Will Quantum Computing Kill Bitcoin? | Scott Aaronson & Justin Drake

Quantum computing is advancing rapidly, raising significant questions for cryptography and blockchain. In this episode, Scott Aaronson, quantum computing expert, and Justin Drake, cryptography researcher at the Ethereum Foundation, join us to explore the impact of quantum advancements on Bitcoin, Ethereum, and the future of crypto security. Are your coins safe? How soon do we need post-quantum cryptography? Tune in as we navigate this complex, fascinating frontier. ------ 📣SPOTIFY PREMIUM RSS FEED | USE CODE: SPOTIFY24 https://bankless.cc/spotify-premium ------ BANKLESS SPONSOR TOOLS: 🪙 FRAX | SELF SUFFICIENT DeFi https://bankless.cc/Frax 🦄UNISWAP | BUG BOUNTY PROGRAM https://bankless.cc/Uniswap-Bug-Bounty ⚖️ ARBITRUM | SCALING ETHEREUM ⁠https://bankless.cc/Arbitrum 🛞MANTLE | MODULAR LAYER 2 NETWORK https://bankless.cc/Mantle 🌐 CELO | BUILD TOGETHER AND PROSPER https://bankless.cc/Celo ------ ✨ Mint the episode on Zora ✨ https://zora.co/collect/base:0x4be6cd4d402fed49eb2de95fbc8e737e8ffd3e7f/15?referrer=0x077Fe9e96Aa9b20Bd36F1C6290f54F8717C5674E ------ TIMESTAMPS 0:00 Intro 6:50 Google Willow Chip 11:58 How is Quantum Computing Accelerating? 19:27 Quantum vs Classical Computers 40:18 Why are Quantum Computers so weird? 46:18 Quantum Computing & Cryptography 52:53 What will Break Cryptography 54:45 Time Horizons 1:03:14 Accounts Getting Hacked 1:13:23 The Bitcoin Case 1:24:10 Quantum Money 1:29:44 The Ethereum Case 1:35:00 Closing Thoughts 1:36:24 Debrief with Justin Drake ------ RESOURCES Scott Aaronson https://www.scottaaronson.com/ Justin Drake https://x.com/drakefjustin ------ Not financial or tax advice. See our investment disclosures here: https://www.bankless.com/disclosures⁠

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  If, let's say, there's only a few entities in the world that have scalable quantum computers, that allows those entities to mine a lot more Bitcoin than everyone else. Now, eventually, if you got to a world where just about everyone had access to a quantum computer, then it's kind of amusing what would happen.

• 0:23Ryan Sean Adams?

  Welcome to Bankless, where we explore the frontier of internet money and internet finance. And today, we're exploring the frontier of quantum computing and its effect on our internet money. What's it gonna do? Are quantum computers gonna take all of our Bitcoin? This is Ryan Sean Adams. I'm here with David Hoffman, and we're here to help you become more bankless. Guys, special episode. It's divided into multiple parts, I would say. The first part, we have Scott Aaronson on the podcast. He's a theoretical computer scientist. He is a foremost expert in quantum computing. We also have Justin Drake on the podcast for part of this first part, and he asks Aaron Anderson some questions as well, particularly about the effect of quantum computing and our cryptocurrencies like Bitcoin and Ethereum.

• 1:05Ryan Sean Adams?

  Now, because the subject matter goes very deep in quantum fundamentals, you might feel, Bankless listener, like you're hanging by the seat of your pants, just trying to keep up with these big brains and some of the ideas propelled forward. So never fear. We have a final part of the podcast, a third part of the podcast, where it's just David, myself, and Justin Drake. And what we do is we try to synthesize everything we've learned. And that, for me, was one of my favorite parts of the episode, because it was taking everything Big Brain that Scott Aaronson said and applying it directly to Ethereum and Bitcoin, what could happen in the cryptosphere. So three parts to this episode, and you guys are welcome to skip to one of those parts if you get too lost in the weeds at certain sections.

• 1:48David Hoffman?

  Yeah, I would say the first part of this episode are two high schoolers asking a PhD about quantum computing and trying to get that PhD to really put it into simple terms. And I think I thought we did okay there. If you use 100% of your brain power, Bankless listener, I think you'll kind of catch a vibe, you'll catch a direction for it, but it does get pretty technical pretty quickly. And then when Justin takes over, it starts to focus more and more on how this relates to crypto. And so the way that this podcast starts is, you know, what is quantum computing? How is it different? How does it work? How does it change and impact the world? And then as we move, progress further into this podcast, it's how is this going to impact our backs? Oh, what's going to have to change? What are we going to have to change in Ethereum? How is Bitcoin going to have to navigate these changes?

• 2:33David Hoffman?

  Which is an even more difficult conversation that I'm less optimistic about. And overall, I just learned a lot. Scott, it's an honor to have Scott on the podcast. He's a big deal Chad in this space of quantum computing. And I would also say how quantum computing relates to crypto is going to be kind of a microcosm for how it impacts the rest of society. Crypto is not the only industry that is going to be impacted by this. The rest of the world is going to be impacted by this. And like other examples, I think crypto is going to be a little bit of a spearhead, a canary in the coal mine, because we're going to tackle this first because we see it coming and we're futurists and we pay attention to stuff like this, which is why we are doing this podcast.

• 3:12Ryan Sean Adams?

  Yeah, we are. And it's actually a bigger deal than I thought going in. Like it will have a more fundamental impact on cryptocurrencies than I thought going into this episode. So guys, we appreciate it. Let's get right into the episode with Scott Aronson and Justin Drake. But before we do, we want to thank the sponsors that made this possible.

• 3:28David Hoffman?

  Uniswap Labs is making history with the largest bug bounty ever. $15.5 million for critical bugs found in Uniswap V4. This isn't just any update. Uniswap V4 is built with hundreds of contributions from community developers and has already undergone nine independent audits, making it one of the most rigorously reviewed code bases to be deployed on-chain. And with 2.4 trillion in cumulative volume processed across Uniswap V2 and V3, without a single hack, the commitment to security and transparency is rock solid. Now Uniswap Labs is taking an extra step to make V4 as secure as possible with a $15.5 million bug bounty. Head to the link in the show notes to dive in and participate in the Uniswap V4 bug bounty. All the details from eligibility and scope to the rewards are there.

• 4:12David Hoffman?

  The Arbitrum Portal is your one-stop hub to entering the Ethereum ecosystem. With over 800 apps, Arbitrum offers something for everyone. Dive into the epicenter of DeFi, where advanced trading, lending and staking platforms are redefining how we interact with money. Explore Arbitrum's rapidly growing gaming hub, from immersed role-playing games, fast-paced fantasy MMOs, to casual luck-battle mobile games. Move assets effortlessly between chains and access the ecosystem with ease via Arbitrum's expansive network of bridges and on-ramps. Step into Arbitrum's flourishing NFT and creator space, where artists, collectors and social converge and support your favorite streamers all on chain. Find new and trending apps and learn how to earn rewards across the Arbitrum ecosystem with limited-time campaigns from your favorite projects.

• 4:57David Hoffman?

  Empower your future with Arbitrum. Visit portal.arbitrum.io to find out what's next on your Web3 journey.

• 5:06Ryan Sean Adams?

  Bankless Nation, I am honored to introduce you to Scott Aaronson. He is a theoretical computer scientist and he's a chair at the University of Texas at Austin, where he directs the Quantum Information Center. He's an expert in quantum and over the last two years, he was actually on leave, he was working on AI safety at OpenAI. So it's safe to say we have an expert in at least two domains of interest today: quantum computing and AI. Scott, welcome to Bankless.

• 5:33Speaker 00

  Well, thanks so much. It's great to be here.

• 5:35Ryan Sean Adams?

  Joining us, because this is kind of an intimidating subject matter for David and I, we're gonna need help. We've got Justin Drake, you know Justin from the Ethereum Foundation as well. He's going to serve as technical co-host for a portion of this conversation. Justin, how you doing?

• 5:49Speaker 03

  Doing great. Thanks for having me and a real honor to be on the podcast with Scott.

• 5:52Ryan Sean Adams?

  Yeah, great to see you, Justin. Yeah, it's great to have Scott interacting with the crypto community, because we have quantum intersecting crypto here and that's kind of the genesis for this conversation. I think David and I have a simple goal for this episode, which is just to get crypto people up to speed on quantum computing. Because I feel like we just don't know enough right now. We've heard the scary news that quantum might be used at some point in the future to break our cryptography and to steal our cryptocurrency. So that's kind of scary. And so what I want to do for Bankless listeners is break this into two parts. Part one will be what I call the little brain questions. As for David and my We're going to ask you about the Quantum 101, kind of the popular beliefs about quantum. Make sure we have a good grounding and foundation.

• 6:36Ryan Sean Adams?

  And then part two, Justin's going to lead. That's more the big brain side of things where you guys can talk about cryptography, quantum, will this break Bitcoin, will this break Ethereum? And if so, how? And we'll do our best to keep up. Yes, thank you. You guys ready for this? Perfect. I got the head shake acknowledgement, which is just as good as the verbal. Let's get into the small brain, Quantum 101. Okay, so there was this thing that happened about a month ago. This was early in December. The CEO of Google tweeted something out, Sundar, the CEO of Google. He said, Willow, our new state of the art quantum computing chip with a breakthrough that can reduce errors exponentially as we scale up using more qubits, cracking a 30-year challenge in the field. So introducing a new state of the art quantum computing chip at Willow.

• 7:20Ryan Sean Adams?

  And this, I think, broke mainstream news. It broke into crypto and started us talking once again about quantum computing and how it might affect cryptocurrency moving forward. So there's a lot of worries around this. I want to start the question with maybe this tweet. The Google Willow chip, is this a major breakthrough from your perspective? I mean, you've been in the, in working in quantum for 20 years. How big of a deal is this?

• 7:44Speaker 00

  I mean, I would call it an engineering milestone. So it's not that it overturns anything that was previously believed or represents some great new discovery. I mean, this is stuff that, as theorists, was predicted in the 1990s, right? That once you get a qubits that you can act on with a low enough error rate, then you can do these very clever quantum error correcting codes, right? That will protect your underlying logical qubits sort of even better than the physical qubits are being protected. And in principle, you could then preserve encoded qubits

• 8:29Speaker 00

  for arbitrary amounts of time, right? So this is a theory that's been in place since 1996 or so. But what's exciting is that like 30 years later, You're only now finally starting to experimentally demonstrate some of these predictions. So the milestone that Google announced in December, it was actually a paper that they, you know, had online since the summer. So it was sort of old news to us by the time that Google announced it in December. But, but, but, you know, they have now built a chip with like 103 physical qubits, I think. That's what, that's what Willow is. Okay, it's superconducting

• 9:14Speaker 00

  qubits, you know, arranged in roughly like a 10 by 10 grid. And they, they use them to do, implement something called the surface code, okay, which is a quantum error correcting code. Again, as theorists, we've known about since 1997. Okay. But for the first time, they're doing it in a way where as they scale to larger and larger surface codes, so like from a three by three array to a five by five to a seven by seven and so forth, they are preserving an encoded qubit for longer and longer amounts of time. Right? So they've passed the threshold where going

• 9:57Speaker 00

  to a larger code gives you more and more of a net win. You know, it's kind of like the, the Fermi pile in 1942, you know, past the threshold where, you know, each glia is decaying is causing more nucleotide decay. Right? This is, this is some kind of important threshold. Right? So now, you know, it's still not good enough to do, you know, a full scalable, you know, fault tolerant quantum computation. I mean, for one thing, you know, we're only talking for now about one encoded qubit, right? That is just sort of sitting there, right? You know, a next step would be to build multiple encoded qubits, have them interact with each other. That hasn't been done yet with,

• 10:42Speaker 00

  with encoded qubits of this quality. And, you know, if you really wanted to, I mean, we'll,

• 10:49Speaker 00

  Into this later, but if you really wanted to break cryptographic codes, then you'd probably be talking about millions of physical qubits in, you know, possibly in hundreds or thousands of dilution refrigerators with interconnects. So, a long story short, we're not there yet. Okay, but you know, this is a, an important milestone, something that theorists talked about since the 90s. And it is exciting that just within the last year, you know, we've seen that cross, you know, and you know, there have been skeptics of quantum computing who have, you know, I think, you know, firmly predicted that, you know, we would never get this far, that, you know, like, we don't really understand quantum mechanics itself.

• 11:32Speaker 00

  Or, you know, there are sort of sources of correlated noise that violate the assumptions of the theory of quantum fault tolerance. And, you know, when we try to build this, we're going to see that. It's going to make quantum computing impossible, you know, and we haven't seen any sign of any of that. Right? You know, everything seems to be working, just like the theory in the 1990s said it would. So that's the, I would say that's the main upshot.

• 11:58Ryan Sean Adams?

  Well, that does seem significant from the perspective of kind of the theories being worked out now in engineering. And so this is a, an engineering milestone, as you said.

• 12:06Speaker 00

  Yes.

• 12:07Ryan Sean Adams?

  So a big question then is like, how, how much will this accelerate moving forward? Right? And are there any analogues? I mean, are we looking at kind of the transistor and Moore's law? Are we looking at something as explosive as AI, which just seemed to you like we went from transformers? And then suddenly there was, you know, GPT? And now we're seeing monumental gains? Like, how fast could this accelerate moving forward?

• 12:29Speaker 00

  Yeah, I mean, you can always try to look for historical analogies, right? I, I, I do that as well. I do it all the time. It's also hazardous, right? Because each situation is, is not quite the same as the previous ones, right? In this case, you know, I think my main caution would be, you know, some people just, you know, they, they hear all these exciting things about quantum computing and they expect that, that, okay, then, then this must be, just be the next frontier that is going To replace all of our existing computers, right? It will just revolutionize everything. And, you know, the hard part with a quantum computer is that,

• 13:11Speaker 00

  in order for it to be useful, you have to beat a classical computer, right? Classical computers already exist. They are, you know, one of the triumphs of civilization. Okay, and we can get into this later, but it is mostly for certain very special tasks that we know how to get a huge advantage with a quantum computer over a classical one. And for many, many other tasks, many, you know, I'd say the majority of what we do with our computers on a day to day basis, a quantum computer would probably help you little or not at all, right? It would, you know, you could use a quantum computer to check your email or to play Candy Crush,

• 13:52Speaker 00

  but it would be like using the space shuttle to taxi people around the parking lot, right? It would just not make sense. Okay, so, so, you know, you really have to look at, you know, the specific air applications where a quantum computer promises an improvement, right? And even, even once, you know, we achieve the full promise of quantum computing. I mean, those are, you know, you know, I think it's going to be certain specific industries where we're mostly going to see the effect. Okay, so that's, that's, I think, the first thing for people to understand and that really differentiates this from AI, for example, right? With, I like to say that the difference is with AI,

• 14:38Speaker 00

  you don't have to, you know,

• 14:41Speaker 00

  beat what, anything that humans can do. It is enough to achieve parity with a mediocre human.

