PQ Ethereum Q&A

Transcript

[music] [music] Alrighty. Okay, let's get settled in, ladies and gentlemen. Um, the questions are coming in. So, even as you're walking into the hall, don't forget to submit your questions. Yeah, submit your questions. You can scan the QR code. Let's moderate and go through some of them together. Justin, are you ready? >> Yes, ready. >> Always ready. Okay, first >> we have the questions on one of the screens please. >> Oh, sure. Can we get some of the questions on the screen? Thank you very much. I'll read them out to you as well. Yeah, I'll read them out to you. Now, Justin's going to be answering questions. He's also got a few slides that you might refer to as well. But for now, let's go to our first question.

Really important one. This one got the most votes so far. Justin, can you give a quick recap of yesterday's talk on PQ and post AI cryptography? Especially for those who may not have been here. What was your talk yesterday all about? >> Absolutely. So uh yesterday we with Kev we gave an opening talk and there was no chance for for for Q&A. So we really wanted to give you guys an opportunity to to ask questions and really the the talk was in uh was in two parts. Um we focused on the threats and and then the solutions. So the the the key message in the threats is that we're seeing an acceleration of the timelines. Timelines are shrinking when it comes to to

postquantum. But there's also a new and emerging threat. Um the so-called uh AI threat. So the the basic idea here is that um AI is creating new mathematics. It has reached super intelligence. This is something that we greatly greatly underestimated and it is a new risk that we have to take seriously and it is one that is going to crescendo over time as the power of these uh these models uh keep keeps increasing. And then on the solution side of things, uh, which Kev was talking about, we've been working on this for many, many years. You know, we've we've known that the the quantum threat was coming. We've started working

on this roughly 10 years ago. Um, and the good news is that there's one single solution that works for both threats, both the quantum and AI threats. And the the solution is in two parts. First of all, we want to have the strongest, most robust foundations to build our cryptography on. So that's the the the brick at the very bottom, if you will. And then everything that we build on top, all of the implementation complexity, we want that to be formally verified. So that is the new tool, formal verification. It used to be extremely expensive to do formal verification um both from a dollar perspective but also in terms of of

manpower and and latency and formal verification nowadays is essentially free. So we went from you know potentially tens of millions of dollars to formally verify all of Ethereum to maybe tens of thousands of dollars to formally verify all of Ethereum. And one of the other things that we greatly greatly underestimated is that when formal verification solves security, it also solves performance for us. And the reason is that we can start these autoresearch loops where the AI which you know usually is hallucinating, is going in wrong directions, is giving bad answers. This time can be really constrained in a in a in a well-

definfined sandbox. um and we can have it explore the design space extremely aggressively and and have um have it pick the the most optimal uh design space for for for the schemes that we're trying to build. So it's a very exciting time because you know the threats are are real the the timelines are shrinking there's new emerging threats but we also have you really strong solutions uh that that are ready to be deployed and I think now the real bottleneck is coordination how do we get all the technology that we have built and put it on chain >> yeah yeah really really good recap there are threats but there are also solutions

and our teams are all working towards solving these threats. Excellent. Fantastic. Okay, let's go to the uh audience Q&A. So, we've got here on our list here, let's look at the highest voted one so far. All right, so Justin, how lean PQ stack/roadmap eventually is going to merge with the beacon PQ roadmap? Good question. They seem to be on two parallel tracks for now. Maybe you can clarify that. And can we view one being technical while the other one is maybe strategic? What's the cross point? Let's take it.

Yeah, great question. So, two years ago, I gave a presentation at Defcon on the the beam chain and the idea back then was to use Postquantum as a shelling point for doing an ambitious revamp of the whole consensus layer. Um, and the the argument back then was that if we're going to do a very invasive change like Postquantum, we might as well also do all the other things that we've been wanting to do. uh for example have a much better finality mechanism and clean up all the technical debt um and you can think of it as being proof of stake uh 2.0 You know in some sense what I'm saying today 2 years later is the exact

opposite. >> Oh [laughter] I was actually there 2 years ago when you were talking about the beam chain and all that. So why is it opposite now? >> So the the context has changed. Back then when I gave the talk the timeline for postquantum was 2032 at the earliest and the expected timeline was 2035. Now the earliest timeline for for for for quantum is 2029 and the expected is 2032. So we've kind of shifted everything forwards by 3 years. And you know this sudden and unexpected acceleration means that we we really do need to take the postquantum threat in isolation and address this um you know with with more urgency than the other

