Welcome Back And Quantum Net

SPEAKER_00 0:18

Jan Regis Gianniz is head of core engineering at Nomadic Labs. He's joined us before to talk about Tezos X, Latency, and Ushuaia. Since our last conversation, Quantum Net has launched, bringing several pieces of Tezos quantum resistance work together on an experimental network. Jan, welcome back to Tez Talks.

SPEAKER_01 0:43

I'm very happy to be here again and um really excited about uh having this uh this time with you, answering some questions the best way I can.

SPEAKER_00 0:54

Appreciate you, sir. Well, last time you were here, we talked about Ushuaia introducing quantum resistant accounts for testing. Now Quantum Net is running

Auditing Tezos Layer By Layer

SPEAKER_00 1:05

with changes to consensus and the data availability layer as well. So once you had these new accounts, how did you figure out what else needed to change?

SPEAKER_01 1:17

Well, uh you have to look at the system layers uh by layers. Uh you start with um uh the settlement layer, the L1 layer, so the consensus, and you ask yourself, okay, let's look at uh at it. Where where are the where is the cryptography there? And which one is classical, which one is uh is is is uh quantum resistant. And actually, we had some gap, and uh and and we decided to uh look at the consensus and see okay what what are the way to adapt the system in order to maintain the same level of efficiency, you know, the block time being uh uh quite uh short on Tezos. We we don't have much time to decide together what what will be the next uh the next block. And um and then you move to the next layer and you look okay, you have DAR. Here there are some uh cryptographic proofs uh there too. Are there resistant to compute computing quantum computer? No, okay, we have to find an alternate alternative to it. And fortunately, there is a state of the art. So every time we have um sometimes even solution almost on the shelf, and sometimes something that gives us very strong um directions, a very strong uh way of handling it. And then you move to the next layer, layer two. What do we have, etc. etc. And actually uh we realized uh maybe a couple of weeks ago that we missed uh a layer uh under the settlement layer called the P2P layer, where there are also some cryptography uh at work and you can change the uh encryption encryption screen uh scheme uh to make it uh quantum resistant too. Um that's the whole point of uh of doing quantum net. It's uh it's a lab, an open lab, where we prepare in advance with prototypes what will be the Tesos protocol uh uh that will be quantum resistant in the future.

SPEAKER_00 3:28

That is a lot of loose ends to be bringing

The Hard Part Is Validation

SPEAKER_00 3:32

together. I mean, is it what's is there like is it really difficult to do something like that? Like, what's the most difficult part about bringing all this together?

SPEAKER_01 3:42

I was discussing with Zeina yesterday. Uh we were looking at the the the roadmap in order to uh to know what we can bring already in the next protocol uh because our point is to have this open lab and and and decide the piece by pieces what what is ready and move it to uh to production uh on the real mainnet protocol. And and we are discussing actually our point was uh essentially not about writing the code, I mean uh deciding how to integrate, swap from one protocol to the other, reuse some existing component or rebuild one, etc. All this is not too difficult, especially um in the uh uh AI agent world. It's more about validation. Because there are two kinds of uh properties that you need in a system. Of course, the functional property, is it doing what you expect? Is it behaving in the same way as the previous uh classical cryptography? That's one thing. It's not too difficult, but still you have to do this in um rigorously because if you change something, it will generate some impact on on the on the full system. So you need to get the similar, I mean compatible behavior. And there is another thing called non-functional requirements. Here you you find the uh performance, as I've told you uh a few seconds ago, uh, and uh security. And uh and and and sometimes even if something is uh on paper secure, you have to recheck to do somebody to make sure there are no some bugs or some ways to exploit uh in practice uh a component that you believe is secure. So so Zaina was clear, it's it's not about writing the code, and that's why it was so easy to start quantum net and put it uh test net, put it at work. Uh we we we can make it run, but now can we make it secure? That that's another question. And uh and the point is to uh to work pieces by pieces like this, and uh building a roadmap and and shipping this uh in the next protocol proposals and get it voted, etc. So that's that's uh from an engineering perspective, that's uh that's how we we tackle this.

SPEAKER_00 6:01

Now we've talked about quantum resistance before, but I want to

When Quantum Becomes A Real Threat

SPEAKER_00 6:05

put the problem into perspective for people watching. What would actually have to happen for quantum computing to become a threat to someone's TES?