• 14:50Speaker 00

  And that already changes the world. With quantum computing, you really have to beat classical computing. All right, and it's a miracle that that ever happens. But you know, it's mostly for certain specific problems where it does. Okay, so that, that, you know, the, the, the, the types of problems where quantum computers can help or not help, you know, that we can, we can discuss in as much detail as you like. All right, because you know, we, in some sense, we know a great deal about that. And the timeline, how long this is going to take, that we know less about. Or rather, you know, if I did know a lot about that, then I wouldn't be a professor. I would be an investor.

• 15:33Speaker 00

  So all I can do is just sort of, you know, look at scatter plots, you know, look at, you know, what, what promises were made over the last 20 years by, you know, the various quantum computing efforts and, and how, how on track are they in delivering on those promises? And, you know, if you, if you look at that, what you see is that, well, it seems like we have come an incredible distance since where we were when I entered this field in the, you know, in the late 1990s. It's, it's been more than 20 years now, right?

• 16:10Speaker 00

  But, you know, in the, in the 90s, it would have been amazing to get just two qubits to talk to each other with, say, 50% fidelity, you know, 50% accuracy, right? And then, you know, we knew that, okay, if you could get that really, really close to one, like to, you know, 99.999% or something like that, then quantum error correction starts to kick in and, and then you can push the effective error all the way down to zero. But, you know, that just seemed like, like so far off from where people were. Okay, but, you know, over 25 years, what happened was that that 50% fidelity became 90%, became 99%.

• 16:52Speaker 00

  And now in, you know, the, the latest systems such as, you know, those of Google or Quantinuum or Quark. You know, it's ninety nine point eight percent or ninety nine point nine percent. Okay, so it is a really, I would, you know, and in the meantime, the quantum error correction methods have also improved, right? So that they can cope with larger amounts of error. And so we are now at or very, very near the threshold where in principle, quantum error correction does become a net win as you scale up. Okay, so you know, that's not to downplay the sort of enormity of the engineering work that is that is ahead of people, right?

• 17:37Speaker 00

  But, but, uh, you know, if you just look at the, the, the, the, the error rates, right, as a function of time, you know, that looks pretty good. And it looks like if people wanted this badly enough and were willing to spend enough money, right? I certainly can't rule out that, you know, within the next decade, that they could, you know, get, get a useful quantum advantages. I mean, it's sort of like, you know, asking a nuclear physicist in the nineteen thirties, right, you know, how long until we're going to get a critical, right? And, and, you know, and like Niels Bohr, for example, was asked that question. And he said, well, it's not going to happen for, you know,

• 18:21Speaker 00

  in any foreseeable future because you would have to convert an entire country into a uranium enrichment factory, basically, right? It's just fanciful, right? And then, you know, apparently like in nineteen forty three, he toured the Manhattan Project and then he said, well, I see that that's what you've done.

• 18:42Speaker 00

  So, you know, at some point, it just, it becomes a question of, you know, how much is someone willing to spend, you know? How badly do they want this, right? And, and so, so, so the timeframes, you know, depend on all sorts of things that, you know, I, as a, as a theoretical computer scientist, you know, I'm not. Able to predict very well. But I would, I mean, we'll get into this shortly, but I would certainly say that people who have encrypted data, that they want to stay secret for the next decade. Yeah, if I were such a person, then I would probably already be looking to migrate to post quantum or quantum resistant methods of encryption.

• 19:27David Hoffman?

  I think that really helps us place ourselves in history as it relates to this quantum arc of development. We are somewhere in the inflection point of going from research and theory into practicality. And it's kind of just becoming a matter of time of willpower and expense. And Scott, I do kind of want to return back to something you were saying earlier about the differences between quantum computing and classical computing, because I think this is really the first big aha moment that I want listeners to really integrate into their brains. The metaphor that I've had to understand this for me personally, that I think worked very well, is trying to get people out of the idea that a quantum computer is not just a faster classical computer.

• 20:12Speaker 00

  Yes.

• 20:13David Hoffman?

  For example, there's an arc of automobiles that we can say. First, we had the Model T Ford. And now we have Ferraris and Toyotas that work very well, and they're very dependable. And that's a coherent directional arc of progress of that technology.

• 20:29Speaker 00

  I mean, the speed hasn't really increased all that much, certainly not exponentially.

• 20:33David Hoffman?

  Right, yes. But what we're not doing with quantum computing is we're just making a better classical computer. It's much more like something where we're actually making a boat, and we're going off into a different frontier that cars were not able to explore or navigate. Doesn't matter how good the engine you made and put it into a car, it's not going to help you on water. And what quantum computing is like, well, we're actually changing the shape of the frontier that we're navigating. We're going into a different uncharted land. And now we are able to explore a different field of mathematics, and there's different applications, there's different utility out there. That was a really helpful metaphor for me. Maybe you can extend that metaphor and run with that and help explain that a little bit.

• 21:15Speaker 00

  Like most metaphors, that one has, I would say, has both good and bad to it.

• 21:21David Hoffman?

  Right.

• 21:21Speaker 00

  I mean, we are, you know, a quantum computer would really harness nature to do computation in a fundamentally new way, right? It's the first device since Alan Turing, really, that that changes, you know, the basic rules of of of what is efficiently computable and what isn't, right? And it does that because it is exploiting the laws of quantum mechanics, right? So quantum mechanics famously says that that systems can be in what are called superposition states, right? So, you know, a quantum bit, what we call a qubit, can be in a superposition of the

• 22:04Speaker 00

  zero state and the one state, okay? Which means that, you know, you have some number, which is called an amplitude, which is attached to the possibility that the qubit is zero, and you have another amplitude that's attached to the possibility that the qubit is one, right? And so it's not definitely one or the other. Now, if you look at the qubit, if you measure it to ask, you know, which one it is, then you'll get a definite answer, right? It will tell you, you know, either that it's zero or that it's one. And the probability of each possible outcome will be related to the to the amplitude, okay? By a very famous rule in physics called the Born rule.

• 22:46Speaker 00

  This rule says you you take the square of the absolute value of the amplitude, okay, to get a probability, okay? But the key thing is that these amplitudes are not themselves just probabilities, right? What is a probability, right? It's a number from zero to one, right? It's a you could talk about a 30% chance of of rain, or of, you know, someone winning an election, but you'd never talk about a negative 30% chance, right? That would just be nonsense, okay? But amplitudes can be positive or negative. In fact, they can even be complex numbers. And so this is the key, right? This is the key thing that we learned about reality in 1926,

• 23:29Speaker 00

  that somehow, under the hood, nature is using these numbers that are closely related to probabilities, but they're not, because they're complex numbers, right? They're these amplitudes, okay? And so now, that's already interesting. If I talk about a single qubit, which could mean like an electron that could be in one of two locations, or that could be spinning either clockwise or counterclockwise about some axis, has some little degree of freedom. But it's even more interesting when I talk about multiple qubits, because the rules of quantum mechanics, which have been experimentally confirmed

• 24:14Speaker 00

  over and over, thousands of times for the last century, right? They are unequivocal that if I have, let's say, two qubits, now I need four amplitudes, okay? I need an amplitude for both qubits to be 0, so for the state 0, 0, and then I need an amplitude for the first qubit to be 0 and the second to be 1, for 0, 1, and then I need an amplitude for 1, 0, and an amplitude for 1, 1, okay? If I have three qubits, now I need eight amplitudes, right? One for every possible three-bit string, okay? If I have 100 qubits, 2 to the 100 power amplitudes, right? And if I have 1,000 qubits,

• 24:59Speaker 00

  now that's actually more amplitudes than could be written down in the entire observable universe. It's 2 to the 1,000 power, right? So in some sense, ever since we've known quantum mechanics, like we've known that nature, off to the side somewhere, is storing this vast scratch paper with this unbelievable number of parameters, just to keep track of the states of rather small numbers of particles, like a few hundreds or thousands, right? And every time something happens to those particles, nature has to cross off all of those numbers and replace them with new numbers. Okay, now, it's true that we never directly see those numbers, right?

• 25:42Speaker 00

  You never directly see an amplitude, okay? But we need them to calculate the probabilities of the various outcomes that we do see. Okay, so, uh, so this is, the, the, the, uh, this is the basic story, right? And, um, you know, so, so chemists and physicists have known about this for generations, this sort of exponentiality that is at the core of quantum mechanics, you know, because of this sort of explosion of amplitudes. Okay, they've known about it mostly as a practical problem, right? That if you're trying to, uh, simulate chemical reactions, or, you know, simulate, uh, materials on a, using a classical computer,

• 26:26Speaker 00

  you know, you have to solve what's called the Schrodinger equation, right? Which is the central equation of quantum mechanics, and which basically just tells you how the amplitudes are changing over time when a system is isolated, when your qubits are isolated from the outside world, like when no one is measuring them. Okay, and it just says that they change over time by a linear differential equation that, that preserves the property that the probabilities of all the different outcomes will always add up to one. That's all it says. And I just, you know, uh, maybe the most important equation in physics, right? Uh, and, uh, but, but, but the trouble, you know, and so, so in principle, we understand all that.

• 27:11Speaker 00

  It's even a very simple looking, uh, uh, linear differential equation. The trouble is just, you know, how many damn amplitudes there are, right? And so, so as soon as people started trying to simulate, you know, uh, uh, uh, let's say lots of entangled electrons, you know, on computers to calculate, you know, the, the properties of chemical reactions, they ran into that exponential explosion, right? And so a lot of what Chemists and physicists have been doing, you know, over the last, you know, you know, since the 50s and 60s has been, you know, inventing heuristics, you know,

• 27:52Speaker 00

  approximations, hacks, you know, that let them avoid that exponentiality in various special cases, you know, by being clever, right? But in the, in the early 1980s, you know, a few physicists, most famously Richard Feynman and David Deutsch, had this remarkable idea that if nature is giving us this computational lemon, like, why don't we try to make lemonade out of it? Right? So why don't we build a computer that would itself take advantage of that same exponentiality? Okay, they called that a quantum computer, you know, of course, it was just a thought experiment at the time. Okay, but they immediately faced the question,

• 28:35Speaker 00

  well, supposing that we built that device, what would it be good for? Right? And at the time, they really only knew one answer to that question, which was, it would be good for simulating quantum mechanics itself. Right? And, you know, I think more than 40 years later, the, you know, the truth is, that is still the economically most important application of quantum computers that we know about. Right? That, you know, you would, they would give you this general purpose, you know, way to, to cut through this sort of exponential, you know, explosion and amplitudes and thereby simulate, you know, whatever quantum

• 29:17Speaker 00

  material, whatever high temperature superconductor, or photovoltaic, or, or protein, you might care about, and, you know, possibly get a, you know, a much better simulation, a more accurate simulation in a shorter amount of time than a classical computer could give you. Okay? But that was not the discovery that really put quantum computing on most of the world's radar. Right? As long as it was just a device for simulating quantum mechanics, it was mostly just that this idea kicked around. By, you know, a few strange physicists and computer scientists, right?

• 29:57Speaker 00

  And what really captured people's attention was the discovery in the mid 1990s that a quantum computer could also achieve dramatic speed ups for at least a few purely classical problems, problems that have nothing to do with quantum mechanics, right? The most famous example there is the problem of finding the prime factors of a huge number. Okay, and some of your listeners may know this happens to be the problem that underlies the security of a large fraction of the encryption that currently protects the internet, particularly, you know, anything that's encrypted with RSA, right?

• 30:39Speaker 00

  It depends on the belief that factoring is a hard problem. And in 1994, Peter Schorr showed that if you could build a large quantum computer, then there would be a fast method for factoring large numbers. Okay, you could factor an N-digit number using a number of steps that would scale only roughly like N squared. Okay, whereas the best classical method takes a number of steps that grows exponentially with N, actually with the cube root of N. So that was an exponential speed up over the best known classical algorithm. Okay, and variants of that, as it turns out, could break most of the other public key encryption that we also use to protect the internet, okay?

• 31:23Speaker 00

  Including Diffie-Hellman, okay? Which is based on a problem called discrete logarithms and even elliptic curve encryption. Okay, that would all be broken by quantum computers. Okay, and so then that really got people's attention. Okay, but unfortunately, what happened like 30 years ago was that like a certain narrative took hold, you know, about what, how a quantum computer would do all of this. That's been really, really hard to dislodge, you know, even though I've been trying for 20 years on my blog, right? And the narrative basically says, well, the way that a quantum computer would Do this is it would just try every possible divisor of your number in parallel.

• 32:07Speaker 00

  Right. It would try everything in superposition and it would basically just be like a massively parallel, exponentially parallel classical computer, right? And you know, that I think that caught on because it sounded really good. You know, anyone could understand why that would be useful, right? And you know, it even had some relationship to something true. Okay, but unfortunately, that's not how it works. Right. It is, it's false in a very important way. Right. And so now I think we can really get to the heart of, you know, how a quantum computer is different from a classical one. Right. So it's true that with a quantum computer,

• 32:48Speaker 00

  you can create an equal superposition over every possible solution to your problem, even if there are exponentially many of them. Uh, you know, that's even an easy thing to do with a, with a quantum computer. The trouble is that for a computer to be useful, you know, at some point you have to look. You have to measure, you have to get an output. Okay. And if you just did that, you know, to an equal superposition, not having done anything else, then the rules of quantum mechanics, you know, this, this born rule are very clear that all you're going to see will be a random answer. Right. And if you just wanted a random answer, you could have just flipped a coin a bunch of times. You know, you could have just picked one yourself.

• 33:31Speaker 00

  You could have saved yourself all the billions of dollars of, you know, building this quantum computer, right? So really the only hope of getting an advantage from a classical computer, you know, compared to just a classical computer with a random number generator. Right. Is to exploit the way that these amplitudes being complex numbers work differently from conventional probabilities.

• 33:57Speaker 00

  Right? And with every algorithm for a quantum computer, you know, including the famous Shor's factoring algorithm, okay, the the trick is that you're trying to choreograph a pattern of interference in such a way that for each wrong answer, so like each number that's not a prime factor of of your number, like some of the contributions to its amplitude are positive and others are negative, so that on the whole, they cancel each other out. Whereas for the right answer, you know, you want all the contributions to its amplitude to be pointing in the same way, so that they reinforce, so that they add up, right?