stuff. >> Yeah. Yeah. >> Um now in terms of um the the broader lean lean Ethereum idea which now encompasses all layers of the stack not just the consensus layer. Uh Vitalik put forwards an even more ambitious vision which he calls the extremely lean chain. And the extremely lean chain um gives us multiple things but one of them is that we have a totally stateless consensus layer. Uh and I guess this ties in um with with the previous talk where um the the resources to run a validator node will be very very very very minimal which

means that we can scale it to to to to many millions of validators if we wanted to >> billions. Actually the target is a 1 billion. Yeah, >> potentially a bit invalidators. >> But the the thing that I find most exciting actually is this idea of having an enshrined privacy pool at the consensus layer. [snorts] >> Um so by default all of the validators, all of the stake would participate in this privacy pool. Um and if we imagine that let's say there's 50% of all ETH staked uh that's 60 million ETH and that's enough to bootstrap an extremely high quality uh privacy pool with a very very very good anonymity set. Um and

that's something that the execution layer would be able to to to connect with as well. And the third thing that I'm excited about uh the extreme lean chain is that it would also be an opportunity to clean up all of the technical debt. something that I've been wanting to do in the context of the beam chain. >> Fantastic. Thank you. Great. Really comprehensive answers. Really appreciate it. I'm sure the audience appreciates it as well. Another big question that getting a lot of votes for this question. Let's take a look at it. What is the single single biggest bottleneck to Ethereum becoming postquantum secure? Is it signature size? Is it client performance? Is it wallet UIUX or social coordination? What do you think?

I would say it's the latter. >> The latter. [clears throat] Yeah. >> Yeah. At this point, we have made so much progress technically speaking that the technology is is no longer a bottleneck. >> Um what we do have is this ACD process um which you know is rather slow. We're seeing one fork every 10 months right now. And the next two forks um have already been scoped for things other than postquantum, >> right? So we have to wait for glams to them which might come in January or February of next year and then we're going to have to wait another 10 months to get heota.

>> And so we're looking you know at the earliest at 2028 uh for for postquantum. >> Yeah. But um you know the situation is changing on a day-by-day basis now and there is a possibility um you know that the the devs as a community all come together and say actually you know what maybe postquantum is the number one thing that we should be focusing on in the short term. Um, and if we do manage to have all of the dev converge on this top priority, then the social coordination cost goes way down and maybe maybe we could um have Ethereum be postquantum secure in a matter of months

as opposed to having to wait till the end of 2028. >> Awesome. I think you know echoing what the other speakers were already sharing, the research has already been done for the past 5 years. People may not be aware of it but it's all being done but the timelines are being compressed right because of AI. >> Exactly. Yes. >> Yeah. So it's being compressed but you know we've got so many devs here so many core developers here. So hopefully after DevCon India something amazing is going to happen. >> Yeah. Let's go to the next one. We've got a lot of votes for this one as well. Okay Justin will L2s and rollups have to make their own postquantum migrations or will they inherit it from the L1? So I think a very good technical question.

>> Yeah, great question. So um I guess the answer is it's hard to tell because we live in a permissionless world and each L2 can do whatever they want. >> Um and you know some L2s might be first movers and that might be a competitive advantage to be postquantum secure even before the L1. >> Um now there's there's two very natural shelling points uh for on L2. The first one is to just adopt whatever the L1 does. >> And the scheme that we're putting forward is called Lean Sphinx.

>> Lean Sphinx. >> Sphinx. Yes. Lean Sphinx. >> Yeah. >> Um it's basically an adaptation of a NIST standard called Sphinx Plus, >> but it's optimized for a specific use case. It has support for hardware wallets. It has support for MPC signing. and it's just generally more efficient and especially when it comes to aggregation of the of of the signatures which is something that we want. Now over the last few days there has been a massive push uh to try and accelerate the maturity of lean sphinx and it's possible that over the coming weeks or months we will have a a frozen standard for lean sphinx which which means that

the L2s if they so choose could start um you know looking at it and and and making integrations. >> Yeah. The other very natural shelling point is to use the signature scheme which most of the internet might end up using which is called MLDDSA. >> MLDDSA. >> Yeah. So this is a NIST standard. Um and you know it's it's also an option for the L2s. Um >> the [clears throat] the main reservation that we've had for using MLDDSA at L1 um comes from uh security. So there's different security assumptions. Lean Sphinx uses only hash functions. MLDDSA uses latises.

