Crypto Agility Framework for Ethereum (CAFE)

Transcript

Okay. Thank you very much. Hi everybody. My name is Oleg Lodizhansky and I am very pleased to introduce Cafe, a new project that I'm developing. Cafe is a crypto agility framework for Ethereum. Cafe aims to industrialize the necessary cryptography migration for the Ethereum blockchain. In this presentation, in these 20 minutes, we will see that cryptography is at the corner and we must migrate to new cryptography. You will see why we must migrate and then we will see that Ethereum ecosystem is working hard toward this migration and we will detail what must be migrated.

This will lead to my subject. Uh where where I argue that we need a tool to industrialize the necessary migration and finally the road map will permit to understand when we must migrate. So, cryptography is based on some mathematic properties that permits given a secret to publish some data and given that public data, it is almost impossible to retrieve the initial secret. This is the base of the Ethereum security. Cryptography exists for a very long and we have a good view of the cryptography let's say life cycle. We know that time to time a cryptography migration is necessary because new science, new technology

pushes the the current cryptography under pressure and this is exactly where we are. We are at the point where a new technology is emerging. This technology is namely the quantum computer and the quantum computer push this our current Ethereum cryptography under pressure and we have to migrate. Luckily, some new mathematic properties has been elected to write the new cryptography algorithm and some of these new cryptographic algorithm have been elected and published as the new standard by NIST in the USA.

So, this is the base and these new algorithm are the base of the Ethereum ecosystem work. Um but I mean these new algorithm are somehow I would not say the simple part but the the first step only toward the migration. The question The first question, what algorithm should we use now to resist the quantum threat is answered somehow. Uh but next question arises. How could we migrate the cryptography for Ethereum?

If we migrate and when we will migrate to a new cryptography, what are the consequences for the for the decentralized application, for the wallet, for everything? If we change the protocol, which is today the protocol is written with a fixed cryptography, we cannot change ECDSA just like that. It's not possible. There are some solution but by itself in the protocol, the cryptography is set once. And if we change this protocol, there are a lot of decentralized application that are written against this protocol. We can think of course about a DeFi, NFT SBT DID lot of things, bridges are also written using this protocol and its

cryptography. So, that if we change the protocol, we must we must of course audit all the decentralized application. Not all the application will need to be migrated because some of the application, decentralized application do not use some sexy function. So, they could stay like this but of course the decentralized application that uses the cryptography part of the protocol will have to be migrated. And if we migrate them, if we migrate the Ethereum layer one, let's say, of course all the other networks must be migrated too. It is a waste of energy to to to to let's say to ensure new security for Ethereum if the other part does not comply to this new security. And at the end of course the

the the end user, we are all end user of the of Ethereum I guess. Even we can be developer or or users only but we always use wallets and these wallets must also comply to this new cryptography. So, it is a mess. It is a There are a lot of things to change. It is not only the question to put another algorithm but also we have to manage properly to coordinate all these subject and to ensure that globally the security is still ensured. We know that today we certainly have been to some panel here in ETHCC. So, we know that the researchers, the Ethereum researchers are working hard toward this

migration. We know the all the questions that must be answered, the question of a gas usage, the question of a storage usage, of a throughput and and all that. You also may have you should be aware that there are new working groups. Every Wednesday we are all invited to connect to video call or to discuss to follow the discussion at least. There are also a new website pq.ethereum.org. So, we can all easily follow what is going on and the Ethereum Foundation published a straw map. You may all know that now today and in the straw map among others the new the migration to the post quantum cryptography is mentioned and this migration should be done by 2029, which is tomorrow. So, we have to work

harder today from today. Uh a lot of of of effort, a lot of suggestion, lot of proposal as are being processed. I mean some of the solution are already deployed. You have seen 447, maybe 4337, sorry. Maybe you heard about that or 7702. There there are different levels. There are a lot of discussion, a lot of a lot of other EIPs that are under discussion. Some the the the the stages, the level of maturity is not equal for all of these proposal and it is quite complicated to follow all these proposal and to to know what at the end will be really deployed and used. This is the question today. So,

all that is very interesting. We are very early. There are different directions. Some will be abandoned certainly. And my point is that we must be able to follow quite easily what is going on regarding our own threats to our wallet. So, this is why I propose the tool Cafe that permits to implement the crypto agility. Crypto agility is a well-known process. Okay. So, you can easily find information about documentation about a crypto agility on on different websites and crypto agility is a way is an automated, iterative, data-driven way to migrate the the the cryptography.

