for systems like blockchains that you know ultimately we want to be critical infrastructure you know we can't ever bake in the assumption that everything's going to last forever and and and be how it is

and that's That's crypto agility in a nutshell. And this is I think really going to be not only the future of blockchain, it's going to be the future of cyber security generally. Um is this agility and this and this kind of zero trust on any of your even cryp cryptographic architecture in so far as you can get away with that is going to be is going to be the way to go. Now what people could also ask me they're like well Alex that sounds sensible. Why doesn't everyone do that today? Cost is the simple answer, right? If I'm supporting two schemes versus one it's going to be more. If I'm supporting three schemes versus two it's going to be more. And just like you decide how much insurance you want to carry for your house against what long tail of threats, protocols and people are just

gonna have to decide how what level of redundancy is is enough to assure me that I'm protected against all worst case scenarios for the value that I'm trying to secure here or the information. >> And and the last piece on that I think is really, you know, to put a positive spin on all of this because it sounds quite doomsday so far. the the the if we build these systems correctly, if we migrate to this new crypto agility crypto agile world that Alex is referring to, the first scheme we move to certainly won't be the last. You know, we we can build these schemes in a way that now we don't have to have this big migration conversation. AI is breaking cryptography. Yes, that is true. But it's also creating brand new cryptography. And you know, I don't for a second think that the scheme that

Bitcoin uses in the first postquantum migration or Ethereum will will be the last. we will see these, you know, new schemes come out that are better, more performant, more gas optimized, you know, faster throughput, whatever the kind of performance metric you're looking to to to tackle with these schemes. We'll find those and that's great. And if we build the systems correctly, we can kind of reap the reward of AI making all of this new cryptography and we can constantly just be migrating these systems if we build them properly. If we build them the same we've done before where we just lift and shift everything over to a new scheme. Well, every time we have a new scheme or a new break, we have to have these exact same conversations about migration and and and it's it's going to become a little bit tiresome if we have to keep

doing that because this is only going to get faster with with with AI. >> Yeah. Um to go back to the comment about NIST, um I wonder if part of the reason that they're um more on the side of lattice or I don't know if that's the way to face, but you know the why the reason that they're proposing people adopt um the lattice standard is because it I guess is less data intensive. But then the other thing is um since NIST is probably not recommending standards for blockchains um they might have like a different standard of what security is.

And so um Justin I understand you know like if he if he is more worried about the threat of advanced math from AI or quantum that might be why he would prefer something random. Um but again this goes back to what we talked about this assumption that it is actually random and whether or not that you know that is true and how we can know or or how we probably won't be able to to know that's its own risk. And so that leads me to another thought which is that it sort of creates this situation where choices that blockchains make make about how to secure themselves could end up being make or break like the in a way it's almost like a gamble because you

kind of need for the technology to play out to see what will actually be effective. And so it's like if people if if chains have to make their choices now then it might be that like all of a sudden some breakthrough happens and a chain is kind of basically for lack of a better word. Um am I right that like that could be a scenario? >> I think yes but I would soften it and I let me just actually make a quick like a quick caveat on the hash function things like yes all of the randomness we know or not. I think the one thing just to steal man that or or to give it, you know, give that argument it's due on why hash functions might be good. You know, the number of elliptic curve signatures that have ever been signed, I don't

know, is maybe in the billions. I don't know. I I don't know. It's like it's a big number, but like the number of hashes that get made for every single Bitcoin block is astronomically huge. So like the number of times we've run the hash function. And by the way, if a minor in Bitcoin could find a pattern in the hash function, they would definitely do it because that would be an enormously valuable thing for them to do. By the way, it's like many other proofof work schemes that have been built on random h you know, hash functions that people just decided they made up one day, they get broken all the time, right? So that's just just to just quickly kind of go back and touch on that. It's like important to to give that argument. It's due that like hash functions are really really really

secure. They've seen a lot of attack arguably. So it's not that they are perfectly random. In fact, we know they're not. But I think it's it they're very resilient. Okay. Now, to your point, I think you're actually what you're describing is I I think look, I think there's a fantasy in some blockchain context that people are like uh it's this automate. It's like, you know, it's a protocol that just self-governs and somehow like we're going to put it in the universe and it's just going to always be what it is. is I mean I think you know to name names I think the Bitcoin ecosystem is particularly uh you know guilty of this where it's like oh it's perfect in its form and it's all it's going to last until the heat death of the universe that's pure poppycom right the reality is is that cryptography just look at the

last h 100red years of cryptography it's evolved right and things need to evolve right and there needs to be people who participate in these communities that ultimately underpin this technology that decide and make these tradeoffs right and that's I guess depending on how much of a you know I guess automatic automated decentralization max you are that could be depressing but I think it's also it takes some of the pressure off and I also think to to to the practical suggestion that Connor made is like if we build these systems to be somewhat agile if we think about what we go to next as not the final solution you know or the final you know form of cryptography then it gives us a lot more flexibility and you know and I think opportunity to fine-tune and evolve I I

