ETHcc meets QPL

Transcript

[Music] um hello everyone um this is a panel about crypto and Quantum computing the reason for this panel is that I don't know if you're aware but basically um in Paris at the moment there is also an ongoing Quantum copyright conference it's called qpl and we thought if this could be a nice opportunity to bring together basically experts from both crypto and Quantum so we have Jason Drake from the ethereum foundation Stefano Joseph from hashberg

I am Fab from 20 squares and this is mati Hoban from continuum uh so I would probably start by just asking Mattie or Stefano if you can explain what Quantum Computing is like we are a bunch of like five years old would you like shall I have the honor for now yeah all right yes yes I think as you can probably hear Matty has reduced voice so it is possible that at some point we'll pray charades and he's going to mime what he wants to say and I'm gonna try and figure out how to say it uh just as a brief introduction uh I yes I I do research in Quantum Computing

how to program quantum computers and how to understand quantum computers and part of my job is also how to explain Quantum Computing so hopefully I will not entirely embarrass myself today the just in a nutshell these machines are specialized Hardware that is good at solving some specific classes of problems so you really should think of them as some black boxes you take your your problem you do some pre-processing you send data to the computer the computer returns some results you post process those and solve your original problem if if it's one of those that we know how to solve so they're not general purpose they're not

a replacement for all algorithms that you run today you shouldn't think of them as we take like a classical computer but faster that's not quite how it goes they're more exotic machines so you have to figure out how to phrase things for them that said we know quite a few interesting problems that can be solved better with quantum computers typically any problem that deals with optimizing over a set of constraints that we know how to phrase for quantum computers any problem that involves physical systems minimizing energies Computing Bond strengths for chemistry that we know how to how to solve with quantum computers but probably most interesting for this audience we have quite a lot of

cryptography Quantum Computing crossovers so there are problems we know how to solve with computers that will break Classical cryptography but we also know how to do things with quantum computers that cannot be done with classical cryptography so we have there's new protocols that open new possibilities for cryptography if you have Quantum Resources available so there's an adversarial side if you wish we have to be aware that quantum computers will break things but there's also an opportunity side where we know that quantum computers can do more that's a very brief overview but of course we'll have the panel to discuss the specifics so that was very good I'm convinced um so Justin

um over your work at the ethereum foundation have you ever like stumbled in problems where you wandered or you know like looked for like solutions that could lie in the quantum realm or in some way right for so for the last half decade um we've been studying problems to ways to defend ourselves against quantum computers um like the maybe one of the most basic Primitives that we have is signatures and the specific security scheme that we have is called BLS signatures and it's very good at being aggregated because we have on the order of a million validators and they all need to sign the message every Epoch which is every 6.4

minutes and so you want to verify roughly speaking a million signatures every 6.4 minutes and you want to do that on the Raspberry Pi how do you do that um with with these aggregatable signatures and so we've been uh looking into signature schemes that are post Quantum and aggregatable but more generally we've been looking at every single component that uses you know Quantum vulnerable cryptography and thinking having some sort of plausible upgrade for it so for example we have vdfs we have a secret leader election we have proof of custody and all all the time we kind of use these these disc Primitives that can be upgraded

um I guess one interesting thing that I only realized well you know maybe a year or two ago is that um proof of work as a primitive as a building block is quantum vulnerable and the reason is you can run Grover's algorithm and you break the the property that you know you have one one CPU one vote as described in the the Bitcoin paper or you know more precisely maybe like one transistor one vote or one drool one vote and with Grover you can basically Get N squared votes for n and jubets or n units of energy and so um you kind of break the the incentive

alignment there and they have in papers that basically explain how proof of work is is vulnerable to to Quantum and then I guess there's another aspect which is at the application layer right at the application layer we don't use these fancy aggregation signatures but we still use quantum vulnerable signatures uh specifically ecdsa in the context of Bitcoin and ethereum and here we have a bit of a social problem and the reason is there's going to be a lot of funds out there that are going to be crackable by an attacker and these could be funds that are just lost yet the owner died or the owner lost the keys and so there's a question like what do we do with that um do we do some sort of irregular State

transition where we just destroy it all so we just let it be and kind of almost incentivize the creation of quantum computers um do we like almost create a new form of mining right like you're mining for these uh these private Keys um yeah it's going to be interesting um so um okay so is there a particular like kind of cryptography related question that you would like to ask to a Quantum scientist or like right so most of the time um you know as I said we've been