• 34:38Speaker 00

  And if you can arrange that, then when you measure your qubits, you're going to see the the answer you want, like in in the case of Shor's algorithm, the prime factors of your number with a high probability. And, you know, if you don't see it, you can always just repeat the quantum computation several times, you know, and until you do. Okay, but the whole game is to use this interference between positive and negative amplitudes to try to boost the probability of seeing the right answer, you know, to higher than you could get with a classical computer. Now, it's very tricky. It's like nature is

• 35:20Speaker 00

  giving you this really bizarre new new hammer, right? It's not obvious a priori that there's any useful nails that that hammer can hit, you know, other than just simulating quantum mechanics itself, right? That's why it took Peter, it took people like Peter Shor to figure this out, right? It wasn't obvious, okay, because you have to arrange all this interference, even though you yourself don't know in advance which answer is the right one, you know, if you already knew what would be the point, right? And you have to do all of this faster than the fastest classical method, right? Or else, you know, again, why not just use a classical computer instead? Okay, so so this is the game with with quantum

• 36:02Speaker 00

  computing. And this is why, you know, the the applications of a quantum computer have been more specialized than that than some people would like, right? It's to go back to your boat analogy, right? It's okay, in some sense, anything that a classical computer can do, you know, a quantum computer can also do. Right, so maybe it's less like a boat than an amphibious vehicle or something, right? It can, you know, but it just for most of what we do with classical computers, there's no point to using a quantum computer because it's not any better. Right? It's only better to the extent that you can take advantage of this interference phenomenon

• 36:47Speaker 00

  to concentrate more amplitude on the answer you want faster than a classical algorithm could do the same thing. So in the case of factoring and discrete log and elliptic curve problems, the problems that underlie much of modern cryptography, right? The way that Shor's algorithm was able to solve those problems was by exploiting like very special algebraic structure in those problems. In particular, all of these problems sort of have involve an underlying mathematical structure that is called an abelian group. They all involve some sort of multiplication operation, right?

• 37:30Speaker 00

  Where the multiplication is commutative, you know, X times Y equals Y times X. Okay? And abelian groups are very amenable to an operation that is called the Fourier transform, right? Where you can sort of make an equal superposition over all the different elements of your group. You can then, you know, compute a function of those elements and then you can learn some secret about that function. Like in the case of Shor's algorithm, you have a function that is secretly a periodic function. So like it's a function of integers that repeats itself with a certain period. And actually, you know, the heart of Shor's algorithm, it actually has nothing to do

• 38:14Speaker 00

  with factoring, right? Factoring is just a byproduct, right? The heart of Shor's algorithm is really about how do you find the period of a periodic function, right? And it gives you an exponential speed up for that problem. Okay? And then Shor then separately, you know, observed that if you could find periods quickly, then that Would give you a way to factor, right? And, and so, so period finding, he does using this quantum Fourier transform, it's called, which is an operation that acts on this, this superposition involving this, these exponentially many amplitudes, you know, for, for a different possible configurations of your qubits.

• 38:58Speaker 00

  And that sort of takes, it starts with a superposition that sort of encodes your periodic function. And it transforms it into a superposition, a different superposition that encodes information about the period of, of, of the function, assuming that the function is periodic. Right? And, you know, this is sort of what the, the Fourier transform was designed for, you know, hundreds of years ago, for sort of mapping, you know, what we would call, you know, from the time domain to the frequency domain, or mapping from, you know, a basis of just what are the different values of this function to a basis of what are the

• 39:39Speaker 00

  different periodic components that have been summed to, to create this function. Right? And so, so, so that is where the quantum interference is happening in the computation of that Fourier transform. And, you know, there's, I wish that there were a simpler answer than that, you know, as to like, like, what is it about factoring that, that enables, you know, it to be solved quickly with a quantum computer, right? But, but I think, you know, ultimately, the answer is factoring is connected to period finding. Period finding is connected to the Fourier transform. The Fourier transform is a thing that quantum computers are really good at.

• 40:18David Hoffman?

  Scott, I, maybe I can ask perhaps our last fun dumb question before we hand things off to Justin Drake here.

• 40:25Speaker 00

  These are not dumb questions.

• 40:26David Hoffman?

  Oh, good, good. I'm glad, I'm glad. And the simple question is, why do the quantum computers, the pictures of the quantum computers that I've seen, why do they look so weird? Like, why, like, I'm used to chips that are these like very small, flat, square, you know, metal things with some, that fit into like my motherboard. And that is not What I am looking at right here. So what's the deal with this?

• 40:48Ryan Sean Adams?

  Yeah. Can you describe for people just listening to this, David, what we're looking at here? This is like a quantum computer image.

• 40:54David Hoffman?

  I mean, if I wanted, if I was in charge of making a sci fi movie in the seventies or eighties about some like ray gun thing that was on some spaceship. And I wanted to make it look as crazy and futuristic as possible. I would make something like a quantum computer machine.

• 41:10Ryan Sean Adams?

  It doesn't look real.

• 41:11David Hoffman?

  It is, it looks so incredibly complex that you don't even question like what, you wouldn't even question it, what it does if you saw this in a movie.

• 41:19Speaker 00

  Yeah. So I think that the key to answering your question is to just remember what classical computers looked like in the fifties. Right. They also looked really like intimidating and science fictional, right?

• 41:33Speaker 00

  You know, of course, you know, you know, they, they would be much less powerful than, than, than anyone's iPhone is today. Right. Uh, but you know, uh, because people were just learning how to build these things, right? But you know, they didn't have all the components just like etched to one little microscopic chip, right? That, you know, it was all out there to be looked at. And I think that's the reason for the science fictiony appearance.

• 42:02Speaker 00

  So, so in those pictures, uh, so, you know, I should, I should caution that I am not an experimentalist. You know, I do, uh, you know, get taken on lab tours, you know, and talk to my experimental colleagues. But, you know, they make me promise up and down not to touch anything. So. But again, in a lot of these pictures, what you're seeing is basically just a dilution refrigerator. Right. So most of that fancy stuff, you know, all it's for is for cooling down your chip. So, you know, now it has to be cooled down very cold to, uh, you know, in, in, uh, with superconducting qubits. They typically cool them to about 10 milli Kelvin, which is like a hundredth of a degree above absolute zero.

• 42:48Speaker 00

  And, and the reason for that is that, you know, it's only at such low temperatures that you really see your, your degrees of free. And behaving as qubits, you know, staying isolated from their environment, not getting measured by their environment, you know, and be being able to persist for a long time. And by a long time, we might mean like 50 microseconds or something like that. So, you know, not long by by human standards, but you know, uh, long enough to do something interesting with them. Right? We uh, we need them to sort of stay in these in these uh, superposition states uh, without uh, the, the, the environment getting in the way. Okay. So, so basically when, when you're looking at those fancy images,

• 43:33Speaker 00

  you know, uh, in, in many of the cases, a lot of what you're looking at is just a refrigerator. Okay. And the, the, the actual chip itself, you know, just looks like a pretty standard computer chip, right? That's where, that's where the qubits are in a, in a superconducting device. Okay. But uh, the reason why those dilution refrigerators, they look kind of like upside down wedding cakes. I've heard them described as, right? It's because like each layer is cooling to a lower temperature than the layer above it. So like you have one layer that's cooling to a few Kelvin and then maybe, you know, the next layer is cooling to, you know, I don't know, you know, a few hundred milli Kelvin, right? And then, you know, you get all the way down to the temperature that you want.

• 44:18Speaker 00

  Let's say that's 10 milli Kelvin and that might just be in, in something that's the size of my fist. And that's where you put the chip. Okay. And, and the chip is where, where the actual qubits are. So that, that's where the, you know, the real action is happening. And then the other thing that you see is a lot of wires, right? Because, you know, we, we need, at the end of the day, we need to tell these qubits what to do, right? And uh, like, like what operations should they do, you know, to uh, uh, uh, affect their amplitudes to create this interference pattern that we want. And all of that control is being done by classical computers. Right? So, so you have, you know, lots of just conventional classical computing hardware, you know, you've got

• 45:01Speaker 00

  uh, you know, often some grad students or postdocs just. Sitting at, you know, a Linux box or, or a Mac or whatever. And, you know, they're just writing code that is going to control a microcontroller that is going to send commands into the dilution refrigerator, into the chip, to tell the qubits what to do. So all that classical electronics, uh, uh, uh, that's the other thing you're seeing there. Now, if we were talking about a different kinds of quantum computing hardware, like trapped ion or neutral atom, uh, then, or, or, or photonic qubits, uh, then, then you'd be looking at different things, right? But, you know, in, in, in some sense, like, the pictures are, are, are fun to look at,

• 45:46Speaker 00

  right? But like, all the real action is happening in this space that we never directly see. This, this, uh, what we call Hilbert space, right? The sort of abstract space of possible quantum states, you know, described by these different amplitudes, right? And so, you know, when I, when I visit labs and I talk to the experimentalists, it's like, you know, we have those cool looking pick things that you showed as like a very cool backdrop, but then we just end up, you know, usually on a whiteboard, just talking about quantum states.

• 46:18Ryan Sean Adams?

  It's so wild and cool and exciting that these upside down wedding cake refrigerators, uh, allow us to tap into nature's a scratch pad. And a lot of what you said, uh, was like, uh, just so fascinating to me. And it shows there's so much to learn here. At this point in the conversation, I think we're done with, uh, the David and Ryan questions. We want to introduce, uh, Justin Drake, maybe, and I think a lot of people at this point in the conversation, we have the foundation for what quantum computers are, what they can do. Now we want to know how they affect our cryptography, because the basis of this entire cryptocurrency industry that we've birthed is part, part economics and a lot cryptography. And so if we're saying quantum computers kind of break RSA, break some of the underlying assumptions,

• 47:02Ryan Sean Adams?

  we need to know how many of those refrigerators it takes and by when, uh, like, and, and like, at what point in time are, are Bitcoin, four million Bitcoin that aren't quantum secure could be like quote unquote hacked. Anyway, let me introduce a Justin into the conversation. And Justin, I don't know what you want to do, but feel free to take the reins on the rest of this conversation and get into those topics with Scott.

• 47:25Speaker 03

  Absolutely. So Scott, it sounds like, you know, everything's going to plan. We've had these theoretical predictions that are coming true with the engineering. And quite famously, a couple of months ago, you wrote this statement in one of your blog posts saying that you expect that within the next 10 years, we should have a useful, full tolerant quantum computer, or we will learn something fundamentally new, maybe something fundamental about how physics works.

• 47:56Speaker 00

  I should clarify that by useful, that doesn't necessarily mean, you know, hacking Bitcoin or, you know, breaking RSA, right? You know, I think, I think before we see that, we're going to see quantum simulations that can tell us interesting new things about nature. Right? Like that, I'll be, I'll be very disappointed if we don't at least see that within the next decade. And the breaking RSA part, I don't know. I don't know how long it will take.

• 48:23Speaker 03

  So this morning, very coincidentally, I bumped into Steve Briely, who is the founder of Riverlane. It's a quantum computing company in Cambridge. They do quantum error correction. And he told me that he believes it will cost $10 billion in R and D to break ECDSA. Does that sound reasonable to you?

• 48:45Speaker 00

  It's, it sounds like about as good of a guess as anyone's, you know? He would, he would probably know more than me. Yeah, I mean, I mean, the amount, you know, I was just at a conference called, you know, Q2B, Quantum to Business in December. And I heard an estimate there that there's about like $40 billion per year globally being spent on quantum information research, research and development. Now, you know, a lot of that probably depends on exactly how you define it, right? Because there's, there's a lot of people, you know, who, you know, have, have, you know, things that, that they would have done anyway,

• 49:25Speaker 00

  but that, you know, that they've sort of redefined as being quantum information because, because it sounds cool. But, um, you know, the, the expenditures are reaching. The billions of dollars, I would say, you know, already like a decade ago, they passed the point where sort of academic labs, you know, could mostly hope to compete, you know, on pure scaling, right? Like a professor at a university, you know, might be able to raise a few million dollars, right? They can't raise hundreds of millions of dollars. And, you know, and, and, and I think a few hundred million dollars, you know, is, is, is, is at this point is table stakes

• 50:04Speaker 00

  for, you know, just having a state of the art experiment, uh, you know, like the kinds that, that Google or IBM or, uh, or Amazon, or, um, you know, the various startups like Quantum, um, Quora or, or, um, and now when you talk about scaling up, you know, to break, uh, ECDSA or other cryptographic standards, right? So, so, uh, you know, you're talking about like a few thousand logical qubits, right? Just, you know, to do your, your, you know, run whatever version of Shor's algorithm you need to run. But now each logical qubit needs to be encoded using a quantum error correcting code,

• 50:49Speaker 00

  right? And, and, and that itself might take hundreds or thousands of physical qubits. So you get like a thousands times thousands, basically. And so now you're talking about millions, maybe even hundreds of millions of physical qubits. Okay. And so, so these estimates, you know, were, were first done, I think by Austin Fowler and others, you know, around 2008, you know, and they look pretty scary. It depends on how you look at it, right? It's again, you know, you like, think of the estimates in the 1930s of like, what is the critical mass for, you know, uh, uh, a nuclear weapon if you use U235, right? Like on the one hand, it's very scary. On the other hand, it says, oh, if we merely did this, then we would have that.

• 51:35Speaker 00

  If, let's say for simplicity, we talk about superconducting qubits, right? So, so, so each chip, you know, I think can store up to, you know, you know, a few hundred, maybe a few thousand qubits. Okay. And now if I need millions of qubits, now I'm talking about hundreds or thousands of chips. Right. And the trouble is each of these dilution refrigerators, right, only cools, you know, a pretty small volume. And so, so now if I need lots and lots of superconducting chips, now I'm talking about lots and lots of dilution refrigerators, right, whose chips all need to be connected to each other, you know, have to be connected by sort of a, a, a quantum communications network.

• 52:20Speaker 00

  And so now I'm envisioning potentially like filling a building, basically, with dilution fridges, right? Having, having this whole quantum network between them. Okay. This sort of thing has never been demonstrated, hasn't been demonstrated yet. But, you know, that is, if you wanted to build a scalable device using superconducting qubits, then it looks like that is where things would need to go.

• 52:47Speaker 03

  In the interest of time, can I ask you some rapid fire questions?

• 52:52Speaker 00

  All right.

• 52:53Speaker 03

  So I guess one of them that I'm curious about is when we do have a quantum computer that can break cryptography, is it going to break a very specific flavor of cryptography, such as RSA or specifically BLS signatures or ECDSA? Or is it going to be a general purpose quantum computer that can be reprogrammed to break all of, all of the elliptic curve based cryptography?