I think that's like I think that's a it's a logical trap that I think um you know that I think a lot of protocol designers kind of fall into where it's like I have to build the perfect system now like look no system is perfect right the world evolves around it and the needs change and therefore the system has to change that's exactly why we're having all the conversations we're having right now and we should be we would be silly in my opinion to assume it's somehow going to be different tomorrow but um but yeah look I do think that said it doesn't remove the consequential the you know the consequential nature of this decision. But that settler, I think there's an easy decision at all these protocols can make right now. It's doing something. Do something right. And there's unfortunately still a lot of people in

the in the ecosystem in crypto that just are choosing to pretend like nothing needs to be done. Now, so choosing to do nothing, I absolutely think will have catastrophic consequences. And to be clear, I think there's a chance that choosing to do the wrong thing could too. But honestly, my bet is on the chains that are at least choosing to do something because at least there's like a little bit of faith in the proactivity that ultimately the system will be maintained by people that care about it and have a stake in it as opposed to people that aren't. >> All right, so let's talk about timelines. Um, like every time I have one of these discussions, I'm always like, let's talk about timelines. So, um, Justin said, "In my opinion, it is now reasonable to brace for the

possibility that ECDSA breaks before Qday. In the worst case, in months, not years." Which, whoa. Um, and then he said, "By break, I mean fast private key recovery, eg in one week on available hardware, eg a large GPU cluster." So, Alex, I know the last time when you were on the show, I kept asking about timelines. Um I did see um another announcement by Google about a development around so-called magic states which as far as I understand are kind of crucial for modeling quantum computing. So I know you know that's only quantum but I'm sure there's applications for AI just generally. So I'm curious like now with everything

that we know about AI and quantum if you have an updated sense about timelines um in terms of you know when when this will be relevant for blockchains. >> That's good. We're really not giving the audience a break here like okay the last few minutes let's talk about magic states. Anyway, no uh yeah uh but it's it's all connected. So I I think it's important to address and um yeah so very briefly magic states have to do with quantum error correction and um and and yeah the uh um you know the Google's result basically validated some prior resource estimates that they had. Um I don't think it changes Qday timelines honestly that there was another result earlier today uh actually from a company called Quantinum which is a quantum computing company based in Colorado that also had

a very impressive result with regard to error correction. Um, look, again, I don't necessarily think it moves the needle. What it does is, you know, if you recall, Laura, when in the past when I've given Qday predictions, it's really been about like, you know, we give a date, but we also have to give our confidence in that date. So, I think my earliest date where I think a a quantum attack is realistic is probably around 2030. And then I think, you know, the chance where it's more likely than not is called the, you know, the early to mid 2030. So 2033 to 2035 with these two results that have come out I think we are more likely in the case where it is earlier right so I don't think it's you know there's still a lot of engineering work to be done and to Conor's earlier

point nothing's broken today and I would still be shocked frankly on the out very very outside chance that within by the by the time that you know the decade is out that quantum computers exist that said I think there are people and you've had some of them on your show that love to say like oh it's all just theory people are just writing papers and there's no real engineering going And I think these are two examples of real engineering and demonstrated evidence that this is actually working. And I think it makes the arguments that some of those individuals make much more tenuous. So again, I don't want to be alarmist and say this changes everything right now because I don't think it does.

But I also think it definitely implies that we are on a trajectory where soon we are going to be in a postquantum world. Um the AI timelines are way harder to reason about. I don't know Connor may have an idea, but like that's kind of the unknown unknown. like your guess as good as mine as to how fast mythos or whatever next model can evolve. I I don't know. I'm not an expert. >> Yeah. The the so so one thing that's very important is and we get to ask question a good bit. The the postquantum migration and the and the post migration are the same. If you know if if you migrate to postquantum security and and to Justin's point if you use hashbased schemes you you killed two birds at one stone. You're now postquantum secure.

And then you know to use Justin's framing you're post AI secure as well because he doesn't think hashes will break under you know AI attack. The AI timelines are are definitely more immediate than the quantum ones. We're seeing AI break these, you know, break schemes, not break any schemes they're using in production yet, but break schemes today. And that that is true. So we can't shy away from that fact. The AI attack is here, you know. So if Q day is is the day a quantum computer arrives, I don't know, a day or whatever you want to call AI day, you know, that's happening, you know, maybe now, last month, you know, sometime around now. And and that is that it is likely that we'll see more schemes fall to this.