defending against quantum computers and for that we don't actually need Quantum scientists we just need classical cryptographers and um I think we've made a ton of progress so we have hashes as like basic Primitives that we believe are post Quantum and then we have things like lattices uh and uh we also have this very nice construction called fry from which you can build like hash based snox and we even have like more fancy stuff like isogenies so all of that we're happy with but everything changed about a month ago about a month ago I discovered this amazing paper called One-Shot signatures and it basically was about using quantum

computers constructively um basically to make consensus better and what One-Shot signatures give us is basically a signature scheme where the private key can only sign a single message and so you could you should think of the private key as being this the superposition of states which is unknown and cannot be cloned by this you know so-called no cloning theorem and the process of signing a message involves observing the private key and collapsing collapsing it and thereby destroying it and so you can only sign a single message and these One-Shot signatures which I didn't realize were possible

um kind of solve most of the big open problems in in crypto so they gave us for example perfect finality right now on the theorem we have what's called economic finality which is that if a finalized checkpoint gets reverted and you have two inconsistent finalized checkpoints then you have a guarantee that at least one third of the validators will get slashed and that's a pretty good guarantee because we're talking about roughly 15 billion dollars of money that will get slashed but perfect finality is kind of the end game where you just can't buy the laws of physics and cryptography revert the finalized checkpoints another thing you can do is reduce the threshold for finality from 66 to 51 percent

you can also just completely remove the slashing conditions so as a validator you just can't get slashed how cool is that so if your if your keys get you know your signing Keys get compromised then you know you just can't get slashed and one of the cool applications is trustless delegation so we have this this kind of issue in ethereum whereby a lot of the stakers and by stickers I mean those who provide if at stake are trusting operators uh with with the with their Eve so for example in the context of Lido there's these 29 trusted operators and they can slash the if whenever they want they basically trust it to to not slash and one shot

signatures gives us trustless delegation so we can have trustless liquid staking for example and the reason why I started looking into these One-Shot signatures to was to solve yet another problem which is around restaking there's this whole new idea of restaking um and it turns out that you can build proof of stake without restaking where risk taking is just not possible uh with with one shot signatures basically mimicking what you can do with proof of work it's a proof of work you can't slash there's no slashing it's kind of rewards only so you have mining Rigs and those just can't be like destroyed and it would be a similar situation with proof of stake where you

have stake and it just can't be destroyed and so you can't you can't really do the restaking okay so I mean uh for what you say looks like there are some cryptographic Quantum cryptographic Protocols of some almost magical Maybe Matty maybe you can well I guess there's a history lesson here yeah at the very beginning of quantum information of the subjects that we care about money was was pretty Central so you you have uh Stephen Wiesner he's an interesting character in himself who came up with a scheme called can everyone hear me by the way I'm very hoarse but yeah okay um he came up with this this Quantum money scheme where you use this no

cloning principle so that um if you do not know what your Quantum state so the the representation of your physical system if it's a if it's a Quantum system if you don't know it you cannot copy it you cannot create copies so clearly something that is incomparable with classical systems and so he was the first to see the potential in this no cloning and create a money scheme so but the issue of this scheme was that you could be issued uh these Quantum States from a bank but then okay you can walk around town with these Quantum magical Quantum states which do not interact with their environment or become noisy and then in

order to use them again you have to go back to the bank so so I imagine in this room that probably does not sound ideal um so subsequently many years later people came up with the idea of okay I should say this Quantum money scheme is secure against unbounded adversaries so no computational assumptions so you allow them arbitrary computational power and they still not still can't copy your Quantum money so that's really cool very nice conceptually and then many years later I think it was Scott Aaronson who came up with the idea of public key Quantum money which was to get around having to revalidate or you know get your money

verified at the bank the idea is you could issue a classic the banquet issue a classical public key and anyone could verify their money um using this public key and so that the research on that is still ongoing I think there's been some very recent progress on this but I've not been kept up with it um okay and that that solves the issue of having to go back to the bank to use your money but then okay again in this room I imagine the fact that you're using a bank probably that doesn't go down so well um as just a hunch so the idea is you want to be able to delegate the creation of this Quantum money to someone you do not trust