So, each iteration is done as a let's say as three parts. The first part is discovery. Discovery is a tool that permit Cafe discovery is a tool that permit to understand to retrieve all the information about your wallet, let's say, and to understand what is your attack surface. Okay. I call that blast radius but finally the idea is that when you have a wallet, you must be able to understand. Maybe you use your wallet. You own some NFT, some of course some some digital assets, some you you you participate to let's say a multi-sig signal multi-sig wallet or what you want but everything is written on the the

different blockchain where you use your wallet and the tool permit to receive all this information. So, that you clearly know what are the consequences of all that, of using your wallet and if your wallet is compromised, you can see what are the the consequences, sorry, of this compromisation. When you have your your attack surface, you are invited to go to step two, which is to define a new cryptography policy. The idea here is the end user will have some options. Certainly it will also be able to define its her own option.

He's her own option but at the end you define a new cryptography policy so that you say for example, you could say okay, I want to leave ECDSA and I want to use that technology. Maybe today you could you could say I want to use ERC 447 or EIP, I don't know what. But you define a way to reduce your attack surface. This is the idea. And when your crypto policy is defined for that iteration, at each iteration you will have an opportunity to modify your crypto policy so that you will have the possibility to follow the work done on the protocol, let's say.

Okay, but for that iteration, you define a crypto policy and when your crypto policy is defined, is written, then you can go to the third part of the iteration, which is remediation. And the remediation is the execution of the crypto policy itself. So, you could say for example, I would like to use someone presented a new way rotation system so that which I I mean the beauty of simplicity. So, it was very nice and it is an idea, why not? You could say I want to implement I want to use this EOA rotation system and this is this should be would be written in your cryptography policy and at the end your remediation is effectively to use this system.

And when this this remediation has been run, you are invited you will be invited to go to the next iteration so that you will recalculate your attack surface, your blast radius, your risk score and you can go to to another loop. Okay, because we know it is necessary because the idea here and this is very important I think I did not mention that. Something very important in this cryptography migration is that today we are in a fixed cryptographic system. Okay, there is no way we can Of course, there are some ideas, but basically the signature algorithm in Ethereum is ECDSA. This is not a discussion. Okay, so the cryptography is written in the protocol itself, and this is ECDSA and nothing else. Okay? So, the the idea of

the crypto agility is to move from this uh fixed cryptography environment to a more flexible one. Okay, at the end we want to be able to see exactly why I like EIP 8141, which introduces front transaction, but this is just a parenthesis. But the idea is that we leave this fixed cryptography system toward a new flexible one. And at the end, we'll have the Sorry, we'll have the opportunity to choose the cryptography we want. And this is very good because what you must understand here is that the first iteration where we are now, the not me, but the Ethereum structure, is very complicated because we must leave this fixed cryptographic system to propose a new flexible one. But when the flexible

cryptographic system will be put in place, then the next step will be just easier. Okay, so if if for example I I am not a cryptographer, but if for example ML-DSA does not fit the requirements and we start using ML-DSA and ML-DSA is not a good one, we will be we'll have the opportunity to easily change the the the cryptographic algorithm. Okay? So, the first iteration is to leave this fixed cryptographic system to a more flexible one, and it is very very important. This is why the first step is is is that heavy finally.

How it is implemented today, the the Cafe Discovery is already implemented as the end there will be a QR code to go to the to the to the service if you wish. You The end user give his wallet address. The system is read only, so there is no no risk about that. The system dig different EVM networks, and at the end you have an answer your wallet. This is your wallet. Okay? And your wallet is used by for for this, for that. Your wallet uses a signature algorithm, of course, for the moment it is ECDSA for sure if it is an EOA.

Lot of things, and at the end I calculate a risk score just to to to to have a good view of a simple view of of your attack surface. Uh I am very interested. I think it is very important to use standards so that the system will be interoperable, and there there is a CycloneDX project that proposes Cbom, cryptography bill of material for those who know that. This is the equivalent of Sbom, software bill of material. Okay, this is the same idea. And the idea here with the the advantage of using this um standard, let's say, is that the system will be interoperable, of course. The discovery Cafe Discovery also proposes to retrieve the blast radius and calculate the risk score of your RPC endpoints.

And this is very important, of course, because when you interact with the blockchain, you want to know what is the risk to use such an endpoint. Okay? So, the system permit to to retrieve the blast radius and the risk score for such a uh things. So, how it works today, it is a first uh quite simple version. You give your wallet address, and uh the the system retrieves information in different uh network, six or eight, I don't remember. And at the end you have a risk score. So, this one, the risk score is very low because this uh EOA never been used, so the there is no way to retrieve the public key. This is the base of the quantum threat point of the quantum risk. Okay? And this one, and if if you click here, you go to Etherscan, of

course. And this one has been found somewhere, not here, I don't know where, but it has been used, and then the key the public key is exposed. And when you click one of these uh you have the detail, of course. The algorithm is always ECDSA these days. Cafe, more than discovery, the next step Cafe will propose some solution to reduce your the attack surface of your wallet. There is, as I said, we will see the policy crypto policy management, sorry, and also the remediation. As I said, the discovery permit to retrieve Maybe you know test uh ssl.com. This is some some something just quite the same. Okay?