• 53:19Speaker 00

  I mean, once you have a quantum computer at all that is able to break, let's say, elliptic curve cryptography, I would strongly expect that to be a programmable device that you could then reprogram to break RSA, to break Diffie-Hellman, for example, you know, with, with, you know, all sorts of caveats, depending on exactly what is the key size, exactly, you know, how many qubits, you know, do you have? Have and do you need for for each one of these codes, but I would expect it at that point to be a fully programmable device. Okay, but it's very important to say that, you know, there are other cryptographic codes that we just let's most famously the

• 54:01Speaker 00

  ones based on lattices, for example, or just symmetric key cryptography, you know, things like DES or AES that we don't know how to break efficiently, even using a quantum computer, where even having a quantum computer would only make a modest difference. Okay, so that's, that's, that's a really crucial point, right? But for those codes that are breakable by a quantum computer, like, you know, the ones based on a billion group problems. So, you know, RSA, Diffie-Hellman, elliptic curve crypto, I would expect that that that that once you can break one of them, then within very short order, you can break the others also.

• 54:45Speaker 03

  Okay, understood. Another question I have is, once we have these computers, how much time will it take to break one key? And the reason is that on Ethereum, we have a million validators. And so if it takes one day to break one validator, it would take a million days to break all of them. And the similar situation with Bitcoin and Ethereum accounts, there's, there's millions of them.

• 55:05Speaker 00

  Yes. Yeah. So, like I said, the sort of initial estimates for, you know, what it would take to run a fault tolerant quantum computation to break, you know, RSA or Diffie-Hellman are, you know, at sort of, at interesting key sizes, you know, are pretty scary looking, right? You know, they involve many millions of physical qubits, you know, possibly hundreds or thousands of dilution refrigerators. And, you know, the estimates that I've seen would be like to break a 2048 bit key, you might be running your quantum computer for a week. Okay, you know, this is for a single key. This, of course, you know, could could improve in the future, right?

• 55:50Speaker 00

  So you could imagine, you know, the NSA sort of building this to sort of use for very, very high value targets, right? But you know, you could you could easily imagine that there will be, you know, some interval in time when, you know, this exists, you know, it can be used, you know, if if someone really, really cares enough to break one specific key. But, you know, even then, people might, you know, be able to go on using RSA because just, you know, the breaking is very, very expensive. Uh, you know, or at least it would depend who those people are, right? You know, uh, anyone needing military level security, uh, uh, uh, they should, they should definitely at that point be switching to lattice cryptography.

• 56:34Speaker 00

  But, you know, maybe for a casual user, you know, RSA would would still, you know, would still be safe enough. Uh, but, you know, you, you know, like with most things in computing, you know, you would expect the cost to come down over time. But now, you know, we specifically with with with cryptocurrency, you know, I think it's important for people to understand that like there are, there are two main places where cryptocurrencies are relying on cryptography, right? One of them is for digital signatures. And the digital signatures right now, you know, in both Bitcoin and Ethereum, uh, as

• 57:12Speaker 00

  I understand it, are are are based on, you know, elliptic curve or or other, uh, uh, uh, public key, you know, cryptographic codes that are quantumly breakable. So if you had a quantum computer and if it was fast enough, uh, then you could sort of, you could forge signatures and in that way you could steal people's, uh, uh, crypto. But it would, it would have to be quite fast. And it's possible that even after you have a, a, uh, the first, you know, really large fault tolerant quantum computers, they won't immediately be fast enough to, to, to actually, uh, break the Signatures in, in, you know, as quickly as you would need.

• 57:58Speaker 00

  So, so, so, you know, so, so, so maybe you have a grace period, right? Maybe you have an interval where you, you, you, you can actually still use these signature schemes. But, you know, the, the, the, the, the other important thing to say there is that we already know us alternative signature schemes that plausibly resist quantum attack. Right? So as, as you know very well, you know, people in the crypto community have already been talking about, should we migrate to these alternative signature schemes? You know, that, that's a, a, a, a, could be, you know, a hard logistical or engineering problem. But, you know, Ethereum already demonstrated that it could do this merge.

• 58:43Speaker 00

  You know, that it could actually change the, you know, underlying basis of, of, of how Ethereum worked. You know, while it was still in use, right? And so, you know, maybe, you know, Ethereum has the capacity to do such things, you know? With, with, with Bitcoin, maybe that's harder, right? But that's, that's the, that's the signature schemes. I like to, to a theorist like me, like, you know, it's all a solvable problem. Right? Because, you know, we know, you know, what, what signature schemes you could use that are plausibly quantum secure, you know? But it's, you know, it is a big headache to, to upgrade that. Right? And then there's a second big place where cryptography of some kind is used in, in cryptocurrency.

• 59:26Speaker 00

  And this is for a proof of work, right? Well, which Ethereum is, is no longer based on, but which, which, which Bitcoin and many other cryptocurrencies still are, right? And so the proof of work is basically, you know, involves a hash function, right? Where you have to find preimages of, of some hash function in order to, to, to mine a new cryptocurrency. And for this type of problem, these problems generally don't have that abelian group structure that I was talking about before. And we don't know, even with a quantum computer,

• 1:00:07Speaker 00

  how to get exponential advantages for these sort of mining problems, these problems of inverting this hash function in order to generate a new cryptocurrency. Okay, for those types of tasks, what we know with a quantum computer is how to get a more modest advantage using a different quantum algorithm, which is called Grover's algorithm. Right, and Grover's algorithm, you know, compared to Shor's algorithm, has a much, much wider range of application. Right, like it really does apply to just about any problem that involves, you know, searching a giant list of possible solutions.

• 1:00:49Speaker 00

  Right, it doesn't require any abelian group structure or, you know, fancy periodicity or anything like that. Okay, but the disadvantage is that Grover's algorithm gives you only a much more modest speedup. Okay, it's not an exponential speedup. It can basically solve just about any search problem in roughly the square root of the number of steps that a classical computer would need. Okay, and so that's clearly something. But, you know, the square root of an exponential is still an exponential. Right, like the square root of 2 to the 1,000 power is 2 to the 500 power, for example.

• 1:01:32Speaker 00

  Right, and now the trouble is, you know, if you're going to be running a quantum computer with all this error correction, right, that induces an enormous overhead. You know, like optimistically, let's say, a factor of a billion compared to just, you know, if you didn't need error correction. Right, and so now, you know, you're not, let's say, you have a problem with N possible solutions, like you're trying to mine some new crypto and you have a hash function with, you know, N possible preimages. Okay, so then, you know, the best case would be that our quantum computer, using Grover's algorithm, reduces N to square root of N. Right, but really,

• 1:02:17Speaker 00

  because of the error correction, let's say we're replacing N by a million times square root of N. Right, and so now we have to worry about that constant prefactor. And, you know, eventually... The quantum computer becomes a net win, but only when a million times square root of N is less than N. All right, so when does that happen? That happens when N is a trillion. So basically, for mining problems, you know, you could eventually see an advantage with Grover's algorithm, but you know, it might not be for a while. Even after you can build a fully fault-tolerant quantum computer, you know, it still might not be a win for mining cryptocurrency,

• 1:02:58Speaker 00

  you know, until things get a lot better than they are, right? Whereas for Shor's factoring algorithm, because the advantage is exponential, there you would much, much more quickly see the win.

• 1:03:14Ryan Sean Adams?

  Okay, so I feel the need for a little brain to hop into this big brain conversation really quick. Justin, from a crypto perspective, would you be able to summarize kind of what will break? So Scott is painting a world, a future world, not immediate, where we might have sophisticated enough quantum computers to break some things in crypto. But I guess from a practical perspective, what breaks within Bitcoin? What breaks within Ethereum? How would users feel this? If like suddenly tomorrow, we have such a quantum computer?

• 1:03:46Speaker 03

  Yeah, so I think what Scott alluded to, that there's different layers to the blockchains. There's the application layer and the consensus layer. Within the application layer, one of the most worrisome things is that the accounts that hold the balances could get cracked, meaning that from the public key, you can derive a private key to forge messages, forge signatures, and therefore steal money.

• 1:04:12Ryan Sean Adams?

  So that means if there was an account, Ethereum account with, say, $100 million in it, right? And you would assume an attacker, a quantum computer attacker, would prioritize the big value accounts. They're not gonna come steal my $5 worth of ETH in some Metamask private key that I have. They're gonna go for the big ones. And that could theoretically be done right now on Ethereum? Also, on Bitcoin?

• 1:04:36Speaker 03

  Yeah, so both Bitcoin and Ethereum use the same cryptography. It's called ECDSA. And the reason why I ask this questions of time it takes to break a key is, as you said, an attacker would presumably attack the bigger fish before the smaller fish. And I asked the same question, it's interesting, to my friend Steve from Riverlane. And he said in his estimate it would take a few seconds. So it looks like the experts really can't agree on even the order of magnitude.

• 1:05:03Speaker 00

  Well, it depends enormously on what architecture we're assuming, right? Is it trapped ions? Is it superconducting qubits? Right, you know, superconducting qubits would be like, you know, the gate times would be a thousand times faster. So yeah, so you can get wildly different estimates depending on, you know, what numbers you plug in.

• 1:05:27Speaker 03

  I see, that makes sense.

• 1:05:28Ryan Sean Adams?

  This almost feels, Justin, sort of like the AI conversation of how fast takeoff is towards AGI, right? It's like, just like, we don't know all of the intricacies, not to open up another can of worms, Scott, I know you're in that field as well. But, but Justin, it seems like a really big deal if accounts can be hacked on Bitcoin and Ethereum. That's like existential level stuff. And I know Scott was also talking about proof of work, which could be susceptible to some of this too. But maybe let's take the big thing, which is accounts getting hacked. I mean, that kind of destroys both Bitcoin and Ethereum. Again, if we had one of these quantum computers overnight, what's kind of your reaction to that? And like, are we all doomed? Because that was, you know, basically the genesis conversation when I talked about

• 1:06:12Ryan Sean Adams?

  the Google CEO of rolling out Willow. There was a lot of conversation about, whoa, Bitcoin is doomed. You know, like unless it hard forks in some way, and because it's very difficult for Bitcoin to hard fork, you know, it could be susceptible to these types of attacks. So what's kind of the crypto community's reaction to this? Like, what do we do?

• 1:06:32Speaker 03

  I mean, I think Ethereum's reaction is that we use what's called account abstraction to allow for accounts that hold balances to define their own signature scheme, which could be post-quantum secure. So Ethereum today, without any hard forks, can support post-quantum signatures. It's more of a standards and adoption process that needs to happen through the wallet. One of the downsides of post-quantum signatures is that they tend to be roughly 10x larger than the pre-quantum signatures, and so you'd have to pay 10x more gas to get them through on-chain.

• 1:07:10Speaker 00

  Okay, that's a huge downside, though, right? And I get, how about Bitcoin as well?

• 1:07:16Speaker 03

  Yeah, so I guess one positive note for the signature size is that we can have Snarks aggregate the post-quantum signatures into a single proof, and that can be a very nice batching optimization. In the case of Bitcoin, unfortunately, there is no real solution. There is, there are some mitigations that you can take. So one of the big ones is that you don't expose your public key. So what you do instead is you expose the hash of the public key, so that an attacker, without the public key, can't find the private key and attack your system. And the idea is that you only reveal your public key for a small period of time, maybe just a few minutes, until your transaction gets included in the block.

• 1:08:00Speaker 03

  And if Scott is indeed right, that it takes a whole week to crack a single key, then any in-flight FMR key will actually be secure.

• 1:08:11Speaker 00

  As I said, that week could certainly come down, right? I mean, what is doable in a week in one year may indeed be doable in a few seconds in a future year.

• 1:08:22Speaker 03

  Yeah, absolutely. And so eventually, plausibly, Bitcoin will have to do some sort of a fork in order to protect itself. It'll have to introduce a new signature scheme. And, but then there, even if it does that, there is another problem, which is the lost coins. Satoshi has a million coins that haven't moved. And unfortunately, Satoshi's coins are vulnerable in the sense that it's using an old version of Bitcoin script, where the public key does go on-chain. And so anyone can go ahead and mine these coins. I have a bit of an optimistic take, which is that... Satoshi's 1 million Bitcoin is about $100 billion today. And if Bitcoin was to achieve parity with gold, it would be a trillion dollars.

• 1:09:07Speaker 03

  And it would basically be a hugely valuable societal bounty to basically push forward the development of quantum. And actually, my friend Steve this morning, totally unprompted, he basically asked me about Satoshi's coins because he's been thinking about potentially starting a company to do address that.

• 1:09:27Speaker 00

  I mean, whether it's a societal benefit or not would seem to depend entirely on who gets those coins.

• 1:09:32Ryan Sean Adams?

  Yeah, yeah, yeah, exactly.

• 1:09:33David Hoffman?

  Who do you think that might be, Scott? Like, who's the most likely party of people out there? Nation states, a tech company? Who do you think can get there first?

• 1:09:41Speaker 00

  I mean, you know, all we can say is like, who is, you know, ahead right now in the race to build scalable devices? And, you know, the companies, you know, it is mostly being led by private companies. You know, it's like for the past decade, you know, the ones that people mostly talk about are Google, IBM, doing superconducting qubits, a continuum, you know, maybe some others like IonQ, Rigetti, SciQuantum doing photonic qubits. Okay. And then, and then in China, we have less visibility into what is going on there.

• 1:10:24Speaker 00

  But the government is certainly much more heavily involved in China.

• 1:10:28Ryan Sean Adams?

  I just want to make sure I understand the state of Bitcoin. So from what you're saying, Justin, what you're saying, Scott, is basically with Bitcoin, there is an upgrade path. It would require a hard fork. We all know how difficult hard forks are in Bitcoin. But say Bitcoin could do some sort of a hard fork to implement, you know, quantum secure cryptography, then that could be done. And that would protect most of the value on Bitcoin, most of the Bitcoin in existence. But there is a subset of Bitcoin, the early Bitcoin, including Satoshi's 1 million, which is kind of locked in the Satoshi wallet and hasn't moved since the very early days. And but not inclusive of that. I saw some. Some other estimates that was between 1 and 4 million Bitcoin supply.

• 1:11:13Ryan Sean Adams?