and this is what I believe Mark zandry called Quantum lightning so this is like the magical solution to money where you do not trust this person but you uh the the this this prover this bank but you're asking them to make Quantum money and you want to be able to verify that they are making Quantum money um again using the public key um and so I guess these one shot signatures are I'm not sure about this but they probably imply that you can have Quantum lightning so yeah so this is kind of the Holy Grail of uh decentralized money and it's really nice that this has always followed like the history of quantum information this issue of money yeah I just have a quick question

um basically in I guess that for many of these uh Quantum cryptography schemes you need at least some actor needs to have access to Quantum Resources so basically a quantum computer which I don't think many people have at home so uh not yet at least and probably not ever but uh so the question is in this kind of schemes which parties need to actually perform Quantum computations and there are other parties that can classically like verify with classical means that everybody yeah yeah so um there are scenarios where things can be just uh completely delegated so that you have an untrusted party who is

issuing Quantum money and you only have yourself classical computation and you classically communicate with them um okay there are computational assumptions going on there as well um that which are akin to those that you find in uh post Quantum uh cryptography but yeah so that's kind of you can make everything classical in that respect nice but you have to assume that someone out there is making doing Quantum good okay yeah it might be our company I don't know so Stephanie are you uh I've been looking into a lot of different flavors of quantum computation uh is there a particular like set of techniques that you think could be

beneficially adopted also outside of the quantum world like many people obviously think okay quantum computers fast computation Quantum cryptography even magic keys and stuff like that but is there some other stuff that is let's say maybe less known and still like amazing and insightful that we can we can benefit from yeah so that's uh that's I guess the byproduct of the quantum race recently there's been I'm sure people have heard some large companies claiming that they have good Quantum hardware and putting out papers on reputable journals and that's happened for the past maybe three four years

and pretty soon afterwards people have developed techniques classical techniques to obtain exactly the same results and so one of the very interesting byproducts of this race is that the incentive for people to say no hang on you don't really have it yet has pushed research in simplification and simulation a lot over three four years like we've discovered things we didn't know about we've developed tools we didn't know about the nice thing is that these techniques are not special to Quantum at all they apply to tensor networks which is a very broad category of sorry it's a computational mode it's the one that's

used for example by most modern deep learning techniques that's about taking all these arrays multi-dimensional arrays and Contracting them efficiently so doing these reduction operations and that's how machine learning works that's how a lot of classical cryptography works too and so what we got out of this race is optimize techniques to simplify other calculations that we may care about so we can now solve certain classical problems in machine learning or cryptography with fewer resources than we would have in 2018 say when nobody really cared about doing this at scale and the only reason why we got there is that

quite simulating quantum computers is so hard that you really have to push the boundaries you really have to like develop new new things it won't fit in your large machines it doesn't matter how much money you throw at it there's just not enough computational power so that's that's the result of this we now know how to we have a new family of the of techniques that can be used to take classical algorithms and encode them in terms of these arithmetic operations ZK schemes are an example of this they there's a lot of arithmetic and contraction in there it's just not real numbers but same principle applies

and now we take those and we have really powerful techniques to simplify the calculations and make them significantly more efficient that's not Quantum per se it's just a byproduct of the quantum race which is I think very exciting um relevant to piggyback on that relevant to cryptography there's been an interesting byproduct as well which are these proofs of quantumness so where people consider Interactive pre-systems uh where you have a verifier it's completely classical or poly polynomial term bounded and can talk classically with approver who is one of these companies unlike mine who make Xperia's claims about their Quantum computation and um and so you can come up with these

very beautiful schemes where you interact with these systems and again based on things like Quantum secure one-way functions you can you can verify that you've actually done something quantum and you can try and make these things zero knowledge as well which is very cool yeah yeah and perhaps it's uh just just worth mentioning that if you have access to a Quantum device it doesn't have to be a quantum computer by the way maybe this is something worth spelling out there are we've had Quantum technology that works for cryptographic purposes for many years now there's companies like ID quantique that have based their entire business on this so the the hard part is to make general purpose quantum computers

making specialized Quantum Hardware is not easy but not not quite as hard so in a sense there's a lot of optic Optical Hardware that already exists that works well and one of the really interesting things you can do if you have access to this hardware and you have access to let's say a Quantum Internet a way of transmitting some of these Quantum States across distances which mainly be fiber optics maybe lasers and satellites people have experimented with various practical schemes and it works um then what you can do further than just prove that someone made a Quantum state or truly like generated the quantum money that you wanted you can