And um you know various people within the EF including Vitalic you know believe that there's a significant chance yeah >> or at least significant enough chance that Latises um will get attacked over the next few years potentially. Um, and we're trying to build on L1 a signature scheme that will last for decades and centuries. >> Of course. Yeah. Yeah. >> So my personal recommendation would just be to copy the lean spanking standard. >> But if you want to move faster, for example, implement it today, you could go with MLDDSA.

>> Fantastic. I think great practical advice for anyone working on L2s and roll-ups. You heard it from the man himself. Okay, next question. We're getting a lot of votes coming in. Again, ladies and gentlemen, please if you see a really good question, upvote it so that we can pay attention and answer it together. Okay. Justin Vitalik has outlined a hard fork to rescue Ethereum from a sudden quantum emergency. So, let's say a black swan event of some kind. What specific actionable steps are already in the codebase today for this kind of a quick recovery? >> Yeah. So, I think the question that um the the post that this question is referring to Yeah. is um a specific idea of Vitalic >> to allow for recovery using something

called proof of seed. >> Yes, I think I saw that as well. Yeah. >> So, normally when you um have an address, >> you have the the the private key and you sign with with your private key. >> Yeah. >> Now, the problem is that if we have a quantum attacker or an AI attacker, the private keys are no longer private. They they become public. Exactly. everyone can can can see the private key. And so the question is what can we use as a secret instead of the private key and it turns out that the seed phrase so the 12 words or the 24 words that you write on a piece of paper um is is quantum secure because the process of going from seed phrase to private key uses hashes which

are postquantum secure. Um, so Vitalic's idea, but this would be in the, you know, the most extreme of emergencies, would be to just freeze ECDSA signatures, just say that they're invalid from this point onwards. >> And if you want to spend funds, you have to do it using a proof of seed mechanism. So you'd have a zero knowledge proof of knowledge of uh of your 12word seed phrase. >> Zero knowledge proof of knowledge of your 12word seed phrase. Wow. >> Exactly. >> Quite a mouthful. Well hopefully we never have to face that scenario.

Hopefully. >> Now one thing that I want to stress is that >> this proof of seed will work for almost all users. >> Okay. >> Except for some of the most sophisticated ones for example custodians which instead of having the seed phrases they have you know fancy MPC setup >> which is slightly different. >> Yeah. Now, the good news is that these fancy setups um are associated with some of the most sophisticated custodians. And so, for them, what I would recommend is to enter the bunker mode, which is bunker mode. Yeah.

>> To not even reveal your public key. Yeah. >> So that there's no risk that someone can >> No signing, no transactions, right? Yeah. >> Yeah. Well, you you can sign, you can use your funds, but every time you move your funds, move it to a clean address. >> Exactly. They move it to a clean address. >> And some custodians, for example, Coinbase does this properly. >> Okay. Wow. >> They don't leak the public keys, which [snorts] is good. >> But other custodians like Binance have $400 billion in two addresses with the pup keys leaked. >> Wow.

>> So, anyone from Binance here, just please consider, you know, securing your cold storage because we don't want to also lose the cold storage. >> Yeah, exactly. Practical advice. really really practical advice I think for all of us in the industry whether you're working in a cryptocurrency exchange or not. Really practical. Thank you. Let's go on. We got a few more questions and a little bit more time for answering. Okay. How will Ethereum prevent postquantum ZK proving model from creating an unfair yield advantage for institutions who can run in-house provers to avoid attestation fees solo stakers must pay? Complicated question.

No, this is a really easy question. >> Oh, it's an easy question. It's complicated for me, a non tech guy, but feel free to take it away, Justin. How would you answer this? >> Okay, so the the the easy question is that there's no such thing as prover fees. Um the the the ZK proving is extremely cheap. It has been incredibly optimized. >> So much so that um we can just have the same altruistic model that we have today. So today when you run a node you will altruistically as in do it in the goodness of your own heart gossip the transactions you will uh serve the history um and you'll do all sorts of things that are in some sense optional and the reason that you do it really is because of the power of the default y so

the clients by default will have you do all of these altruistic tasks and it's so cheap that you can't be bothered to disable it uh manually and this will be the same thing for snark proving it will is so incredibly cheap um that it you won't you won't even notice it and it will happen in the background. There's no fees. >> Fantastic. It'll be so cheap that you won't even notice it. I love that answer. Fantastic. Okay, a few other practical questions coming your way. These look like they're questions from people who are like users, everyday users. Very good question this one. Will my future postquantum wallet seat phrase require an entire bookshelf to store?