It's impossible to tell which schemes will fall. I don't think any of the major schemes we're using in production are going to be the first to fall. So I think it's it's a non-zero chance that these schemes fall before Qday. But the good news is if if you're focusing your postquantum migration, you're already kind of focusing on your post AI migration as well. It's the same it's the same work to be done. It's the same migration. It's just picking a new algorithm scheme that you know is going to be safe, migrating to that algorithm and building it in such a way to Alex's point that you're crypto agile. Um so the the the AI day is here uh so to speak. If you believe in super intelligence and you believe what open AI is is saying. So now it's just a case of how do we deal with that? Well, I

think it's we we begin this post migration, you know, in fast soon. If you haven't started planning this, you should do it today. Um and and we do a orderly migration. It's not a panic stations. We don't have to do everything, you know, in the next two weeks. I don't think elliptic curve is going to be broken in a couple of months. Um maybe I will regret saying that, but you know, we have time to do this migration. We we we know that the kind of end state target we need to build towards. It's now about just getting that work done. And to Alex's point, it's it's just starting that work is hard, but once we started, it's, you know, there's there's a pretty defined path of how we go from preAI and pre-quantum to post AAI and postquantum.

>> Okay, so let's now talk about these different solutions. And I'm going to name three. I'm trying to cram like three questions into one question. Um, so Hib Kashi of Dragonfly proposed what he called cryptographic wartime. uh in his view this is like better than bunker mode because he said that requires you to not just move your coins but then not move them again after you move them to this fresh address. So he proposes a system level solution quote which includes governance ecosystemwide plans that engage not just protocol devs but also wallets exchanges apps etc. And he said that would start with every blockchain creating what he calls cryptographic recovery mode which begins with a new and extremely simple

hashbased so he's pro hashbased public key system and then everyone creates a backup key using the signature scheme and then at a certain point every app won't let you transact unless you have one. So basically like the the apps kind of institute a sort of deadline where after that it forces you to create one of these backup keys and then he proposes that in addition there's a pre-eployed kill switch in which validators can without a protocol upgrade vote to flip the kill switch which will force all addresses into cryptographic recovery mode. And there's you know more details after that but that's kind of the overall gist. I also want to call out um some uh things that

biologies 3D vos said in an episode of the chopping block. So he's the founder of network school. He said he thought that blockchains might need to implement something like the following quote. You use Ethereum and by using Ethereum you may have to ascent to something on chain that says if there's a hack of you know this or that or the other hash fun hash function that you that you know digital that sorry or or like a digital signature or what have you that miners can then rewind to the state from like a week ago or you know whatever time frame and that transactions can be reversed and everybody consents to that ahead of time as part of the terms of service.

That was super interesting. Um, and then in another uh suggestion in the same episode, he said that uh blockchains might come with an AI that has like a token budget so that whenever a new model drops, the AI immediately uses that new AI model to probe the blockchain for vulnerabilities and defend itself against any wouldbe hackers. Um I'm curious for you know any reactions to any of these uh proposals or or if you have a completely different one. >> No I me and Connor are just chuckling a bit because I think the second one uh actually project 11's first product was this thing called yellow pages which was exactly uh what what Bology is describing which is this fallback

solution where like you sign a message and you could always prove you had a bitcoin not even after it. So I mean and maybe I'll without being glib let me like maybe just I I think the make a comment broadly on these suggestions. First off I think very uh yeah creative framing on the wartime mode etc. But I think look um there are um like these are broadly I'm not going to speak to all the details but broadly good suggestions. Um, the challenge, and I can speak firsthand to this, as can Connor, is getting in the the communities and having the conversation about doing this. And I actually was like, as you were reading's thing, I was like, "Wow, I really would love to send this on the Bitcoin mailing

list and see what happens." And like this, that's the hard part. The hard part is not coming up with ways in which to mitigate this. The hard part is how to figure out how to build this consensus not just even in one ecosystem, right? We're talking about across multiple ecosystems. And look, I I think the reality is that that's a very good like I I I respect both of those individuals, both a se and bali who I personally know. But I just think it's it's a very like thought leader thing to say, right? It's like this is what we should do is the ultimate thing.

is like yes in the pra but practically speaking how are you going to convince all these disparate ecosystems to all sing sing to the same sheet of music and I think ultimately I think it's best left to for that for for practical reasons best left to the individual ecosystems and their stakeholders to determine the answers to those questions on their own now I think it's makes a lot of sense if any of them want to adopt the advice that either biology or has but I also don't think it's that simple as like oh what if we just like mandated a token budget for every blockchain like that's just I mean it's just we're never going to live in that is my personal view.