run some some protocols that are known as device independent protocols their their security is independent or who made the device so you may not trust the person who gives you the the token generator that you use to access your you know the bank or you use to encrypt your messages because perhaps the adversary in your I know security model uh is the person who makes the device or could intercept the device and you know plant a backdoor on it so you might want to find ways of generating Randomness that you can use to secure Communications without having to trust anybody in the equation without having

to assume that they're bounded by anything other than basic laws of physics not even quantum physics okay like just relativity let's say let's keep it simple and then there are schemes that use quantum they use entanglement special entangle states that can generate this kind of security and this is sort of device independent security which is also fairly new field some of it has been some of it has been done for Quantum key distribution but for more complicated protocols there's very much ongoing open work but it's something that classically cannot be done like there is no way to beat an adversary that gives you the security token that's just yeah they can do whatever they want with it if you have Quantum devices then

you can which is also very exciting interesting um I would say if you want we could make this panel interactive I think one of the purposes of this kind of event was exactly fostering collaboration between Quantum researchers and crypto researchers or professionals so if you have any sort of question or topics you would like to discuss yeah okay we are ready one hey guys thank you so much for putting a really interesting panel so I'm actually a physicist not really a crypto person I'm actually a PhD student Quantum

networking I was wondering whether you guys have come across a recent paper called like proof of quantum sampling where someone's created like a new blockchain design where they use existing noisy Quantum hardware and namely a boson sampler which for example Xanadu has put on the cloud and everyone and people can use to essentially design a new blockchain consensus mechanism whereby the kind of hard computationally difficult problems establish consensus is like a one-way Quantum signature through boson sampling and there are a lot of like fairly complicated considerations going to the design but I was just wondering whether you've come across that or what you guys think and maybe more generally whether you think we could use quantum hardware and the design of new blockchains from the bottom up

so is that like a proof of work based on the hardness of simulating boson sampling exactly yeah yeah yeah so I think I have I have seen this uh I think this this is relevant to the point that Stefano made earlier about people finding good classical algorithms to simulate Quantum Hardware so as far as I know things change all the time uh the boson sampling experiments they've been carried out people have found algorithms that simulate them so at the moment they're not like sorry oh okay yeah okay that might be that might be right that changed all right for most of the ones especially yeah but I think the principle is the principle

of a really good boson sampler using that as a proof of work I think yeah I think that's that's very plausible and it's similar to um this kind of proof of quantumness idea what I will say is that I guess the verification of it is also extremely hard isn't it so this is um yeah I don't know if anyone can comment on that but it's a very hard thing to verify this proof of work I mean I wanted to answer your your second question I guess which is like is this used for you know for building consensus and like usually one of the properties that we want for consensus is decentralization and so once we can you know bring the cost down

and everyone can have a computer at home and it only costs a thousand dollars then yes I think we can use it for consensus uh but I guess before that I think there will be like this intermediate stage where there's like there's one quantum computer and for applications like um like delegation that's actually sufficient right we just need one quantum computer to which we can trustlessly delegate to they won't be able to cheat and that's already hugely valuable yeah and I guess also you know public sources of Randomness are extremely useful right for a proof of stake I guess and if you have a verifiable source of Randomness which I guess could come from something like a boson sampler

or one of these device independent schemes you've got like in the short term I could see that being very useful as well right I mean there is always the consideration of liveness like you have okay yeah yeah sure yeah actually that is just just as a final final point on that I think this is one of the Borealis sampling experiments from Xanadu is that what your is it based on their like 216 modes machine okay so there are uh um when they publish their advantage paper the paper came with tensor contraction techniques that they developed and then they said we Benchmark against these and we are we do

better than these and we can't really simulate with these ones but then there's a couple of follow-up papers that yeah that take the noise assumptions put them into the tensor contraction and say I mean it's noise why don't you instead of applying it randomly why don't you apply to break that bit there and that bit there as long as I can tell them from the real noise model then it it it goes but you can break the nice bits and make the tensor Network easier to simulate and then those are also broken so that's that's why they they knew that this would happen that's why they did not go as quite as hard they said that's advantage they I think they did more homework than others but yeah so yeah it is my understanding that at the moment in the