How does the seat phrases work in a postquantum world of Ethereum? So the great news is that they work exactly the same way. >> Exactly the same. Okay. That's really that's a relief. >> Same standard for seed phrases. And actually what you can also do is you can keep your seed phrase. >> Oh really? You don't have to change your wallet. >> You don't have to change the seed phrase. Well you do have to change the wallets. >> The wallets. Yeah. >> But and the addresses but not the seed phrases. >> Ah. >> So >> Okay. I didn't know that. >> As I mentioned in the proof of seed mechanism, the proof of seed is quantum secure.

>> Gotcha. So you can keep your 12word seed phrase >> but when you derive addresses from it you want to make sure to derive postquantum addresses. >> Ah all right wow you've explained it so simply now even I as a non- tech person managed to understand it just in those few moments. Let's continue. This one's a slightly philosophical/general question. Justin crypto is already difficult to explain. How can I explain postquantum crypto to my 60-year-old dad? Oh, >> so I'm going to steal an analogy from Nico Mumblat. Um, >> so basically in his analogy, there's two materials to build infrastructure in the

real world. Let's say there's wood and there's steel. >> Um, and one of the materials, wood, is flammable. >> Yes. >> Um, and the question is, what happens if there's a fire? Right. >> So basically we have these two materials to build our cryptography. We have the really really strong stuff which is hashbased which is made out of steel that's staying. >> So you know the the chain of blocks the the the the transaction hashes the state tree all of that in Ethereum is built off steel. It's not breaking right. But there's a few things which have built up wood okay >> on the Ethereum protocol and that's specifically um the ECDSA signatures,

okay, for the users, the BLS aggregate signatures for the consensus layer and the KZG blobs for the data layer. So there's like three pieces of of different types of wood >> and we want to replace those with like the highest grade possible steel. >> Fantastic. So I like that analogy, right? The Ethereum blockchain is made with steel. a few pieces made with wood that's being upgraded. So fantastic. That's one way to use an analogy to explain it to someone who may not be so familiar. I love that. This one's also about uh wallets. I think you answered it a little bit already. How will Ethereum protect old wallets from quantum attacks?

>> Right. Um >> so you said you need to generate a new wallet, but you can keep the same seed. >> Yeah, you keep the same seed. >> Okay. >> Um and um the wallets could just do that for you, right? They could say, "Hey, you know, we noticed that you have some pre-quantum addresses. Would you like to migrate? Press this button to migrate." Okay. >> Um, now, one thing that I want to kind of stress is that there's no need to rush. There's no emergency. You know, take your time. Some people are going to try and scam you, okay? By saying, you know, download this postquantum secure wallet. They're going to try to scare you.

>> Always take your time. Um now when it comes to old wallets there's two types of old wallets >> okay >> there's those for which the owner still has access to the funds okay >> they still have the seed phrase >> and then there's wallets where the funds are just lost >> okay >> and you know one example would be Satoshi's coins in the context of Bitcoin [snorts] >> and you know for the first class of of wallets really we just need to educate and have the infrastructure to do the you know uh um a calm and steady migration to to these new wallets.

>> But then the real question is what do we do with the lost addresses? >> And there's really like two classes of solutions. >> Solution number one is don't do anything. >> Just let the eventual quantum attacker or attacker just steal those funds. Okay. >> And you can think of it as being a bug bounty for building a quantum computer. >> A bug bounty. Okay. A big bug bounty. Yeah, and actually there's this is part of the business model and some of the pitches that the quantum companies will tell their investors, you know, let's go take some of the funds, you know, take a take a cut and return the rest to the to the, for example, to the US government.

And there's a whole legal process really >> for this um actually in the case of of shipwrecks. So if there's a ship which has gold in it and it sinks, >> what happens is that uh there's an opportunity for the government to employ a company to go rescue the the gold. >> Gotcha. >> The the company takes a 10% cut. Let's say the 90% goes in a fund controlled by the US government, for example. >> Yeah. >> And anyone who who is the rightful owner of the gold can go claim that gold. And if there's no rightful owner, well, it just goes to the US government.