>> Yeah, I think um yeah, I guess I'm a cryptographer so I I I think we should, you know, I like all these creative solutions and I've seen hundreds of them in the past couple of weeks and probably over the last year. Uh and part of me always kind of want to say, well, let's just, you know, rather than coming up with more creative solutions and using that energy over there, like we should just do the the work of, you know, migrating these systems. That that's not to say those creative system those creative ideas are bad. You know they're they are all reasonable ideas and actually in fact Alex's point every chain will have to answer those questions. Every chain will have to have a kill switch, a redundancy mechanism, a whatif, a black swan switch. Every chain will have to have what you know um Hib

is alluding to which is some sort of proof of seed which again is a solution that we built at Par 11 which is kind of what is hinting at towards there. And that is true. All of those things will need to be considered. But I think you know to Alex's point you know the the the that the 80% of the work is just getting the migration started. Um, and that's the boring work. It's it's kind it is boring and that's fine. And then all these creative solutions are important, but I think, you know, they're solving for edge cases. They're solving for things that could go wrong. We know there's a huge amount of work to do. We can just get started on that today. And then and then the creative solutions, Starbucks point, I think each ecosystem is going to be very different because, you know, you try and pitch

that to the entire crypto community. Uh, you know, this is what we'll do with all chains. Uh, we'll roll them all back if this happens. I I I don't see that being realistic just yet. >> Yeah. Good luck. >> Yeah. >> Yeah. So, I know we have to go and the engineers gonna be really mad, but I have to ask one last question. Um, you re you recently announced Strongpoint, which is a new institutional custody platform for the transition to postquantum cryptography and you have Zcash in as an initial development partner. You were also partnering with uh Realm Insurance. Go ahead and talk about um you know this this development in this new platform.

>> Yep. Quick plug. Yeah. So, I mean very high level strong point is the crypto agile custody solution. So everything we just said about hey we should do crypto agility that's what we're building here right and you know custody is obviously where you know customers and keys and money intersect. So you know we're building what we think the world needs to look like in the future and that strong point. So Zcash uh foundation is a is a design partner. We're going to be supporting Zcash out the gate along with several other assets. But touching on Realm real quick which we you know you just highlighted and and we've announced today this design partnership with Realm. I'm very excited about because Realm is an insurance provider in the digital asset space. one of the leading insurance providers and you know our work there is really going to be explore

how you can price this risk right in theory you know hopefully at this point in this in this uh you know in this interview and this discussion we've scared the living daylights out of everyone and out of all the ways things could go wrong right and insurance is there to some extent to to mitigate that right and but of course the art of of insurance is being able to price it properly and the reason I'm excited about partnering with them for strongpoint is because I think there's a very real world in which you know if you adopt some of these proactive solutions that we talked about crypto agility postquantum security etc you know I think there's actually it's a cost saving I think it can save you money on an insurance premium that would otherwise have to go up to to account for these known and known and unknown

unknowns and so we're very excited to work with them and explore that and again you know the the point being here is that the the world is not going to end when AI breaks cryptography and quantum breaks cryptography we have to keep driving forward and that's what we want to do here at Project 11. That's why we're building strong point. That's why we partner with Realm and um and yeah, that's that's that's what we do every day. Um so very exciting. >> I think uh one thing that finish on there is both the lattice maxis and the hash maxis will be happy. Uh strongpoint supports both and more. Uh you know any postquantum algorithm is supported as long as it's safe. So all of that debate can be can be put to bed and say okay well this product does any of them. So you can you know use whatever you're

comfortable with and and we'll we'll help you support that security. All right, great. Well, thank you both so much for coming on Unchained and um informing users if not assuaging all their affairs. >> Thank you. >> Thank you, Laura. >> Thanks, Laura. Bye. >> Thanks for joining us on Unchained. Stay with us. Next up is Bits and Bibs where Austin Campbell and Chris Perkins are joined by John Daxto of Coinbase Institutional and Nick Vanak of Agora to work through a rough week for semis and the NASDAQ falling bonds with oil above $100 and the Cosby's worst week since layman. Nothing you hear on Unchained is investment advice. This show is forformational and entertainment

purposes only and my guest and I may hold assets discussed on the show. For more disclosures, visit unchainedcrypto.com. I think if you if you care purely about physical security, um minimizing the number of hands that devices are passed through before they reach you is a sensible approach. So obviously buying

directly from Ledger in this case would be the best way