We dig your endpoint uh mainnet.optimism.io. This is just an example, of course. And then we receive everything. Okay, so you know the risk to regarding the quantum threat. The quantum threat, of course. You know the risk of using such an RPC endpoint. Okay? So, here this is very important. I will not the Cafe do not and will not propose crypto policy management for RPC endpoint, and neither remediation. This is out of scope. Okay? RPC endpoint is a question of infrastructure. I do not touch infrastructure. But at least it is very I think it is very important to know what is the risk to to use that endpoint, not mentioning that you in the when you define your crypto policy for

your wallet, you will say I want to use that algorithm, new cryptographic algorithm, lot of things. Among them, you will be you will have the opportunity to say I want to use RPC where the risk level is lower than for example. Okay, this is why I retrieve the the RPC risk score. I calculate the RPC uh risk score. And at the end you will have This is not implemented yet. At the end you will have the end user will have a way to define to have you will have a several proposal to to reduce the the attack surface of his or her wallet.

Also, this is not implemented yet, the remediation. But when the the crypto policy is defined, you will have an an a way to reduce to to execute, sorry, your policy management. Crypto policy, sorry. To to execute your crypto policy. I am not a cryptographer. I will certainly not propose any solution, but we could use EOA rotation key. I heard about Zcash, Trezor, Ledger secure Trezor, Ledger implementing new developing new HSM with including that include cryptographic post-quantum cryptography. So, this is the exactly the kind of things the end

user will be invited to do. Okay? And I think it is all No, no, my roadmap, of course. So, we are in 2026. I started the project in the last autumn. Uh >> [clears throat] >> I have to implement to to to to to continue to implement the discovery. I have to implement the first version of the crypto policy management and how to I have to find, let's say, some partners about remediation, of course. In 2027-2028, I will continue to follow what is going on on Ethereum and and to to to follow the the the implemented EIP and what you want, and of course I will comply to all that. Before we go to mainnet, as usual, we will have to to do a security audit, and uh

since the roadmap mentions that the post-quantum cryptography migration should be done by 2029, I follow that finally just to be ready on time. And that is all for me. Thank you very much. If you have questions, you can access the of course the website and the the GitHub are open. So, if you want to participate, if you want to read to read how it works, you are very welcome. Thank you very much. >> [applause] >> Any question?

Yes. There's one right there. Um thanks for the talk. Actually, I have one question. There was this Google announcement that they thinking that post-quantum cryptography, especially I guess related to Bitcoin, but I assume it also touches Ethereum, might be happening that they might crack it in 2029. Uh and after that there were rumors that actually it might have been already cracked. I just Google gives a little bit of time for everybody to uh it's going to go live. Um so, like what if it is faster than 2029? What do you think we need to do, basically? I

think this guy is better to answer >> [laughter] >> that kind of question. This is what you presented this morning. My my my opinion is My opinion is that we should not I mean, there are a lot of information. Okay, so what I understood this morning is that and this is also what I read, that Google presented a theoretical solution. But between theory and putting practice with a hardware defined and develop and blah blah, there are a lot of time. There may be some times to to to have the this hardware. By the way, what I personally follow is let's say NIST, and NIST from the US, this is a National Institute of Standard and Technology.

NIST says that by 2030 ECDSA and uh RSA will be deprecated only, and uh by 2035 it will be you will have no chance to to continue working with this algorithm. This is what I follow. I've been I am French. I've been in force with In Europe, we have ENISA, which follow finally NIST. In France, we have ANSSI, which follow ENISA, let's say. And I have been to to to Banque de France with a lot of big bank and insurance company, blah blah. And the message where was you should do the discovery now because you must know now

>> [laughter] >> where you are regarding the quantum threat. And they mentioned 2030 and 2045. So, I don't know what to think if the let the the thing suddenly is that science and technology evolve sometimes as a new technology suddenly is raised. Maybe it will happen, so we are in to be to be honest. Otherwise, if we are not so pessimistic, let's say we have some time. I think 2019 for Ethereum is a good starting point. I'm not sure about I don't know if Ethereum Foundation will achieve this migration by 2019, but at least fix a kind of

challenge. Okay, 2019 [snorts] is a yesterday finally. So, fix a challenge is a good way to put the right state of mind to everybody. We must migrate now. So, even if it is not possible today, but this is the idea we must keep in mind. I am all right. I agree. Thank you. Thank you. Any question? Thank you. Okay.