current Quantum industry there are basically two main alleys one is invest an unfortable among affordable amount of money to build an actual Quantum Computing device or invest a bit less money to actually prove that everyone had claims Quantum Advantage is wrong and and basically keep going so I guess both businesses are are profitable right I mean at the moment we still don't have quantum computers so the race is still open basically right yeah and there's also this movement of the quantization that says there is a good chance that because a lot of these algorithms look like they use quantum but then a classical algorithm inspired by the same

principle gets developed that does exactly the same thing then there's some people who I don't know if they really believe it but at least they write it in papers and they say you see algorithm one seem to be Quantum release and algorithm 2 seem to be Quantum release and so perhaps none of them are I I don't know if that's that's not proven right there is no proof that of any separation so it may well be that we live in a world where everything can be done efficiently classically I I don't no I don't believe that no but people do don't we have a separation for One-Shot signatures you can always rewind and then do a second signature whereas one shot

signatures uses a fundamental property of quantumness so we have separation it's a conditional separation conditional what a conditional is it not conditional on the validity of uh Quantum secure one-way functions or something like that so you have to assume some problems are quantum hard right a conditional on um you know hash function being yeah yeah okay yeah yeah yeah yeah so like a random yeah there's a separating random Oracle or something yeah I see okay I know we all give it for I mean I think we all believe that that's true we all believe we all believe it yeah but it's yeah there's so much money at stake if it weren't true someone would have

surely like found a way to cash in but still technically on the subject of things that people believe so there are all these new ZK proof systems and some of them use somewhat novel cryptographic assumptions that are often extensions of existing assumptions that are believed to be good but you know there's sometimes quite a bit more complicated so I'm wondering what's known or what work is being done on the quantum security of ZK proof systems I mean the one of the main things is um basically fry which is studied in this model called the random Oracle model um and then there's an extension of this model called the quantum random Oracle model and uh you can prove that [Music] um the the soundness uh basically the

probability that the attacker can the soundness error which is the probability that an attacker can kind of break these proofs only the case by a factor of two so basically like you need to make your proofs like twice as large so today I believe that Starcraft for example uses a hundred um has bits of security but that's classical security so actually they only have 50 bits of quantum security is that because of Grover's algorithm basically on the Xbox yeah exactly so there's a there's a security proof of the of the of the low of the lower bound and then Grover gives you the upper balance so it's like a tight thing yeah so basically there's only like a hash based ZK proof system and you're pretty much

fine I just have to use like a bigger bigger hash or something yeah the hash function actually needs to be bigger by a fact of 1.5 which is a little strange um but then like the the number of queries needs to be twice twice as many queries I guess the breaker Hashi you don't need like square root n um like queries of the hash function right so the reason why it's 1.5 is because you have a slight Quantum Improvement upon Collision finding essentially yeah right yeah kind of which was surprising to me because I thought naively that you could always get at least a factor of two yeah I think in practice when people look at post Quantum schemes they just they just assume that the bit Security will be halved that there will exist a quadratic

speed up whether one can prove it or not yeah I think this is the case with lattice based schemes that if you want a certain Quantum security you kind of take the classical one and just half the bit security or double if you have to create it right yeah yeah sure equivalently you double the the key size yeah yeah okay um another topic I think an interesting topic we should touch upon that I know you two are well versed into yeah unfortunately is uh the topic of doing Quantum computations with pictures and the choreographical and probably this this will sound very strange to people in this room so it's

it's probably something we should elaborate on more yeah promote the book yeah promote the book yes yes I could just come and say I have a book that you should read but there is a large let's let's take a step back why why do we need a different way of talking about Quantum programming than classical programming because if you think okay quantum computers we were we write programs we have programming languages we've had programming languages for a long time what's different um the issue with quantum computers is that if you want to describe the state of the computer it takes an exponential number of bits or complex numbers or real numbers whatever measure you want

it's pretty much the same so you have 20 qubits it takes about a million a million components in a vector 30 cubits is a billion components 40 cubits is pretty much the size of one of these large language models 50 qubits is beyond what we can do today like there is no super computer that can fit that in memory just out of our out of the question and so really if you want to program these machines you have to find a better way to describe what you're doing you can't just manually specify functions you have to have a way of sort of hiding away the complexity into something simpler that composes nicely that captures what you want to do and

then you pass it to the computer and the computer knows how to execute it and Quantum circuits are that it's a graphical depiction of the program that you want to send to the quantum computer and you should really think that Quantum circuits today are less than assembly for classical Computing okay that's the level we're at we're not at assembly at all we're before that we're assembly minus minus and now the issue is that what you get is a way of compactly writing a program but now reasoning about what the program does is equally hard it is not the same as classical where you can think of Case by case and reconstruct what's going on because all of the cases are sort of

