So you wanna Post Quantum Ethereum - Antonio Sanso

Transcript

[Music] all right does it work cool okay thanks a lot for the introduction So today we're going to talk about we see how we our plan as Ean Community to try to migrate ather to postquantum cryptography we see what actually means a little notation that I use always assuming you get something to eat and you're tired you want to get an app do it but when you see the red stars it's a good time to wake up um so for people that don't know ethereum uh I have here like a macro view of how itum is

actually works and we have four micro areas so we can in a long if you zoom out we can seeum being in four different parts the execution parts that basically like what we see like when we use it we use get or never mind or whatever so it's like where the transaction are happens then we have the consensus part where the magic happens and yeah where the validation of the the blocks happens then we have this new part of ethereum that is called uh data availability sampling or D or 4844 or Proto sharding you call whatever you want and you have this part is for the future for light clients that is called stess itum and

they're like we have this vertical trees uh uh behind data availability something I forgot to mention there are all these things called rollups or L2 and you can see there optimis arbitrium linear whatever is your test um now if you want to put a bit of a to see inside the engine of this area of of ethereum we have this four part that is cryptography so what is the cryptography behind any of these components so behind the execution layer there is something called ecdsa signatures that is the same one that use Bitcoin by the way um behind the consensus we have another really nice piece of map this called BLS

signature and uh behind the data availability sampling we have something called kdg commitment you don't need to know what it means just put some names here we'll see shortly why they're all here and behind stess ethereum there's something called Peds and commitment now one thing that is in common behind all these four things is one one things that is elliptical so whatever is in the engine of these four components is really elliptic curves and uh yeah this it turns to be a problem in the long run um again why what which kind of elliptic curves are Behind These Technologies behind ecdsa we have one

elliptic curve called secp 256 K1 and again it's the same that uh uh Bitcoin uses and behind bls2 behind consensus and data avability sampling we have another pairing friendly curves no worries if you don't know what it means but it's called BLS 12381 and behind stairless ethereum there's another curve that it turns I kind of made with another collaborator it's called bandn well yeah it will not last long unfortunately was actually ready to be shipped but given the fact that we have this Quantum Menace probably is not going to happen before to see why uh I I swear I have only two slides that shows a little bit

of math but just to give a there's no really map behind here just like an idea and we see why we cannot use any more any more elliptic GRS at least so this elliptic curves and basically a rough idea of how it works this comes from the some guy in the old Greece called dantos they discovered this really nice idea that if you have two rational points then no worries what mean if you know what means to rational in an elliptic curves you can always find the thir one and the way to do it is just trace a line between the two points this line hits the curve in the third point and you have this weird additions that's is defined like this um what actually we use for cryptography is

not even addition but is a kind of scalar multiplication what you need to remember about the stock is only one little thing this problem this is a really simplified one and it's called so the problem is not simple but I simplified here highly and it's called DLP or discrete logorithm problem and more or less what happens even now when you connect to the Internet or when you use ethereum or Bitcoin there are some exchange of points especially in in the internet your browsers let's say Chrome or Firefox will send some points to the server and the discret logori problem is basically having this um these two points that you know they are public and you need to know a kind of scolar that

let's say connects these two points at high level we say has a relationship between two points and so far this worked this concept was invented for elliptic cves in around 1983 84 and it served us well for many many years but yeah I have a bad news this is not going to last long uh because in 1994 we got one guy one researcher called Shore that invented the soal sh algorithm this will basically destroy completely our internet and what we know about Bitcoin or ethereum of any other publicy cryptography that lies around and so we need to do something not doing

anything is not an option um one things just to warn you it's like don't worry for now at least even for the future actually vitalic wrote a post some years ago and um and it's very nice you can read this in know it research and basically tells what to do in case of emergency of a quantum computer and um yeah but in a nutshell what he says is uh what I told you before that quantum computers breaks Public public cryptography but it doesn't break private symmetric cryptography so hashing for example is not broken it's broken but not in a so bad way it's just like the algorithm

efficiency is only quadratic so just double the key and you're going of find and the reason why I'm telling this is if you have a a a public key an address in in ethereum it is the hashing of the point of the elliptic C what you need to remember is not this but you need to remember is that if you have an ethereum address where you have some eer and you never move an eer from that address you are safe even with a quantum computer so if you if you see a quantum computer coming just move your eer to a fresh address and you're are fine because the KCK part on this slide so this means hashing this means shat this means symmetric cryptography is not broken by

quantum computer but at the time you're actually doing one single transaction well goodbye youor in case there is an attacker with on the computer so we need to find a replacement and um as we said elliptic curves doesn't work anymore in the future we need to find some some replacement we have kind of four or five micro areas the first one I already mentioned hash based cryptography we probably resist it then we have So-Cal latis based cryptography it will I'm not telling you what it is in in details just put here some sentence but really not need to remember we have some other area called code based cryptography is really really