  So as you said, if you kind of extrapolate that forward, we could be talking about hundreds of billions of dollars or trillions of dollars. And that cannot be upgraded. So even if you did this post-quantum cryptography upgrade for Bitcoin, you can't really upgrade that 1 to 4 million in Bitcoin supply. So that's kind of a problem. And I know the Bitcoin community has talked about this. And this is sort of the aftermath of what we saw early in December. What do you do? Do you burn the Bitcoin? Do you like do something else with it? Do you slash it in some way? And that, of course, is very much against Bitcoin religion and Bitcoin Eo Canon. And so what you're saying is this presents almost like a, not a bug bounty,

• 1:11:52Ryan Sean Adams?

  but a bounty for whoever builds a quantum computer like fastest to go snatch up that Bitcoin. What a weird world we live in. I can't believe that's the reality. Is what I said just like approximately true?

• 1:12:06Speaker 00

  I hadn't thought about it in those terms before. Like Satoshi's Bitcoins is like a pirate's booty to be, you know, snagged by whoever first builds a quantum computer. I guess if their ethical scruples allow for that.

• 1:12:20Ryan Sean Adams?

  Well, but they don't have to be ethical, to your point earlier, Scott. I mean, they could be nefarious actors. I mean,

• 1:12:25Speaker 00

  Well, yeah, that's exactly what I mean.

• 1:12:27Ryan Sean Adams?

  Honestly, it could be North Korea. We have, we have a lot of North Korean like base tax in crypto today. But that's a bug bounty incentive. And so Scott, when you're saying there's like 40 million a year being put into quantum computers.

• 1:12:40Speaker 00

  Billion.

• 1:12:41Ryan Sean Adams?

  Billion a year, excuse me. Yeah, right. This, this increases the economical value.

• 1:12:46Speaker 00

  I think that that's for all of quantum technology. But, you know, however, people define that. But yeah, I mean, there are lots of governments that have, you know, made significant investments, you know, the US, China, Singapore, Australia, you know, the UK, the EU. But, you know, I think the, you know, the, the, the leading efforts to scale this up are mostly private companies, at least as far as we know, in public. You know, mostly in the US and Canada, right? But, you know, of course, that could change.

• 1:13:23Ryan Sean Adams?

  Justin, let me get your perspective on Bitcoin. Do you think that this is existential for Bitcoin? Or like, I mean, observing the Bitcoin community for, you know, the decade or so that you've been doing this, what do you think actually happens here in this scenario?

• 1:13:36Speaker 03

  I basically see two scenarios. Scenario number one is that the Bitcoiners are very, very purist and don't want to touch the supply of Bitcoin because that impedes and violates the property rights of some people, including Satoshi. There is another direction, which is more subtle, which involves freezing the coins up until there is a point where the owners can provide a proof of knowledge of the initial seed, the seed phrase, that generated the public keys and the private keys.

• 1:14:18Speaker 03

  And so if you have an entity, for example Satoshi, that generated their addresses from a seed, then because the key derivation process uses hash functions, then you can actually use the seed as the new private key, the new secret.

• 1:14:38Speaker 00

  That's a very nice idea. I hadn't heard about that, nor did I even know about the use of hash functions at that stage of it, which is crucial to that idea.

• 1:14:48Speaker 03

  Yes, exactly. It's not my idea. It's one that's been around for a few years. But unfortunately Satoshi's coins specifically wouldn't apply. More likely than not, he'd just generate those randomly as opposed to from a seed because the 12-word seed standard that we have today postdates Satoshi's.

• 1:15:10Ryan Sean Adams?

  Oh, wow. So even in that case, even with your kind of like Plan B solution, that 1 million Satoshi coins would just likely be... So I wonder what happens, right? Does the Bitcoin community fork? Is there kind of Bitcoin quantum and then original Bitcoin? But again, this won't play out overnight, is what we found out for the big first part of the podcast with Scott. But at some point, this is coming. At some point, this is inevitable. And whether it's like 2030 or whether it's 2050, we just don't know. But I guess the clock is ticking. Is that what you would say, Justin?

• 1:15:46Speaker 03

  Yeah, and one of the very nice things is that not all of Satoshi's coins are in the same address. Satoshi's coins are scattered over many, many addresses that each have 50 Bitcoin, because that's the amount of Bitcoin that you would get when you used to mine a block in the early days of Bitcoin. And so if indeed-

• 1:16:03Ryan Sean Adams?

  There's many, many 50 Bitcoin bounties out there, not one lump sum.

• 1:16:08Speaker 03

  Exactly. And so you could think about it as quantum issuance that could extend the secure lifetime of Bitcoin, because we all know that Bitcoin has this security problem where issuance goes to zero. Well, now we have this new, fresh 50 Bitcoin per unit of time, where the unit of time is dictated by how fast these quantum computers can operate. And so if it takes, for example, one day to break one Satoshi address, that's maybe a totally reasonable thing, where you're just unlocking 50 Bitcoin per day, and that actually secures the Bitcoin blockchain for another few years.

• 1:16:42Ryan Sean Adams?

  Wait, wait, run that by me again. How does that secure the Bitcoin blockchain? So let's say it happens gradually. We see it on-chain. We're like, oh, you know, a quantum computer just took 50 Bitcoin in bounty, and then tomorrow we see the same thing. The next day, we see this. How does that secure Bitcoin?

• 1:16:59Speaker 03

  Yeah, so the way that Bitcoin is ultimately secured is people buying hardware and burning a lot of energy. And for them to do that, they need to get paid to pay for the hardware and electricity. And Bitcoin has a decaying issuance. And so unless the fees grow dramatically by two orders of magnitude, which I don't think will happen, then we need to have some sort of a solution for Bitcoin security. Now, these 50 Bitcoin is basically an incentive to go pay to buy hardware, in this case, quantum hardware, and to pay the electricity to power the quantum computer. And if we're talking 50 Bitcoin per day, then that will

• 1:17:43Speaker 03

  extend the secure lifetime of Bitcoin over a few more years.

• 1:17:48Ryan Sean Adams?

  Wow, that's wild. Okay, I mean, I guess that's the Bitcoin story. How about Ethereum? How is Ethereum positioned for this, Justin?

• 1:17:55Speaker 03

  Yeah, so actually, the Bitcoin story, as Scott alluded to, is not completely finished because proof of work is itself going to be more likely than not disrupted.

• 1:18:04Ryan Sean Adams?

  Let's talk about that then first. What happens with proof of work with Bitcoin?

• 1:18:07Speaker 00

  With the proof of work, like I said, eventually you can get an advantage from Grover's algorithm, right? And then that allows, if, let's say, there's only a few entities in the world that have scalable quantum computers, that allows those entities to mine a lot more Bitcoin than everyone else. Now, eventually, if you got to a world where just about everyone had access to a quantum computer, then it's kind of amusing what would happen, right? Which is that the proof of work just has its hardness just set automatically based on how much mining people have been able to do recently, right? And so all that would

• 1:18:47Speaker 00

  happen would be that pre-images would have to satisfy an ever more stringent condition, and so that basically the proof of work would automatically just be made harder to compensate for Grover's algorithm, and we would all just be back where we started.

• 1:19:04Speaker 03

  I mean, I have a slightly different take. I agree with you over the very long term, but the transition from classical to quantum might be very problematic. And the reason is that at no point in time do we want one single entity to have more than 50% of the hash rate.

• 1:19:20Speaker 00

  Right.

• 1:19:21Speaker 03

  And more likely than not, there will be a first mover. And even the second, third, fourth mover might have very big discrepancies relative to the best performer. And it might be a 10x delta in performance, or in energy efficiency, or even orders of magnitude difference. And so my expectation is that for several years, there will be one dominant actor, which, as Scott said, would likely be either the Chinese government Or, you know, a company like, like, like Google or, or Amazon. And that's kind of scary.

• 1:19:57Speaker 03

  And so the good news that, that Scott pointed out is that more likely than not, we're looking at Grover disrupting Bitcoin mining way after it breaking ECDSA.

• 1:20:09Ryan Sean Adams?

  Oh, I see.

• 1:20:11Speaker 03

  This is a longer term future, maybe on a 30 year time scale.

• 1:20:15Ryan Sean Adams?

  And Justin, could proof of work be fixed by implementing a sort of a quantum proof of work, quantum resistant proof of work algorithm? That would require another hard fork presumably and just like be a big social like upheaval in Bitcoin, but could that be happen?

• 1:20:30Speaker 03

  So unfortunately, I think the answer is no. I think Scott, do, do correct me, but.

• 1:20:36Speaker 00

  There, I mean, there, there are proof, proof of work tasks that would give you more quantum resistance, right? More resistance to, to Grover's algorithm. But, but the truth is that I get the point where you're talking about doing a fork, right? You could also just talk about, well, you know, once we get past this, this, this transition, then, uh, you know, you just, uh, you just, you just take the existing proof of work and you make it appropriately harder. All right.

• 1:21:05Speaker 00

  I mean, okay, I mean, I mean, I mean, there are, uh, I, I've seen in the literature, like proofs of work, uh, where a quantum computer would only give you like an N to the two thirds power advantage as opposed to a square root of an advantage. There's also a, a, a proof of space, you know, type of protocols, like, uh, uh, I know Bram Cohen, uh, like Chea, uh, has been very interested in those. And, and, and those would probably, uh, uh, see a, a little or no quantum advantage as far as I know. So, so you, you could consider, you know, forking to, to something like that, to proof of space.

• 1:21:47Speaker 00

  But, you know, any, any task that involves just, just pure searching through a whole bunch of preimages to a, to a hash function, like should be susceptible to a Grover speedup, right? If we changed to a different kind of task, like I want to find. Collisions, you know, I want to find two inputs to this hash function that map to the same output. Then I can find tasks of that sort where the advantage from a quantum computer is less than a square root, or it's only, you know, N to the two thirds, or even, you know, N to the three quarters, or, or, or, or something smaller like that.

• 1:22:24David Hoffman?

  With over $1.5 billion in TVL, the METH protocol is home to METH, the fourth-largest ETH liquid staking token, offering one of the highest APRs among the top 10 LSTs. And now, CME takes things even further. This restaked version captures multiple yields across Kerak, Eigenlayer, Symbiotic, and many more, making CME the most efficient and most composable LRT solution on the market. Metamorphosis, Season 1 dropped $7.7 million in Cook rewards to METH holders. Season 2 is currently ongoing, allowing users to earn staking, restaking, and ABS yields, plus rewards in Cook, METH protocol's governance token, and more. Don't miss out on the opportunity to stake, restake, and shape the future of METH protocol with Cook. Participate today at meth.mantle.xyz.

• 1:23:07David Hoffman?

  Cello is transitioning from a mobile-first, EVM-compatible Layer 1 blockchain to a high-performance Ethereum Layer 2, built on OP stack with EigenDA and one-block finality, all happening soon with a hard fork. With over 600 million total transactions, 12 million weekly transactions, and 750,000 daily active users, Cello's meteoric rise would place it among one of the top Layer 2s, built for the real world and optimized for fast, low-cost, global payments. As the home of the stablecoins, Cello hosts 13 native stablecoins across seven different currencies, including native USDT on Opera MiniPay, and with over 4 million users in Africa alone. In November, stablecoin volumes hit $6.8 billion, made for seamless on-chain FX trading. Plus, users can pay gas with ERC20 tokens like USDT and USDC and send crypto to phone numbers in seconds.

• 1:23:52David Hoffman?

  But why should you care about Cello's transition to a Layer 2? Layer 2s unify Ethereum, L1s fragmented. By becoming a Layer 2, Cello leads the way for other EVM-compatible Layer 1s to follow. Follow Cello on X and witness the great Cello happening, where Cello cuts its inflation in half as it enters its Layer 2 era and continuing its environmental leadership.

• 1:24:10Speaker 03

  So I do want to highlight something very cool, which is that quantum might actually be the end game of Bitcoin, which sounds completely crazy. And the reason is that even though quantum might disrupt the consensus of Bitcoin, Bitcoin the blockchain, not BTC the asset. There's also this vision of quantum money where you don't even need consensus. Where basically you have money which acts like cash. Where, you know, I give you some, a piece of cash. Not, the whole world doesn't have to know about it. Only you and I have to know about it.

• 1:24:47Speaker 03

  And the way that it works is that the private keys are themselves quantum objects. They're a private superposition. And when you sign a message with your key, you're effectively destroying the private key and thereby not being able to double spend it.

• 1:25:10Speaker 00

  Yeah, so even more simply, right? There's one of the fundamental facts in quantum mechanics is called the no cloning theorem. Right, and as the name suggests, it says that, you know, there is no way to copy an unknown quantum state. Right, so if I have some qubits in a superposition state and I want to make new qubits that are in the same superposition state, I can't do it, right? You know, I can measure my old qubits, but measuring not only won't tell me everything I need, it will even destroy the one copy that I had. Right, and so, you know, one of the oldest ideas in the history of quantum information, going all the way back to the 60s,

• 1:25:56Speaker 00

  was the idea that you could use this no cloning theorem to create physically unclonable cash. Right, and this was an idea of Steven Wiesner. You know, he proposed a scheme that would do this with provable security, but it had the drawback that if you wanted to verify a bill is genuine, then you had to take it back to the bank that printed it. Right, so, you know, I mean, now, in around 2009,

• 1:26:30Speaker 00

  I sort of revived the interest in the subject of quantum money and I came up with some proposals for Schemes for quantum money that anyone could verify, right? Not just the bank. So what we called publicly verifiable quantum money. Now, some of my, my and others' original proposals were then broken. Okay, but now we have proposals for publicly verifiable quantum money that seem to be secure, you know, based on some, some barely, you know, accepted cryptographic assumptions, you know? We could, we could do a lot better, but, you know,

• 1:27:14Speaker 00

  based on things like indistinguishability, obfuscation. You know, if those exist, then we know that you can enter, you know, in a way that's secure against quantum computers, right? Then, then you can build this, this publicly verifiable quantum money. Now, the main drawback would be a technological one. In order to do what, what Justin and I were talking about, you would need, you know, not only would you need quantum computers, you would need quantum computers that can keep quantum states,

• 1:27:48Speaker 00

  preserve them for arbitrary amounts of time, like however long you needed this money for, right? So you would need to, to keep your quantum state, you know, maintaining its superposition, its coherence for weeks, months, you know, whatever, right? And, and, and with many of the schemes, you would also need the ability to send these states around, you know, like from the sender to the recipient, which would then require like a quantum communications network, you know, a quantum internet, right? So, but, you know, I mean, these are all things that you could imagine doing in some future. Now, your, your listeners might be amused to know

• 1:28:30Speaker 00

  that the first time that I heard about Bitcoin was in 2010 or so, 2011, when I was going around giving talks about my new ideas for publicly verifiable quantum money. And then people would come af, come, come up to me after. The talks and they would say, you know, there's this other way of getting, you know, a unclonable electronic cash. There's this Bitcoin thing. You should really look into it. Right. And so I did. And I said, oh, well, well, okay, of course, you could do it that way. But then, you know, you basically require, you know, this whole distributed process over

• 1:29:09Speaker 00

  the internet to be to serve as your trusted third party in a way. And you require this blockchain that's going to grow without bounds, right? As as the thing continues. So, you know, surely no one really wants that, right? And but, you know, but but fine, I'll have to mention this in my talks, that quantum money could someday be better than, right? And, you know, of course, it never once occurred to me to to say, you know, should I be buying up this Bitcoin? Should I be investing my life savings in it and holding it?