embedded in a weird way it's it's a bit doing like doing machine learning you have to figure out what's happening in the future space and that's very big and so you want to have a notation that does both that does the description part and allows you to write down the programs but also allows you to manipulate these programs and reason about them so you need a bit more flexibility you have to go a bit out of what's physically possible and make sort of a logical version of this where you try to have building blocks that are easier to manipulate and then what you get from this is you understand Quantum programs better so you can for example communicate explain investigate but you can also simplify them with a machine

you can do machine learning or classical algorithms that take your program and say this would require 64 qubits I only have 20 qubits on my very good machine and how do I fit it how can I re-jig it around so that I get the same result but using fewer qubits sometimes it's not possible but sometimes this additional Freedom that you get to reason about things allows you to you know move around the pieces simplify them generate new ones and then boom you can actually do useful stuff with fewer resources so that's there's a new movement here like things have been changing for the past maybe 10 15 years there's a lot of these they're called diagrammatic Methods the most famous one

is probably the ZX calculus or ZX calculus but there's quite a lot of them and people have been applying these methods to other fields and they've been applied to cryptography for some things that apply to classical programming for some things so yeah that's they are born out of necessity it's just hard to reason about quantum computers but it turns out that the these new flexibility is also helpful for classical Computing it gives you more insights in some cases so yeah that's what I do most of the time yeah it's interesting I I also did my PhD in pictorial methods for Quantum Computing and and other stuff this is

still like the kind of main technology that we use in in like my day-to-day activity in crypto the reason why it works is that everything is all these pictorial stuff is basically it's based on something called category Theory which is basically kind of complicated maths but the idea is that you have a soundness result that it's a kind of logical statement that basically tells you that whatever you do with pictures is legal in mathematics so in this case the idea is that every time you manipulate a ZX diagram you know that every kind of rewriting is an allowed linear algebraic operation that you are doing so you cannot basically up

you will never get in a situation where you are mixing apples and pests but the funny thing is that until quite recently this approach was basically being hardly rejected by a part of the mathematical community and the reason is that probably look too simple like you know it's really it's really strange but you know people that have studied like complex stuff their whole life take great pride in the effort they have put in and when you come by and say well you know I can do the same thing with like three pictures they're like yeah go drawing uh in the other room and leave me alone like I mean what do you want so this is this is really like a real problem and I guess that especially in ZX so this is like the the calculus that

Stefano mentioned the big result came a few years ago when the completeness of ZX was proved so what that means is that okay when you manipulate these diagrams you are doing like legal manipulations in algebra land okay so every sequence of manipu or diagrammatic manipulation is a valid algebraic theorem that you're approving you're saying that a is equal to B where a is your initial diagram and B is your final diagram what people would object is well maybe there are something things that I can prove in algebra land that I can't prove graphically so in using the graphical formalism you are like missing some

pieces and this is why we will need you know like traditional linear algebra anyway a few years ago a completeness result came out that basically say nope that's not the case like everything I think it was about qubits back then but basically everything you can do in linear algebra when it comes to qubit computations can be done graphically so you can happily forget about the hard matrixes and and that kind of stuff and then the idea is that you just like build some like python thing that gets the diagram in compiles it to the Matrix so now you know you can basically simplify your problem algorithmically diagrammatically and then it spits out

the final Matrix that you have to use to basically program the quantum computer and that changed pretty much operating and now all these people well actually what you were doing is interesting you know like can we talk about that a bit because we are having a lot of problems with that yeah um one question I wanted to ask to to Justin is in your like a day-to-day research activity uh do you ever use like uh yeah maybe other pictorial techniques or like is there space for this kind of stuff in like in cryptography for instance or in like reasoning about consensus or or like stick to the math and like uh right by the way I just realized that