old it's actually older potentially than the invention of uh elliptic CSE but is now coming back to be modern again because a a broken clock is always right twice a day then we have multivar cryptography and then of course my favorite part I see some people here that do this kind of research they super singular elliptic isogen cryptography that is awesome now the bad news is that when you kind of try to replace the stuff it takes time so this not immediate so we we need to act in time so as I said you also the internet cryptography is going to be

broken by qu computer indeed the the nist that is like when kind of a American Association let's say that is behind the cryptography of the United States um announc a kind of call for proposal for postquantum cryptography already in 2016 and and uh already in 2017 people start to propose new cryptography based on the Assumption we've seen in the previous slides so there were some assumption based on latis some on code some on multivariat and what happens in this kind of situation is like danger game or like I don't know people try to

kill each other Nam like cryptography try to kill others proposal until one wins or in this case there's not only single winner but yeah will the idea is to have like few kind of proposal that will replace um the elliptic cryptography that we deploy now um well this continues so in 201819 it was the first round of evaluation so it means that some of the candidates were quickly eliminated actually I think four or five were already eliminated the nights of The Proposal submission by a few people uh few years after we got some other um selections so other standards or yeah other algorithm were were were

killed and finally in 2022 we got a selection uh candidate for the standardization and yeah well the implementation started contined to be there and yeah as you see like in order to have something deployed by 2030 or I think the maximum for United States government software 2034 well they already started in 2016 this takes really lot of time whoever WR software knows that is not easy you need to standardize in this case plus r in the software plus test so also for us it's going to take time by the way these are the four uh

kind of winners we have one winner for the king capsulation that is means encryption and it's based on lates and we have three winners uh for signatures they're Del ium Falcon that are again ltis and sphinx that use hash based now we already started as etherum Foundation or as eum Community to work on um some post Quantum uh algorithm many years ago already in 2020 I've here some papers that tells uh some stuff we've been doing not now already like three four years ago here we have a an attempt of doing some multi secret scheme from latis this is one of my proposal to use

isogenous for single secret leader election uh this again the Improvement of the first paper on latice for for multi signators this again me doing some misogynous for something called stealth addresses so we were actually thinking about post Quantum for a while um until 2024 2024 was actually a topic here for uh for quantum computer uh the first things that caught the attention not the media but people that follows papers uh was this paper on a AR archive and are from Google people and they show some kind of

breakthrough one thing is like that uh we know uh I'm not an expert computer but basically at the moment a lot of problem are not actually theoretical but are engineering problem and Engineering problem tend to be solved with time but tend to be solved and here in 2024 it was this paper from Google that they had some kind of engineering breakthrough going through um um in this paper and it was U yeah was still an academic paper but people that follow Scott arenson that's one of the the main people that do uh Quantum Computing he kind of shifted his message and when

before was saying yeah start to replace your your algorith with something uh it was kind of urging people to really start replacing their algorithm with something is not RSA or elliptic curves and then what actually moved a lot uh Waters and it's actually the same thing that happened in August but was for the mass but basically like the the Google CEO was introducing this will of that is nothing else that a a chip that does Quantum Computing that is basically that paper of August 2024 but of course like many people use Twitter and not many people follow

archive but it's basically the same thing coming back to ethereum we is clear that doing nothing is not an option so these are again our micro area and we need to take time and try to study what we can do for AOS Quantum materium uh today we're going to only talk about the first um part so is the part I've been working people following Ed research might have seen some of my post and uh I've been proposing to use a falcon as an ethereum transaction that will replace ecdsa but uh people that follow the ethereum

um let theum research knows about Bon chain this this big project announced by Justin Drake one one of my colleagues at Dev connect in bangok and that's is going to tackle the consensus area it's a really an ambitious project which going to last four or five years and again we have to find as well replacement for das and stal eum as a result probably verle tree whoever here likes verle tree is probably not going to happen because well the Paradox here is that at the moment the way how we store data inum is called Patricia Merle tree that use hashes and is postquantum and if we go to veral 3 we'll use PS in commitment on elliptic curves that is not postquantum so it's kind of

regressing so probably what is going to happen is we skip veral tree and we go directly to something called binary tree plus posidon but again in at in it with like the governance is well you know is not an easy thing so we'll see what is going to happen so um about replacing ecdsa I've been try to split the problem in three part and U how can we replace ecdsa with a new um algorithm the first option is to do a hard Fork doing an hard Fork means do a new IP doing a new release of of ethereum and well it's not

easy I mean we are going our ROM or release is about one release every one and a half two years and it's a big thing clients need to read software testing and there are no not many things that goes through and uh yeah but it's an option how to do it it's actually technically is not really hard I talk I'm not a developer so I can code but not a great coder I talk with the people of get and basically the the way to do it as a doing Falcon as a EIP is basically like something really simple in terms of code there not many lines of code and it will these are only for people that follows the