• 1:29:44Speaker 03

  So Ryan, to finish off your question about what to do about it and what the impact, I think we've covered Bitcoin. In the case of Ethereum, there's one thing that we do need to change as well, which is the consensus layer. So today, the cryptography that we use in the beacon chain is called BLS signatures. It's very powerful because you can aggregate the signatures, but unfortunately, it's not post quantum secure. And the good news is that we have knowledge of cryptography that can give us the same aggregation property and is post quantum secure. There's actually a paper from the Ethereum Foundation, researchers and collaborators

• 1:30:23Speaker 03

  that will be published in this month. And once we do the migration, then it's end of story. There's no more doubts about, you know, proof of work potentially leading to centralization. And so in some sense, proof of stake is much more secure against quantum computers than than proof of work is it's a final solution as opposed to one which which is much more uncertain.

• 1:30:52Ryan Sean Adams?

  Okay, so the overall story is there's a lot going on in Bitcoin with the advent of quantum compute, both on the ability to kind of like take funds from individual accounts and also in the proof of work algorithm. And so some major upgrades might be in store. However, at the end, there's a light at the end of this tunnel, which is like quantum money. That's a concept that could continue to be iterated and worked on.

• 1:31:19Speaker 00

  Even before that, just quantum resistant, you know, conventional cryptocurrencies are also a light at the end of the tunnel.

• 1:31:28Ryan Sean Adams?

  Right. So another light at the end of the tunnel. And for Ethereum, we have like a future hard fork that could be planned that is capable of being pulled off and that would make Ethereum effectively quantum secure. Just last question on this, Justin, are there any trade offs with deployment of using quantum resistant cryptography for Ethereum? Like, does the whole thing get slower? Are there any downsides to this?

• 1:31:53Speaker 03

  So the major trade off is that the signatures are about 10 times larger. So the consensus participants, they're casting attestations or votes. And in order to have as many attestors as possible, we want to have the messages be as small as possible. Now, right now, in the context of the Beam Chain, which is meant to be like this proposal to make Ethereum post quantum secure, we're de-risking the most risky part of the design, which is specifically the post quantum signatures and the fact that they are roughly 10 times larger. And one of the things that we're looking into right now is new ways to spread

• 1:32:33Speaker 03

  the bandwidth load in the peer to peer network. So we're going to be doing experiments with the library that we use called Lip P2P and basically slicing and dicing the peer to peer network slightly differently with a different architecture. But other than than than that fact, the verification costs, the signing costs, all of that is extremely good.

• 1:33:00Ryan Sean Adams?

  Justin, what's your personal take on how soon we need to do that for Ethereum? Given the estimates, I know it's like just like a moving target. No one really knows, you know, what would make you feel comfortable?

• 1:33:10Speaker 03

  So I think the quantum narrative is one which, you know, will age like fine wine over, you know, many, many years. I wouldn't say there is a specific rush. And actually, that's one of the reasons why, you know, it's better to do the beam chain properly so that we have a solution that will stand the test of time as opposed to rushing something. What I would like to see is on a five-year timescale, having post-quantum cryptography. Part of the reason is something that I learned very recently is that ECDSA is being deprecated by NIST. So I have some dates here.

• 1:33:55Speaker 03

  Let me see if I can find them. So in 2030, ECDSA will be deprecated and it will be disallowed in 2035. And so what I expect could happen as a consequence is that highly regulated institutions might just be disallowed from touching Ethereum if we don't do these upgrades ahead of time.

• 1:34:19Speaker 00

  Yeah, and NIST, you know, held a competition to, you know, agree on standards for post-quantum cryptography, which ran from about 2017 to 2022. And that converged around what's called lattice-based cryptography, you know, or learning with errors-based cryptography as sort of the main quantum-resistant alternative that is standing. And so NIST is, I think, already urging people to start this transition. And I recently learned that companies like Google are apparently already doing this. So this, the transition to post-quantum crypto is already happening to some extent.

• 1:35:00Ryan Sean Adams?

  This has been amazing, Scott, Justin. So it sounds like we are not doomed that cryptocurrency will be able to get out of this on the other side, that it will require some significant upgrades. And it's not happening anytime soon, massive quantum computers that can break our cryptography, but it could happen. And I guess we should be on the lookout for those Satoshi Bitcoin 50 at a time, starting to leave the accounts. If we start to see something like that, then maybe we sound the alarm. And Scott, if you would please sound the alarm as well, if you feel like this is approaching sooner, and the crypto industry needs to take some action, please come back and let us know.

• 1:35:38Speaker 00

  Okay, okay. I mean, look, I blog about these things when I'm asked. But I would say if you want to worry about something dooming the world, worry about AI. The threat to cryptography from quantum computers, that feels more like Y2K. It is a headache, but it is a survivable one.

• 1:35:57Ryan Sean Adams?

  That's fantastic context. We'll have to have you back on and ask you your P Doom and get into the AI safety. But that's not for this podcast. Scott Aaronson, thank you so much for joining us. Justin Drake, thank you so much for co-hosting. This has been tremendous.

• 1:36:10Speaker 00

  Yeah, thank you.

• 1:36:11Ryan Sean Adams?

  Bankless Nation, gotta let you know, of course crypto is risky. You could lose what you put in, particularly if your addresses are not quantum secure decades in the future. But we are headed west. This is the frontier. It's not for everyone, but we're glad you're with us on the bankless journey. Thanks a lot. Hey, Bankless Nation, this is a debrief. We thought we would include Justin Drake on this so he could synthesize from that episode because it was a lot. It was a lot. And Scott went deep in certain areas and came back. Anyway, let's start to synthesize some of this. So, Justin, what do we need to take away from just like the basics of quantum computers? Can you parse that for us?

• 1:36:46Speaker 03

  Yeah, so one basic concept is that there's two types of qubits. There's the physical qubits and the logical qubits. If we want to do digital computation that breaks cryptography, we need these more fancy logical qubits. But the building blocks, the bricks that make up the logical qubits are what's called physical qubits.

• 1:37:10Speaker 03

  And unfortunately, the physical qubits are extremely noisy. And so we need what's called error correction. So we need to take the noise, remove it so that we're left with pure signal, which is, you know, binary, digital signal. And I think the very beginning of our conversation basically was with this Willow breakthrough, where essentially we have for the first time a logical qubit, a logical qubit, one of them. So we're able to take 101 physical qubits, put them in a lattice, and basically we have this error correction happen. And that gives us this meta building block, which is the logical qubit.

• 1:37:53Speaker 03

  And then if we want to go actually break cryptography, we need to put thousands, tens of thousands, maybe hundreds of thousands of these logical qubits together to form what's called a scalable, fault tolerant quantum computer.

• 1:38:09Ryan Sean Adams?

  Okay, so I'm sort of getting the picture of, did you have, of course, you know this, you're an Ethereum researcher, but you know, things in Ethereum or crypto at large are just like basically research theory type phase. And then they become an engineering challenge. It feels like that's kind of what where we're at with with quantum computing, where we've been in this kind of research theory type phase. But now we've hit this threshold of, oh, now it's just an engineering and scale problem. And like, humans are really good at that. That's why Scott kept going back to like, I don't know when it's going to happen. It depends how much capital is there. And I'm just like, well, capital is easy. I mean, as soon as, as soon as there's something to scale, we know that capital will go and then we'll push the button, we'll scale that. So he was talking about 40 billion a year. I'm like, 40 billion? What's that?

• 1:38:53Ryan Sean Adams?

  I mean, like, you get nation states involved? Like, this could be hundreds of billions very easily, and now it's just a matter of scaling it. And you measure the scale with these these qubits, right? So like, right now, we're one, but you know, when we start to break cryptography, we're getting into the millions of qubits. And then that's when we can start breaking cryptography. Is that about right?

• 1:39:14Speaker 03

  Yeah, so millions of physical qubits and about two or so magnificat less of logical qubits, because it's roughly speaking, 100 physical qubits for one logical qubit.

• 1:39:25Ryan Sean Adams?

  Is there something like notion of Moore's law here? Like, can we apply like Moore's law to quantum computing? And if we're at one, maybe in a couple of years, we'll be at 10. And a couple of years after that, we'll be at 100. And then not too long after that, it'll be higher than we can count.

• 1:39:39Speaker 03

  Yes, there is an equivalent of Moore's law, and I think it's faster than Moore's law. I'd have to go look it up exactly.

• 1:39:45Ryan Sean Adams?

  Wow.

• 1:39:46Speaker 03

  But one of the reasons is that there's multiple layers of the stack that are improving in parallel. There's the physical qubits where the so-called fidelities or the error rates are improving. And then that has compounding effects with the way that we do the error correction. So we have these like new surface codes and all sorts of other like fancy mathematics that basically allows you to correct and detect the errors. And then there's also improvements at the algorithmic level. And to me, this is extremely reminiscent with Snarks. Snarks is a multi-decade journey that started thirty, forty years ago. And there's various layers of the stack.

• 1:40:31Speaker 03

  There's the proof system, there's the arithmeticization, there's the hardware that you use to prove that itself is growing with Moore's law. And then there's the algorithms that you use to do the FFTs and the MSMs. And all of these things compound with each other. And you know, my rough take is that Snarks improve by a factor of five every single year. So it's like Moore's law taken to the extreme. And I would imagine that quantum has a similar effect.

• 1:41:03Ryan Sean Adams?

  All right, so we're somewhere on an S curve, basically, a new S curve, a quantum compute type of S curve. And we're very early, but you know what S curves do, right? They're exponentials. Okay, so that's quantum, quantum computers. Let's talk about then, let's go over once again and parse everything we just talked about for Bitcoin. So quantum computer, let's say it happens overnight. So some government has a quantum computer that is in the millions of qubits. What happens to Bitcoin? What are the vulnerabilities?

• 1:41:34Speaker 03

  Right, so there's two classes of algorithms that affect cryptography. And Bitcoin got extremely unlucky because these are like two very, very narrow problems that quantum computers are good at, which is basically breaking elliptic curves and doing a search over a very large search space. And unfortunately Bitcoin has both the elliptic curves, in this case ECDSA to store all the balances, and it has the search, specifically the golden nonce search, right? Like you have these miners just spending tons of H2 just to find this one golden nonce that will create-

• 1:42:14Ryan Sean Adams?

  That's the proof of work part.

• 1:42:15Speaker 03

  That's the proof of work part. And so in some sense Bitcoin is like doubly-

• 1:42:22Ryan Sean Adams?

  Doubly screwed because it uses proof of work and then also like the accounts. I know they're not accounts in the Bitcoin world, but you basically get at the private keys as well because they're not quantum safe either.

• 1:42:33Speaker 03

  Yeah, correct.

• 1:42:34Ryan Sean Adams?

  The account balances, I should say, yeah.

• 1:42:36Speaker 03

  The good news is that Bitcoin will most likely have to tackle them sequentially. First ECDSA and then the proof of work question. For ECDSA, as we discussed, basically there's various possible outcomes. Outcome number one is that nothing changes and then the Bitcoin effectively become this bounty or issuance, if you want to think of it that way, to keep the chain growing and to incentivize proof of work.

• 1:43:07Ryan Sean Adams?

  And we're talking quantifying that, about one to four million or so supply of Bitcoin?

• 1:43:13Speaker 03

  So we know that we have the one million coins from Tatsushi. And we know that today, if we look at the balances where the public key is known, that's about four million coins, but of those, some of them are active in the sense that they can always migrate to an address that doesn't have the public key exposed. And so really what we're concerned about is the lost coins for which the owners have died, for example.

• 1:43:42Ryan Sean Adams?

  That stagnant coins where the coins won't simply just move when we learn that quantum computing is here.

• 1:43:49Speaker 03

  Correct. And so one possible outcome here is that the community says- We know that we have quantum computers, so we need to do something. And any coin that hasn't moved in 10 years, for example, is going to be just completely destroyed. And that's going to include Satoshi's coins.

• 1:44:07Ryan Sean Adams?

  Well, but what I find interesting about this, Justin, is that even that choice, what we're talking about right there, it's not just a tech choice, okay? It's a tech plus it's a social choice. Because you have to do, you have to do something different with property rights. It's no longer immutable property rights, right? I mean, correct me if I'm wrong, but there's no way to do this without doing something with that 1 to 4 million Bitcoin that is kind of like lost and kind of out there. Like, you have to have some policy that is like requires social consensus that was not in the original, like, you know, sayings of Satoshi in the white paper. You have to make that decision somehow. And so how does that kind of factor in?

• 1:44:51Speaker 03

  I think we need to see what the concrete data on the ground is. If indeed it takes a very long time to crack just a single key, if we're talking days or weeks, then actually I think we're fine. If, you know, my friend Steve is correct and, you know, we indeed can crack keys in a matter of seconds, then someone will just crack all of the keys and then just steal, you know, millions of Bitcoin in one go. And that would be the equivalent of the DAO hack, whereby a very large percentage of coins are, you know, in the hands of one single entity. And that jeopardizes, you know, it's an existential risk for Bitcoin. And, you know, what they could do as well is just roll back

• 1:45:34Speaker 03

  and basically freeze the coins that all moved at the same time.

• 1:45:38Ryan Sean Adams?

  How are they gonna do that, though? Everything that you know about these. So let's say, let's do a scenario here. Because you don't know, no one knows with the example of an attacker. And they're gonna attack the high-value Bitcoin, you know, like, addresses. They're not gonna do the 50 at a time type thing. They'll do the one with like thousands of Bitcoin in it first, obviously. So let's say you see that on chain. You have no idea. Someone sees that you, I guess, maybe you don't even know if it's a hack. It could just be an old address that has maybe moved, but you get that like you see that happening and you have no idea whether the attacker has the ability, has spent years to do that one address or has just done it in like a second.

• 1:46:22Ryan Sean Adams?

  I guess you have to see that the next time it happens and you kind of can can measure how quickly they're able to do this. But like scenario that out like, you know, you've been in the case of a DAO hack. Imagine you're kind of Bitcoin core Bitcoin community and you start to see some of these addresses on the move and you think they might be quantum. Like, what do you do next?