I bought your book [Laughter] um yeah I'm still reading it um it's very simple but still hard to understand it feels too simple and it's just difficult to get your intuition but I will get it eventually um I mean I my personal research I I'm just a very visual person so yes it is helpful I mean one of the nice things is um for example the the proof um of of the property that I said before you know the um the economic finality so if you have um two finalized checkpoints at least

one third of the the the validators will get slashed there's like a really simple like visual proof that you can do but that's I guess as far as we've gone um so maybe there is an opportunity for for more there but um yeah so I'm okay then maybe yeah we should have a chat about yeah let's chat about it yes because a lot of the store in in CK land a lot of the calculations you have to do are effectively algebra but on fairly complicated field or rings that you can there's languages that are akin to the ZX calculus but for algebra over finite

fields and finite rings that make it very well not very easy but easier for sure to track all of these situations where you have multiple inputs multiple outputs and some like an array of algebraic operations in the middle because you can track them like in graphs rather than having to use multiple variables in between so maybe there is space there to to look at some of these simplification techniques or modeling techniques I mean one thing that comes to mind is we have these vdfs verifiable delay functions and basically we want to use computation as a way to simulate the passage of time and for that we need to prove lower bounds on

the depth of circuits so we have we want to do a certain amount of work sorry good luck with that we have proved lower bounds oh nice we have we have lower bounds so for example if you want to do um like a modular Square in uh you know and and bit uh finite field I think the the lower bound that we have is something like two log n oh nice um yeah it's not it's not lower Bound for the whole vdf but at least one core component which is this modular Square um but yeah because you're talking about simplifying things right and my understanding is that in Quantum

computing you also want to minimize the depth of the circuit is that correct and if so then yeah maybe yeah yeah there's there's also all of these uh techniques based on this idea of causality and causal influence that people have been studying where you look at the effectively the dependency of each output on each input and you can you just track down right you look at your original function say does this bit here depend on that bit there or not and you can track it through and if you do it's very complicated it's a very big space especially for Quantum things which are probabilistic but you can use this dependency to infer that you have a certain minimum structure of the

constant depth circuits you can show there's something you do with a constant depth Quantum circuit unconditionally that you cannot do with the content classical circuit for instance there's a few light cones it's very cool I didn't understand that but it sounds sounds cool there's a few techniques to talk about yeah definitely yeah interesting how are we doing time wise by the way yes just one question uh since you talk about a Quantum programming I wondered does it make sense to rewrite a blockchain execution clients in Quantum programming languages I don't know so I'll leave it to you shall I go for it uh if you have a

sufficiently large quantum computer then yes it opens the doors to interesting things you can start doing native Native computation of cryptographic Primitives you also can start attacking some of those Primitives because now you have the entire computation in some in some Quantum State and you can actually run Grover so maybe that's a point that I don't know if we made before but to run some of these to run Grover you can't just take the classical information and run the algorithm you have to somehow encode it into a Quantum State and you may or may not lose some of the advantage in that encoding so it depends on how you do it but there is definitely it opens up the possibility of using

Quantum native cryptographic techniques for blockchain for to run a blockchain so that would be very very exciting but at the same time it's it's very big right you have a lot of bits um you also have cute these qrams right where kind of your data structure your register addresses for your RAM are now encoded in Quantum systems yeah yeah I don't think we're going to build them anytime soon magical yeah magical things yes yes no one do it for now right sorry no one do it for now right oh uh that's the the easy answer is no that's the easiest question yeah I did in my life no I think not right now you have to really think we have What machines

with up to 430 qubits which are kind of useless machines up to what what do you have currently 20 something that are kind of nice uh that's privileged information okay uh well the public one at least 20. yeah at least 20. okay we can't convince you to reveal some spicy Secrets no no entirely sure I'd have to look up okay between between 20 and 400 somewhere there and now 20 is a non-trivial lower Bound in my opinion yes yes yes that's a good uh upper bound and now if you take each bit that you have in in the data of the of I don't know the evm let's say in a block each bit used by the machine in the

computation imagine that that's one bit one qubit it we're quite far from being able to do that I think I think we can safely say it's not happening tomorrow and then maybe tomorrow psych Quantum comes up with their super scalable billion qubit quantum computers is tomorrow a public holiday in the US that's usually a good indication you can do it tomorrow I guess in terms of applications to blockchains there's a few that I haven't mentioned like one is well one is quantum money which you I guess phrased in all language would be uh the lightning network but you don't have any routing issues and you don't have any liquidity issues so you can send point-to-point

um without without any any issues there um another a really cool application is uh bridging so if you want to bridge assets from one chain to another you have this problem where either chain can go back in time and be reverted but what you can have is you can have a decentralized application for example a bridge which only goes forward in time and so you send money from blockchain A to blockchain B it doesn't matter if these blockchains kind of revert whatever the the reversion and the new history is they will always be this this cross-train transaction which cannot itself be reverted and then there's another application which is around the proof of location