SPEAKER_01 6:16

Um okay, so first uh we need quantum computers that uh are uh available. So it's quite clear for everyone that uh Google uh will probably have one very very soon, uh a good one. Uh at least they are working in that direction, and other entities will also uh have quantum uh computers. Now, uh, can an attacker have quantum computers? That's obviously the first assumption uh you need to check. Uh but let's assume that an attacker has a has a a computer, such a computer, and uh and now you have uh two situations. Uh a situation where you have encrypted something, it's there, it's a box, you believed it was impossible to enter into this box. And actually, with a computer computer, you you you can. Um after the fact. So it's a so imagine if you plan to have a quantum computer and do some bad things with it, what you do is to collect as much as possible so that in the future we'll be able to discover some secrets. Okay. But now for the test, it's a bit different because for the test, it's about knowing if someone can get essentially as an end user you your secret secret key from uh essentially your your public key. Okay, and indeed with a quantum computer, you you can you can do such things, you can uh essentially uh break uh the usual uh uh cryptographic scheme. Okay, so uh so that's in principle what's possible. But but if you want to uh to really uh reach that point as an attacker, you have to be uh faster than the end user. If I have a lot of tests, I will move them in a bunker mode. That's how we call it. It's a notion that says, okay, I know my key will be at some point uh probably breakable by a quantum computer. So as a user, what I will do is to protect myself by um uh by um um declaring with this key what would be essentially the next key that would protect my account. So that the moment the protocol says, oh now it's done, um we are not protected against quantum computer, I prepared the path to actually move, migrate to a post-quantum world. So so essentially to answer your question, my tests are protected as long as nobody has a quantum computer, nobody uh is faster than me to protect my my test. So it's not uh to say that it's it's not as if uh we were immediately under uh urgent need to do something. We need to take things uh seriously to offer a way for people to protect their tests to prepare for the post-quantum era. It will come probably sooner than later. Uh people are talking about uh uh 2033, 2030, sometimes 2028, or what so the point is clear for the blockchain industry is about setting now the means for the user to say, okay, I want to be protected, here is a way. Um uh I want my uh account, my my tears, my wallet to migrate to a new secret that I know is uh quantum resistant. So that's that's what is at sake today, offering uh such a mechanism for uh end users.

SPEAKER_00 10:15

And now you've got a network where all these different pieces

What Quantum Net Reveals In Practice

SPEAKER_00 10:18

can be tested together. So what's something you've discovered from running QuantumNet that you hadn't been able to see before?

SPEAKER_01 10:25

Oh, oh it's a uh good question. So um well, uh new new new cryptography. Uh it's uh it's sometimes it's it's a bit different from what we uh we were used to, uh both in not only in the math, but also in the way you use it. Uh so typically uh um for instance for bakers, uh we we went through some some some schemes where you have to do a lot of pre-computation beforehand before even starting to bake. So it's it's it's a new way of uh of participating in some sense. You you have when I say it's a lot of pre-computation, it's maybe some uh several hours of computation and some data that will allow you then to be uh quantum resistant. So that's maybe the the most surprising part on our side. The most surprising part, but also challenging part, is the fact that in general quantum resistant cryptography is slower than uh uh the standard one. So it means for us finding what can be optimized, where we we have to change the hardware requirement. So you know for Tezos we are always fighting for a baker to have the smallest possible machine that can uh still offer the the good quality uh of the Tezos protocol. Uh the typical Raspberry Pi or uh um uh mini uh mini machines that are enough today uh to bake on Tesos. Maybe we'll have to revise this uh specification and we want to be very precise. We don't want to say, okay, just buy this uh 10 ground uh machine, it will work. No, we want to to to use to use uh benchmarks to understand what is the minimal requirement to still participate and be quantum resistant. So all this um has been uh quite a surprise. Um and and maybe a last point is uh creativity. Because the moment you say okay, the the old rules uh don't work anymore, you have to find new ways of um proving things to the system. So typically um uh instead of uh using uh classical secret, what you do is that you you show that you know this secret through a proof, a proof of knowledge that is quantum resistant. So these are new ideas that you have to put on uh in place in several places, uh, and that's a very exciting actually from an intellectual perspective to uh to revise uh the full system from ground to top. Uh um yeah, uh that's uh that's what we learned, and we are we're keeping we are continually learning. It's it's a process. That's why we are doing this quantum net in an open uh way. We we will uh and we we already started uh communicating about what have been our learnings so that the full industry can profit from uh from these learnings because we believe not only Tezos has to be quantum resistant but actually the full uh ecosystem because there are bridges. Um I mean today uh blockchains are not um siloed uh silos, they are uh communicating with each other. We we want the system to be um to be globally uh resistant.

unknown 13:44

Yeah.

SPEAKER_00 13:44

Well, one thing that did catch my attention was the new consensus keys. They can only be used a certain number of times before they

Why Consensus Keys Get Used Up

SPEAKER_00 13:52

need replacing. How did you end up with a system that works that way?