• 1:46:43Speaker 03

  Yeah, so the good news is that in order to freeze coins, you only have to do a soft fork. So basically you have to censor transactions, transactions that were previously valid are no longer valid. That's the definition of a soft fork. And the soft fork can be enforced by various entities, but it can be enforced by those running nodes. But actually it can also be enforced by the mining pools. And it turns out that like two or three mining pools control 51% of the hash rate. And so what the mining pools could do as a preventative measure is basically say, if we see a Satoshi coin, we'll just not include it in our blocks.

• 1:47:24Speaker 03

  We'll just send a tweet saying, hey, warning, warning, Satoshi is alive or we have a quantum attacker. Please start debating whether or not as a community, we want to soft fork in order to freeze Satoshi's coins.

• 1:47:40Ryan Sean Adams?

  I feel like it's a little too late at that point. Well, but what, but also, I mean, you you quoted this with kind of like a DAO type scenario, right? And quite famously Bitcoiners, it came down quite harshly on the DAO scenario for Ethereum because they said, you guys are invading property rights. This is an immutable blockchain. We thought that's what Bitcoin is and somebody's got to make that soft decision. And Bitcoiners quite famously like, you know, how do you find social consensus? There is no social consensus. There is no layer zero in the Bitcoin community. So like, how does that even work? Are you sure it won't like, well, do you think it will break brains and like break the the entire system?

• 1:48:14Speaker 03

  So we do have a precedent for this. Back in the early days of Bitcoin, maybe it was 2010 or 2011, there was this overflow bug, which basically allowed for the creation of arbitrary number of Bitcoins. And this was just so obviously a systemic risk to Bitcoin that they had to fix it. And I think it would be potentially a similar thing for for for quantum mining here.

• 1:48:40David Hoffman?

  I don't know, that's 2010 rollback is meaningfully different than post Michael Saylor era of Bitcoin. When when like people have, even you, Justin, have suggested like possible futures for Bitcoin, which includes like proof of stake and other other outcomes for Bitcoin, like including EIP 1559. And all of these suggestions, many of them include a hard fork. And when I hear people suggesting a hard fork for Bitcoin, in my mind, I immediately say, well, that's just not happening, like that just can't be done.

• 1:49:14Ryan Sean Adams?

  Particularly a hard fork that does something with with property rights, with Bitcoin supply or addresses or the thing that they, you know, the Bitcoin community says is immutable and has been since, I guess, 2010, 2011, that bug.

• 1:49:26Speaker 03

  Yeah, it's it's it's very hard to tell. My personal thesis is that the cleanest way for Bitcoin to survive long term is for the asset BTC to decouple from the chain and for the, you know, the asset to go live on something secure like like an Ethereum. And the good news is-

• 1:49:46David Hoffman?

  Hardcore Bitcoiners, I don't think will accept that. I don't think there is for hardcore Bitcoiners who do kind of set the value system of Bitcoin, that it's untenable to say that you separate Bitcoin from Bitcoins.

• 1:50:01Speaker 03

  I don't see Bitcoin surviving on a period of decades.

• 1:50:05Ryan Sean Adams?

  Oh, my God. So this is a ser- so here's what I was trying to figure figure out, right? So like when this Willow news from Google, you know, came out, there was a massive reaction and some people, you know, went as far as to say, well, you know, Bitcoin is doomed. And it feels like the reality is like, well, not today. And there are- Upgrade paths, of course, and this will take many years to play out. But like what you just said is over the long run, basically, this will require a massive social fork of some kind. Plus, you know, the tech is not so hard. It's more like, what do we do with the kind of the property rights of the 4 million Bitcoin? To such an extent that it may not survive. And this is not even, we're not even talking about the problems with proof of work that will happen after that.

• 1:50:50Ryan Sean Adams?

  That's just kind of wave one of quantum. When you know, quantum computers are strong enough to start attacking individual addresses. So at some level, this is as big an existential deal as, you know, some of the the fudsters and doom stayers were making it out to be. It's just not going to happen in the next three years, probably five years, but 2030 ish. The next cycle problem.

• 1:51:16Speaker 03

  Yeah, I mean, efficient markets should be able to price this in right now. But markets are not not super efficient. But you're right, there's a conundrum. Either you socially intervene, in which case you jeopardize the whole story of Bitcoin and the monetary premium, which is the only thing it has, or you don't intervene. And, you know, Bitcoin is just not going to work like technically always going to have one entity that's going to control a very large percentage of all the coins, something like, you know, double digits percentages.

• 1:51:47Ryan Sean Adams?

  So let's play out a scenario where they decide not to intervene in the property rights. Because, you know, we're just assuming that maybe they would do something with the 1 to 4 million Bitcoin. But it seems like it could be a path where they just say, nope, we're just going to let it be. We're not touching that Bitcoin. In fact, there could be multiple forks, like one fork of Bitcoin that says, no, we're going to, you know, do something with the property of the 1 to 4 million Bitcoin. And another, another fork that says, no, this is the real Bitcoin, Bitcoin classic. We could, we could have that type of a scenario. Anyway, it seems like a viable path where they implement the post quantum cryptography. And they just let the 1 to 4 million Bitcoin be susceptible to some sort of quantum computer attacker.

• 1:52:32Ryan Sean Adams?

  And whoever's first, whoever gets there gets the spoils. It's kind of the, you know, the booty, the pirate's booty of the sunken treasure ship at the bottom of the ocean. And whoever gets it, gets it. I mean, that's viable as well. Can you play that scenario out? Is that a realistic scenario? In some ways, it feels more realistic to me, but what do you think?

• 1:52:52Speaker 03

  Right, so there is this conspiracy theory that Satoshi is actually the NSA and that basically this is a secret master plan where, you know, the US governments will retain dominance economically by controlling a million Bitcoin and they actually have the private keys. And by the way, I'm a little shocked that, you know, if Satoshi didn't want to spend his coins, why don't he burn them? There's a very, very easy way to destroy them, provably, that would have like eliminated tons of FUD. Maybe he has a plan and maybe this story has some legs. But the way that I would see the scenario playing out in the other direction is basically

• 1:53:35Speaker 03

  where the Chinese government, which is the most likely entity that could stealthily build a quantum computer, would basically have the same master plan as the conspiracy theory where they basically said, okay, let's build this quantum computer to get a million Bitcoin and retain dominance economically in the world. So I guess that is a possible outcome and the Chinese government would have to basically work the social layer very, very strongly to stealthily and basically hide the fact that they are the new entity controlling these coins.

• 1:54:15Ryan Sean Adams?

  Okay, that's, we said earlier Bitcoin was kind of doubly screwed. So that's the first, you know, path where they're screwed. People can kind of, you know, hack individual Bitcoin accounts and private keys. But the second path, once quantum computers are strong enough to do that, they'll also be strong enough to accelerate like proof of work mining. And then you were describing, you were talking to Scott back and forth in the episode, you basically said you could very easily envision that just some group, some centralized actor has the first quantum computer that just blasts past everyone else. And so, you know, yeah, there's no equilibrium, I guess, where everyone has access to the same tech.

• 1:54:58Ryan Sean Adams?

  It's just like one super group with a super powerful quantum computer that kind of wrecks havoc on proof of work. So talk about that scenario and like, does that mean proof of work is doomed?

• 1:55:10Speaker 03

  So what would likely happen in that scenario is that for a period of some years, there would be one entity who would control the vast majority of the hash rate. And so what that allows them to do actually is to get all of the issuance and all of the the fees essentially for free. Because what they can do is that they can set the difficulty to be much higher than what all of the classical miners can do. So that all of the classical miners will basically shut off, but not spend so much energy, so not increase the difficulty so high that they have to spend a lot of energy.

• 1:55:53Speaker 03

  So they would have basically acquired the Bitcoin network. It would be theirs and they wouldn't have to spend much to maintain it and receive all of the rewards. But then there's another more worrisome attack, which is that they can change the fee schedule. So right now, in the in the dynamic of competitive miners, you basically have what's called a first price auction, which is that the transactions that are willing to pay the most get included. And sometimes it's just, you know, 10 cents, that's enough for you to get included. But when you control the chain, you have monopoly power over what transactions go in. And so you can have a policy which is not a first price auction. You can have a minimum fee.

• 1:56:38Speaker 03

  So you could say, you know, Visa style, please pay 3% of all your Bitcoin. So every time Michael Saylor wants to move his Bitcoin, 3% goes away. Or, you know, you could go Apple style and say 30%, that's my cut. And basically, there's, once you've acquired Bitcoin, there's kind of two ways to make money. You can try and keep it alive and, you know, just milk the fees, the issuance and like this, this, this small fee. Or you can do something much worse, which is try to kill Bitcoin and basically short it on the on the perp markets. And one of the really scary things is that there's about $40 billion of open BTC perps,

• 1:57:23Speaker 03

  which means that as an attacker, if I want to short in size, you know, tens of billions of dollars, I can totally do that and it will be relatively cheap. And the cost of attacking Bitcoin is most likely not going to be way, way less than that number. It is, it already is less today in the context of proof of work. But if you project yourself into the future, what will happen is that issuance will go down relative to the total supply. And so the issuance relative to the PEP market is going to go down. But also, if you have this monopoly power on technology and IP, this quantum IP, then you'll likely have to spend, let's say, $1 billion, and you'll be able to short

• 1:58:08Speaker 03

  hundreds of billions of dollars. Because presumably, in 10 years' time, the Bitcoin PEP markets will be in the hundreds of billions, if not trillions of dollars.

• 1:58:18Ryan Sean Adams?

  So, but these scary scenarios only happen if like one actor kind of gets this quantum super ASIC, basically. And they're so the only ones that can produce it. If a different world plays out where all of the nation states kind of compete, and they all kind of graduate together, and we have larger proliferation of quantum super ASICs, then can't we still preserve proof of work in the same way? It's just everything has kind of leveled up by orders of magnitude in terms of the hashing power. But since everyone's leveling up together, the proof of work algorithm still works?

• 1:58:55Speaker 03

  Yes. So theoretically speaking, if we all level up together, then it kind of worked. There is this one paper titled "On the Insecurity of Quantum Mining," where basically there's some edge cases where basically, if you're interested, the way that the algorithms work is that you start your problem, and then you do what's called a Grover iteration. And when you're doing the iterations, you don't know whether or not you'll be successful. And then after a certain number of iterations, you observe your quantum system, and you see whether or not you found a golden nonce. And the rational strategy in quantum mining is that when someone produces a block, everyone else is incentivized to observe all of the work that

• 1:59:40Speaker 03

  They've done so far and see whether or not they've also won or not. And what that will create is like high correlations between blocks being produced. So basically, there's going to be a lot of of uncles and and and orphans and reorgs, much more so than there is today, because there will be high correlation between when the blocks are are are produced. Now, putting putting that like detail aside, what I expect will happen is that we won't all level up at the same time. And the reason is that quantum is extremely, extremely advanced technology that will take years, maybe decades to commoditize. And really, the the principle that Satoshi was leveraging with one CPU, one vote,

• 2:00:23Speaker 03

  is this idea of commoditization and linearity, right? You have two CPUs, you have two votes, you have you spend two jewels, you have you have you have two votes. What I expect will happen is that we're going to see massive differences in in the performance of the systems. You may have Microsoft that's, you know, going down the superconducting path, and then some other team going down the trapped iron path. And they're going to have completely different performance characteristics. And even if you have two teams going down the same technology path, one might have an algorithm which is just, you know, orders of magnitude better than another.

• 2:01:05Speaker 03

  And so my expectation is that the difference between the the best miner and the second best miner is going to be orders of magnitude. And today, if you have a special ASIC, which is, let's say, three times better than the next best one, you dominate the market, like you. And so Bitcoin mining is is very, very susceptible to these to these relative differences in performance. And I think quantum will just massively amplify just because it's not yet commoditized.

• 2:01:37Ryan Sean Adams?

  OK, so that's Bitcoin and its problem set, which which seems, you know, pretty significant, pretty vast. Now, contrast that to Ethereum. It seems like Ethereum doesn't have doesn't have a two-pronged problem, so it doesn't have the proof of work problem. All we're fine from that perspective still does have a set of cryptography that's not post quantum secure, but we can get there with a hard fork as long as this doesn't happen tomorrow.

• 2:02:04Ryan Sean Adams?

  Ethereum, yeah, what are the prospects for Ethereum kind of upgrading and and like being fine on the other side of the the quantum compute revolution here?

• 2:02:13Speaker 03

  Right, so there's four different places where we might use pre quantum cryptography. There's the BLS signatures in the beacon chain. That's something that's under control in the sense that we have a plausible upgrade path within the next half decade, say, and that's that's more than enough time. Then we have ECDSA that is used for for for the account. And here it's a similar situation to Bitcoin, except that we have two advantages. Advantage number one is that we have account abstraction, meaning that the process of migrating to a different signature scheme does not require a fork and it can start today. If we have some large holders that want to be very conservative, they can start the process

• 2:02:58Speaker 03

  of of migration today.

• 2:02:59Ryan Sean Adams?

  And Justin, can this be upgraded without for the the the lost coins, let's say, on Ethereum? Or kind of the, you know, the passive coins as well? Or does it require active and active address and active opt in?

• 2:03:11Speaker 03

  This is where there's a couple of observations. The first one is that we don't have the equivalent of Satoshi on Ethereum. Like, we don't have someone who controls 5% of the supply on on an exposed address and who's presumed to be, you know, dead. And then the second advantage that we have is that from day one, we had this addresses that were the hash of the public key as opposed to being the the public key itself. So what is, you know, four out of 20 million Bitcoin, 20% on Bitcoin might be a much, much smaller number for for Ethereum, just because from day one, we had this this protection.

• 2:03:51Speaker 03

  So if if you, just to be concrete, if you, for example, if you participated in the Ethereum, actually, this is a real story. There's some people who participated in the Ethereum pre sale. They have thousands of ether and they just lost their secrets. These are lost coins, but because the only thing that you see on chain is the hash of the address and not the the pub key, these are actually not exposed to quantum computers.

• 2:04:19Ryan Sean Adams?

  Okay, so what I'm trying to get to in this is like the the set of post-quantum upgrades that Ethereum needed to do. Remember with Bitcoin, there was kind of the technical piece, and then there's also kind of the social property rights type piece. Does Ethereum have an equivalent problem? Obviously, it has similar technical, but is there a property rights component to it with some certain amount of Ether or tokens or addresses where we actually have to make a decision whether we freeze, whether like what we do with that?

• 2:04:48Speaker 03

  Yes, there is a similar problem, but from a quantitative standpoint, it's very different. I think for Bitcoin, it will be double-digit percentages, whereas for Ether, I'm expecting it to be a single-digit perspective. And so in some sense, ironically, the Ethereum might be able to take the more purest path of not intervening socially, just because the total percentage is much smaller.