>> Wow. Okay. Yeah, I did not know that. Yeah. So, people are building quantum computers to crack open old wallets. >> Yes. Now, the second class of solutions um besides not doing anything is to freeze the coins. >> Freeze the coins. Yeah. >> Yes. >> Now, I believe at least I hope in the context of Ethereum that we won't have to make this this decision. And the reason is that the fraction of all the coins that will be exposed to quantum computers and lost will be very very small.

>> Call it under 1%. >> On the other hand, and so it's so low that we kind of we don't care if it gets stolen. On the other hand, in Bitcoin land, we have Satoshi's 5% uh of the of the whole supply, 1 million BTC. Um, and we also have another 5% from very very early users back when Bitcoin was monopoly money and they had no hygiene in terms of of having backups of of their keys. So there's about 10 10 to 15% of all the BTC in Bitcoin which is lost >> and that would be really bad right if one single attacker got 10% of the Bitcoin supply. So my personal prediction is that Bitcoin will opt for the second option which is

interventionist right >> and uh Ethereum will go for the the free market kind of pure cipher punk approach. >> Okay fantastic great answer >> and then we'll be one for one where Ethereum will have been interventionist for the DAO and Bitcoin will have been interventionist for quantum. >> Wow really really comprehensive answers. Okay, we've got about one minute on the clock. Just one final question I think. Um maybe a word of advice. We've got something here. Okay, let me check this out. Okay, Justin, our final question for today. With Ethereum moving towards postquantum security, what would you recommend young developers? You know, there are a lot of young developers here. So many of them came out to Devcon India. What would you recommend young developers and researchers to start

learning or contributing today to help build Ethereum's quantum resistant future? >> Okay, so there's a very easy answer here. >> Sure. Go all in on lean 4. >> All in on >> lean for lean for. >> Okay. Lean for is a programming language. >> Okay. >> It's like there's this saying that lean 4 is the new rust. >> Okay. Gotcha. >> Yeah. >> So [snorts] for I would personally forget about rust >> and go all in on lean for >> all in on lean. Um, and is this basically this new approach of developing software where you specify your goal, >> y >> your specification, if you will, in lean for this is going to be extremely compact. Think hundreds of lines of lean for and then you're going to let the AI

do all of the work for you. So, it's going to go implement your binary >> in in um, you know, x86 or ARM or, you know, whatever target hardware you have. Yeah. and it will prove that the binary that it built is matches your specification. And so now the only thing that you have to audit your trusted codebase is the very short specification. And this is what we're doing uh for within Ethereum for now pretty much everything and there's even you know some some projects that are trying to build entire Ethereum clients all in lean for um and I think it's it's it's the future.

>> Fantastic. Right. So advice for developers, forget about Russ, go all in on lean 4. Last words that you have, we're finished with the Q&A time, but any last words that you want to share with the audience about the postquantum future of Ethereum? >> I mean, one thing that we didn't talk about and I'm I'm very surprised we didn't talk about it is is is the the post AI aspect, right, >> of of our cryptography. So I believe that from a postquantum perspective, we're in a fantastic position. Yes, >> there's basically no risk.

>> Oh, wow. >> That Ethereum will will be, you know, threatened by postquantum because the earliest timelines, the most aggressive timelines that I know about is 2029, >> right? >> But we should be ready before then. >> Ethereum is ready. I think based on what you've said, we're ready for that. >> Yeah, we're good. >> The new risk is AI. >> AI. Yeah. >> Okay. And we already have today mathematical super intelligence. Right. >> So one of the questions that we have to figure out is today is there an attack on our cryptography? Right? And this is something that def foundation is taking extremely seriously. But even if the answer is no to this question, what about in 3 months, in 6 months, in 9 months? Because as as the new AI models

come, that's always a new opportunity for new mathematics. >> Yeah. >> And and new threats. So my personal thesis here is that over the next few months the post AI threat will just become louder and louder and louder. So much so that it might crowd out um the the postquantum narrative. >> I see. Well, the threats are real, but I believe the solutions are on the way as well. People are working hard behind the scenes. Today we talk about postquantum. Our next DevCon, we're going to talk about post AI perhaps. Ladies and gentlemen, that's all the time we have.

Can we please give a big big round of applause to Mr. Justin Drake, ladies and gentlemen. [music]