technicality of coding but it's basically doing some new transaction type and it's pretty easy indeed if you're going to see one of the pros of using an hard Fork to do Falcon as replacement replacement of ecdsa is that it's actually easy to code and fast because it's going to be code that runs on the client software the problem here is is not future proof what happens is Falcon is broken we need to do again a new hard work and you move again your eth to an address that you can move and so on yeah so is there any better

way and um we have another possibility this something called account abstraction this is unique um for ethereum namely like if you think about Bitcoin has the same problem it can do hard for way they can do a new algorithm replacing ddsa with the I don't know Falcon as well or whatever they choose we all know that in Bitcoin things are really slow but eventually they have to something but they cannot do a account abstraction because abstraction I cannot introduce what it is but it's basically a friendlier way to interact with the with ethereum and um it's an option that only eum has at the moment and basically like if you want to follow

the account obstruction way we have it right now account obstruction is reality whatever you log to ethereum uh through a a wallet that doesn't use a seed phrase that use I don't know the pass key of your iPhone Google account and you are loging in ethereum you're actually under the hood using this awesome technology called ERC 4337 and basically in pectra this the next upgrade of U of itum you will have a ERC 4 337 on steroids it's going to be more in the protocol because it's in EIP rather than ERC for people that knows what it means and what what actually are the advantage of the pros and cons because

there are not not only advantage of having an account obstruction solution well it's really elegant and flexible namely we can have more than one post Quantum um signature easily I just actually promised to some isogen people that I will I will try to put um Sky sign so it's on the on the rod map and uh so we can actually have more solution than not because it's not hardcoded is it's really easy there is some price to pay through you at how things are at the moment uh and you are writing a account obstruction it means that the validation part of the signature happens on chain

on chain means that that you need to write solidity writing solidity means that it's well it's not rust or C or goong is something really that you pay the price how much is this price well a lot with the current contract of Falcon um not optimized it's just like some contract at the moment on the internet one doing one Falcon verification that the easy part of FAL but it's the only one that needs to be on chain is 25 Millions gas that I don't know if you know it but it's huge um Sphinx cost a bit less but it's 12 Millions if you want to go to something

even more exotic like Mayo is well 938 Millions so of course this is not going to be an option has things are we either optimize things the contract level and we have the possibility with some other Improvement to the to the evm like if Max for example or we start another solution that I call in my talk or in my in my post on it research the hybrid way this actually a good way to start hybrid way will actually means this well means using again a kind subraction but start to Gentle start to tackle rollups start to tackle L2 in L2

for people RP doesn't mean that anything is dead here it means something else RP is the corresp corresp of EIP for raps and uh turns out we already have one so we have many proposed but we have already one RP proposed and this this RP 7212 and it's basically if you ever used Pass Key to log in to ethereum under the hood use this it use uh this software that is deployed only on some L2 and in this case we'll have the best best of two words so again we have the good of um the good of account obstruction so it's an elegant flexible

solution with it is easy to code and fast and yeah the problem to here is that it's a start it's temporary it doesn't solve at all the L1 case but at least it start to cover the rollups I'm starting to this I with the proof of concept if someone is interested you know my how to to reach me um I would like to end this talk with this actually things that was shared by set lloydd in in interview in uh when was is in August so when do we we'll have scalable qu computer he he replied I say 10 years plus or minus never this as well an

option and that's basically it awesome Antonio thank you so much uh time for questions we have one up there yeah whoa there you go yeah so my question is um so you kind of said that just hard forking is basically non future proof because what if Falcon is broken have you ever thought about like uh using combiners for Signature schemes using combiner like uh graphic combiners more than one like it happens now with the hybrid yeah for sure for sure like this is an option but you know when you combine things one of the most

precious things you have for blockchain is space that's why we actually we I've been proposed to use um Falcon and not the lithium because that's the the space of the signat is shorter that's why I would love to say isogenous because the keys is even shorter sure so this will be what you using Coman is Good from the perspective of fut proof but in terms of space is not ideal in terms of execution so the thing that differs blockchain from other things our laptop for example is that you pay for execution through gas and space through gas as well yeah so even one optimization you see on the cost of the transaction yeah but theoretically it's a good idea okay

thank you if it's okay um thanks for the the uh good talk Antonio um you had the slide with the gas costs of verification um do you have a number for what ecdsa would cost in terms of sure no at the moment CS is not is 2,000 something nothing and the reason why because it's it's hardcoded I mean this indeed are are contract is written in solidity if we use the hardcoded way also also Falcon will cost as less as cdsa yeah but it's like order magnitude more super thank you so much big round

of applause for Antonio [Applause] [Music]