• 2:05:13Ryan Sean Adams?

  It's like 5% of ETH? Or do we have any estimates for, you know, how many of, how much ETH or, you know, tokens or addresses would be, you know, not able to upgrade?

• 2:05:23Speaker 03

  So there was this study that was done at one point on all of the lost coins in ETH, and I think we were talking maybe a couple hundred thousand ETH, so like very small amount. And I think half of that was actually the Parity wallet hack, which itself is not exposed, because it's a contract where you just can't move the coins as opposed to being a normal address, which is which is exposed. So if I were to make an estimate, it would be basically 100,000 coins divided by 100 million supply, which would be 10 basis points, 0.1%.

• 2:06:07Ryan Sean Adams?

  That's very little. So I would imagine then the the community, if it is that amount, if it's greater than that amount, I don't know. But if it is that amount, you know, that 10 basis points kind of number, then I imagine the community just like lets it go, right? Probably. I would think that would be in the best interest of ETH holders and, you know, the property rights of Ethereum to just like do something like that.

• 2:06:30Speaker 03

  Yep, correct. And one of the cool things you can do in Ethereum as well is you can implement what's called a quantum canary. So you can have all of the efficiencies of pre-quantum cryptography, which is 10 times smaller. And then when someone provides a proof that small quantum computers exist, small enough to prove that they are indeed quantum, but not big enough to be able to break the cryptography, then anyone can produce one of these proofs on-chain and basically trigger the canary so that the smart contract has a different behavior. And for example, migrates to the post-quantum cryptography. So this is a way to have an immutable smart contract where you don't need governance to turn on that switch.

• 2:07:12Speaker 03

  It happens automatically and you get the best of both worlds. You get the security in the world where quantum computers exist and you get the efficiency while we wait for quantum computers.

• 2:07:24Ryan Sean Adams?

  Okay, but I interrupted your flow. I think you're going more on the technical side of like what's acceptable and what upgrades are required like in general. So just maybe just finish that thought out.

• 2:07:35Speaker 03

  Right, so we've covered BLS, we've covered ECDSA, there's two more. One is the blobs. They use this technology called KZG, which is basically elliptic curve based. That's going to have to be upgraded. And actually, I think this is a great thing. And the reason is that I'm not super satisfied with the blobs as they are today for various technical reasons. For example, they're very large and they're not variable size. So if you want to consume, let's say, just one kilobyte of data availability, then you have to consume a whole blob. And so this means that you have to do blob sharing and blob packing and it's this whole complication.

• 2:08:18Speaker 03

  We now have, this is something that hasn't been shared publicly, I guess, sharing it now. There's this idea called blob abstraction, where we can completely abstract away the notion of blobs from developers, basically developers return to just consuming data availability. But then in the backend, there's this super blob that we That is effectively the whole consensus and execution block taken together. And we do data availability sampling on that directly. So it's a massive improvement to DevX. And the fact that we have to move away from the current blobs because they're not post-quantum

• 2:08:57Speaker 03

  secure is a great pretext to push this new and improved design called Blob Abstraction.

• 2:09:06Ryan Sean Adams?

  Very cool. And would that be in sort of Beamchain concept, conceptual design, that four or five year time range?

• 2:09:15Speaker 03

  Yeah, I think so in terms of the time range, but it would be a different layer of the stack. We have three layers in Ethereum. We have the consensus layer, data layer, execution, Beam is consensus, that would be data.

• 2:09:27Ryan Sean Adams?

  Okay.

• 2:09:28Speaker 03

  And then there's a fourth place where pre-quantum cryptography might enter, which is Verkle trees. So today, we actually have what's called a Patricia Merkle tree for the Ethereum state, and that is post-quantum secure. And what we're thinking of doing is moving to a cryptography which is not a post-quantum secure because it gives us this efficiency advantage where the witnesses, the equivalent of the Merkle paths are basically much, much smaller. But we need to be careful, right? Because it would be kind of awkward if we do the Verkle fork and then a few years after that, we say, hey, hold on, we now need to upgrade again to be post-quantum secure.

• 2:10:13Speaker 03

  And so at least within Ethereum Foundation research, I think there's growing, I guess, maybe not consensus, that's maybe too strong of a word, but directionally, there is a growing interest in going directly to having a binary Merkle tree. So basically, a revamped version of the Patricia Merkle tree where the hash function is more snark friendly than what we have today, which is Kachak. So if you replace Ketchack with a hash function like Poseidon, you can get all of the efficiency benefits of vertical trees, where you take all of the witnesses for statelessness, and then you compress everything in a single snark.

• 2:10:58Speaker 03

  And you also get the post quantum security. So in my personal opinion, this may be like the more long term viable approach, and it would avoid us to have to do this intermediate vertical fork.

• 2:11:13Ryan Sean Adams?

  Okay, so Ethereum, in contrast to Bitcoin, Ethereum has some of the technical challenges, but it feels like there's a roadmap to solve that. And we could do that by the before quantum, well before quantum computers are actually a thing. So we're talking the five to year timer, or five to seven year time range, something like that. Is that the general idea here?

• 2:11:35Speaker 03

  Yep, exactly. We have a plan for everything.

• 2:11:37Ryan Sean Adams?

  Okay, and then in contrast to Bitcoin, of course, hopefully it does not have the the social problem of like, what do we do with the property rights of a massive amount of value on chain? It can just kind of sidestep that because we don't have one to four million Bitcoin worth of ether that's kind of like stuck in these addresses that can't be passively upgraded to be quantum secure. So it doesn't have that challenge. I'm trying to get kind of like order of magnitude of like on the Richter scale or something, like the earthquake that quantum computers will, you know, hit these networks with. And it feels almost like to me like, you know, it's a kind of a four earthquake, like you feel it for Ethereum. It's, you know, four on the Richter scale,

• 2:12:21Ryan Sean Adams?

  but it's not collapsing buildings. It's not, you know, destroying things. For Bitcoin, though, I feel like this is higher on the Richter scale. I mean, we might be at a five, six or seven on the Richter scale for the shake up that this will cause in Bitcoin, because there's just like a lot of challenges. And Bitcoin has not hard forked in this way ever before, whereas Ethereum has sort of a history of this. And this seems almost like less, like less of an upgrade than something like the merge, right? It feels like it's, yeah, it's less difficult. But what's your assessment of kind of the Richter scale impact on these respective networks?

• 2:13:03Speaker 03

  Yeah, I think I agree with you. I think the impact on Ethereum will be relatively small because we can have all of these upgrades. On the other hand, for Bitcoin, it kind of goes against the grain of the social layer. Right? You can choose either you upgrade and make yourself future-proof, but then you jeopardize your social contract of not upgrading, or you don't upgrade and you potentially jeopardize the whole system. And so Bitcoin is this, you know, massive conundrum.

• 2:13:48Speaker 03

  It's stuck and, you know, something has to break. On the other hand, for Ethereum, it almost goes with the grain of Ethereum. And this has to do with, you know, this desire to improve and change with time. I mentioned it with the blobs, you know, it's a great pretext to have a better design. But it's a similar thing for the Beam Chain. We know for sure that we have to change, and so this is an opportunity to clean up technical debt and do things, you know, properly from day one. And that will give us an opportunity to have a system which plausibly, you know, can last for decades and centuries without having to ever touch. And ironically, this is the better strategy to achieve long-term ossification.

• 2:14:33Speaker 03

  Right? The strategy of saying the very first alpha version, you know, of blockchains, you know, Bitcoin in 2009 is the end game, that is just, you know, very naive. And I think the better way of thinking about it is, you know, 20 years of innovation and research, all condensed in a chain like the Beam Chain, which can plausibly be left alone and fully ossified.

• 2:15:00Ryan Sean Adams?

  Now, because this is a problem that's probably for the 2030s and more than five years out, I don't think this has been priced in. I don't think many people are considering it. But of course, it's kind of a long-term thing that listeners of the Bankless Podcast should should consider.

• 2:15:18David Hoffman?

  As we approach it, it probably starts to turn into a game of chicken with the market, where it's going to be invisible into the market, and then it's going to get priced into the market in an acute event.

• 2:15:29Ryan Sean Adams?

  I mean, we could just like, look at what qubits are doing, right? It's like, we're at one right now, you know, a physical and logical qubit. So, you know, will this get priced in when we're at 1,000? Will this start to get priced in? Or how about 100,000, right? Well, then, we're kind of on the cusp. And how quickly does that happen? Maybe we start to see some reaction to that. And of course, this is a, you know, a social community. And so maybe the Bitcoin Core team kind of responds to these attacks with various plans in different ways, and maybe they have a plan for it. But it will be interesting. Maybe the last thing to touch in kind of this synthesis episode, Justin, which is like, really helped me, honestly, because there was a lot from Scott there. And I think Bankless listeners will appreciate this as well. The concept of quantum money. Now, this feels like it's

• 2:16:13Ryan Sean Adams?

  not here. It feels like it's decades, but out, potentially, right? Because there's a lot of preconditions for this. But it almost sounds like it could be a better Bitcoin than Bitcoin, a better Ethereum than Ethereum. And I'm not sure I've got my head wrapped around that. I'm not sure anybody does, quite honestly. Even Scott, his original proposal back in 2009, apparently, was already a leapfrog of what Bitcoin was proposing. But clearly, we don't have the capability for this now. How would you just summarize quantum money for us?

• 2:16:48Speaker 03

  So, it's not an improvement for Ethereum. And the reason is that you can't do smart contracts with quantum money. The only thing you can do is simple payments. But it is an improvement for Bitcoin because Just like gold, it no longer needs to be secured. Like, gold, you know, is just this rock, and you don't need to constantly secure it through fees or issuance. When you move to quantum money, basically, everyone has their piece of gold. And if they want to transfer it, they sign a message, they send the message over the internet, they give that to someone else, and someone else magically has that pot of gold. But you don't need proof of work. You don't even need proof of stake. You don't even need any form of consensus.

• 2:17:32Ryan Sean Adams?

  Why? Because you're using nature's notepad? I mean, that was, you know, kind of what, basically.

• 2:17:37Speaker 03

  Exactly. You're using nature's notepad in the same sense that gold is, you know, nature's ledger that was created in a supernova, or whatever the story is, and it doesn't need to be secured. Unfortunately, what I think will happen is that there's going to be a progression where quantum money will only be practical after Grover and after Shaw's algorithm. And there's a X percent chance that Bitcoin will die off in the first event, and then Y percent chance that it dies off in the other event. And so it might never even see the, it might never have the opportunity to see itself become quantum money.

• 2:18:19Ryan Sean Adams?

  Or that ledger could be forked into some quantum, like, basically, the ledger of accounts of everything, who owns what in Bitcoin, could be forked into some future version of a quantum money type of ledger chain. Well, the interesting thing is, like, from a historical perspective, you know, talking about Bitcoin, Bitcoin is gold, Bitcoin is gold. What if Bitcoin is silver? And there's actually, like, a super predator, a quantum money gold out there that is actually gold? You know what I mean? Like, this could happen quite quickly, at least from a historical money perspective, could happen in the span of decades. Like, we don't know. The race isn't concluded yet. We're just in the first, like, we're just in the second decade of digital scarcity and these types of systems.

• 2:19:04Ryan Sean Adams?

  So maybe we're still waiting for the gold.

• 2:19:07Speaker 03

  Yep. Now, going back to one of your questions, which is, is quantum money useful for Ethereum? I actually want to revise that question a little bit because there is a technology called one-shot signatures, which is extremely related to quantum money. And this does allow us to upgrade Ethereum. It would basically allow us to have what's called perfect finality. Because today, what we have is called economic finality, which means that if you're an attacker that can somehow create two inconsistent finalized checkpoints, we have this guarantee that at least one third of all of the ETH staked will get slashed. So there's about $100 billion of ETH staked.

• 2:19:46Speaker 03

  And so a finality attack will cost you at least $33 billion of ETH, which is fantastic. But what's even better than $33 billion is infinity dollars, where you can't even perform the attack in the first place because you have perfect finality. And the reason why we have the possibility for an attack is what's called equivocation, which is that you, as a validator, as an attester, you can vote for chain A, and you can also vote for an inconsistent chain B. But with one-shot signatures, the fundamental property is that you can only sign a single message, and then the private key destroys itself.

• 2:20:26Speaker 03

  And so you can either vote for A or for B, but you can never vote for A and B. And then what you can do basically is create these chains of one-shot signatures, where you can only sign a single message per epoch number. So today, as a validator, I get to sign one message per epoch. And if I sign two, I get slashed. But with one-shot signatures, it's physically impossible for you to sign two messages with the exact same epoch number. Now, that's something that you can emulate with TES. And actually, it's a way for you as an individual miner, if you're worried about getting slashed, you can put your private key in a TES that will do the...

• 2:21:08Speaker 03

  The double signing protection and effectively emulating one-shot signatures for you. But if you want to do that trustlessly and enshrine it in consensus, you would need a trusted system and one-shot signatures is a potential sci-fi futuristic path to get there. And it solves this another problem for Ethereum, which is this idea of delegation with LSTs. So today, basically, every operator has a different slashing profile. And basically, what we, the best solution that we have is something like Lido, where we put dozens and dozens of operators in a melting pot.

• 2:21:48Speaker 03

  And then we kind of give each of them a small sliver of the steak. And then you abstract away and wrap everything in an LST. But once we have these one-shot signatures, then because the operators can't create a slashable fault, you don't need to trust them anymore as much as you trust them today. And then you don't, you don't need all of this fancy infrastructure to create LSTs and delegated staking. It becomes much more straightforward. Where I, if I have If and I want someone else to be doing the staking, but I don't want to trust them, well, you can do so. The worst thing that could happen is that they just go offline.

• 2:22:32Speaker 03

  But if they go offline after, let's say, one day, then you just change operator and you send your funds to a different operator.

• 2:22:39Ryan Sean Adams?

  One-shot signatures, are they sort of, do they depend on the number of Qubits that we've unlocked? Or are they sort of a quantum adjacent type of thing that's like, you know, developed in parallel? How much does it depend on quantum computing itself?

• 2:22:53Speaker 03

  It depends highly, highly on quantum computing. At a minimum, you would need to be able to run Grover's algorithm. So. This is kind of going to happen, in my opinion, after we have Grover and Shaw. It's going to kind of be this third generation of applications.

• 2:23:11Ryan Sean Adams?

  Justin Drake, thank you so much. This has been a great synthesis and very helpful, I think, for Bankless listeners. We appreciate you.

• 2:23:18Speaker 03

  Thanks for having me.