so you know we want to prove that you are you know an entity in some specific place in the world and this can be useful for decentralization for example we're going to make sure that there's all sorts of nodes around the world and you can do that by you know just measuring latencies on the network and doing triangulation but right now your private key when you sign the message can be duplicated and can be copied but when you have an uncloneable private key then you can do secure proof of location yeah I think there was a paper that proved that um it was impossible to do this classically actually proof of location classically was important oh very cool I may be

incorrectly remembering but at some point I was thinking about using this kind of stuff to do blockchain for Logistics and that was one of the problems I was I was like I'll just take a primitive that does proof of looking nope nope there wasn't anything available and so yeah but one question I had about the bridging so I guess that the bridging problem of chains reverting also goes away if we achieve instant finality through Quantum cryptography right in that case the problem basically disappears in any case yeah that's correct but that goes back to what I was saying around the two phases of quantum there's going to be a phase where there's like one entity maybe Google or whatever we'll have that one content computer and you can rent it to do the

bridging and then phase two where everyone at home has a quantum computer and then we can have it in consensus and so you can imagine kind of a centralized bridge but still trustless um for the for the for the bridging in the short term actually I have a question on that uh it's more of a cultural question how willing are you to trust that the provider that you have in these early days truly has a quantum computer how many assumptions would you be willing to to put on that because obviously you have to assume something unless they can prove they have a quantum computer and the proofs tend to be yeah we want a device independent stuff

that requires having a true divide and through device Independence requires you to also have some Quantum Hardware of some kind otherwise you there's always some assumption hidden in the so my understanding of the One-Shot signatures is that it's device independent and as the verifi the weak verifier you're purely classical yeah there are two flavors of twice Independence there's one which is based on physical assumptions alone and one based on computational assumptions and the latter is single-prover and the former is multi-prover so that might be the confusion yeah yeah yeah uh guys there's a question there oh sure

um I have one question um not directly related to cryptographical uh Quantum uh things but um Quantum is a very wide uh computer scientific field so in crypto we have this issue of uh having to be very fast uh thinking things and communication has to be very very fast in order to everyone to be on time when proposing a Blog and everything so on Earth it's fine we are close to each other uh when you go to moon it's already one minute it's already a bit slow if we go further it's going to be even further is there any um progress and research and things in

the quantum world that could help us for instance to have uh non-local in almost instant uh Network that could support this Quantum Technologies and is it going to be capable enough to to handle the amount of data and is there anything when I say soon uh you you put the date yeah I mean Quantum system still obey special relativity yeah so I I can probably answer that and then we have to wrap up because they are sorry so uh yeah this is actually a very interesting question the point is as Matthew was saying you cannot violate like relativity special in general so not

Yeah so basically the point is you cannot exchange information faster than the speed of light now the question is yeah but we know that Quantum is non-local so is that how is that compatible with general relativity this is a very puzzling thing because it when you realize it it probably changes some kind of ontological perception of what physics is but the point is if we have an entangled qubit and you are on the other side of the Galaxy and I make a measurement to to like my state your state will collapse immediately to the same state but now the point is you don't know which which measurement I I did basically and the point is if you don't have this information

you cannot extract any information from that state I basically need to do the measurement then I have to lift up the phone and tell you classically what I did and now you can use the information that is traveling classically is lower than the speed of light to actually do the same thing and actually unpack the resource this is mind-blowing to me because it's like saying you have physical non-locality but the ontology of it is not super luminal that I'm pretty sure that like a trillion philosophers that now want just to throw rocks at me but I mean this is probably one of the ways to see it it's like you know and there's

this interesting lawyer loophole to basically keep Einstein happy while having no locality but one quick point is I was going to say is you can actually increase the capacity of the information so you cannot send it faster because things called like super dense coding so that with one channel use you can send more classical information as long as you have pre-shared entanglement done okay thanks cool I think we have to wrap it up uh thank you very much and [Applause] I want I want to thank the speakers uh Justin Stefano and mati and by the way if you're interested we are also having a side event uh tomorrow or set by flashbots so you can find it on the

flashback Mev week where we will do probably more like crypto and Quantum Crush pollination so check it out thanks [Music] thank you [Music] thank you