SPEAKER_01 13:56

Yeah, as I've told you, it's uh typically the new uh uh families of uh cryptography scheme uh cryptographic schemes that uh are both compatible with the fast uh uh processing uh systems that process uh transactions in fast way and uh a loss to be quantum resistant. So essentially it's a so it's a pre-computation, it's a set of things that you pre-compute and that will be consumed during the the process, and uh at some point maybe you you have exhausted all the input, so you have to re-compute and regenerate uh explosion on that concept.

SPEAKER_00 14:39

Okay, I wasn't trying the connection. That makes sense.

SPEAKER_01 14:42

That's essentially the idea.

SPEAKER_00 14:43

Yeah, that's yeah, that I makes sense.

SPEAKER_01 14:46

I mean it's very natural. Uh when uh you know uh you you know during the World War II, uh one of the very one of the strongest uh cryptographic schemes was about sharing books. Yeah you you you just uh if you want to communicate with someone in a secure way, you you you you um write uh two long books uh with words, start the your secret, and they are just one shot. So so on the both sides, you you move your secrets all the time from the current one to the next one, and at some point you have no more secrets uh in the books, but you have uh been able to exchange, I don't know, uh millions of messages, so it's fine. And it's quite uh quite uh secure. Um again, there are a lot of subtleties, but uh that's the the basic idea.

SPEAKER_00 15:38

I was reading through the Quantum Net discussions and someone was trying

Hardware Limits And Real-World Testing

SPEAKER_00 15:42

to run it on an Orange Pie. They ran into troubles loading the new consensus keys and then later reported missing attestations. What do experiences tell you about what the team still needs to work through?

SPEAKER_01 15:56

Yeah. Um so we are first uh we are extremely grateful uh for people that report that kind of experience, participate, uh, tell us okay, it doesn't work on this setup, etc. Because that's exactly one of the big uh challenges is for us, as I've told you, to find the right minimal hardware. But it needs to be a uh especially if you want to participate to the DAR also, uh you need to have quite uh quite a large machine today. Our goal is to optimize and uh be extremely uh uh um I'd say uh rigorous in uh in this decision. Exactly as we when we decided to uh to reduce the block time, we did a lot of experiments with a lot of different hardware to know exactly what was possible with uh under the assumptions of the hardware run by the by the bakers and would do the same. So a lot of experiments, and it's a it's a large-scale experiment, so you have to spawn uh hundreds of machines and uh and you collect uh everything that is running on the blockchain, and then you you you extract data, you do some analysis, and you say, okay, that's the the three sort here and there, and at the end of the day you you got uh you got some constraints and and you can deduce uh the valid hardware.

SPEAKER_00 17:23

So there's something I wanted to ask about the transition itself. Say I've got

Protecting Dormant Wallets Without Custody

SPEAKER_00 17:28

some TES sitting in a wallet I've had since 2018. Maybe I haven't opened it in years. As Tezos moves toward quantum resistant cryptography, what eventually has to happen to protect that wallet?

SPEAKER_01 17:43

Yeah, it's um um there are several possible scenarios. Okay, we could we could be uh let's say uh uh in a best effort uh approach, like okay, uh for everyone that is paying attention, you have a way to protect your wallet. Now, many people that don't pay attention, you know, they have this wallet, it's there, they have their own life and they they they continue, and sometimes they recall them, oh actually I have some tests here and there. Um for these people that don't pay attention. Uh we uh want to offer also a mechanism. So essentially saying, okay, when we switch to the protocol that says now we need to be quantum resistant, for this account, we could we could just uh disallow uh the standard way of interacting with the account and and and um uh find a mechanism for uh the owner of the wallet to prove that he is the owner of the wallet. But typically of the you know, the seed uh the the the passphrase that uh were used to uh to generate the the key originally. So that could be a way that's a possible uh path that we are exploring. It's uh not completely obvious, uh but but that's that's our spirit. We want no one, even someone that is not paying attention to to pay for it. But I it it it's creating uh a complex uh complexity. And of course, I mean I see that some uh maybe uh some people could think that uh uh it could justify uh you know compromising a bit with decentralization and patching the protocol so that you in some sense uh some third party has uh the ownership of the wallet. We won't do that. Uh that's uh no go for us, and obviously it's obviously uh nothing we don't something we don't want to consider. We still need to keep people the only owner of their wallet, even if they don't pay attention to the quantum uh resistance. And that's uh part of the difficulty because of course otherwise we could do many things.

SPEAKER_00 20:00

Well, that's once again very refreshing to hear. It's a good reminder. I mean, it's it's one thing, I guess, to live in a completely walled, siloed garden, and another thing to be, I guess, responsible for your own assets somewhere in their right thing. Yeah. Well, you've got Quantum Net running, and there's still a lot to be explored. Some of these engineering choices might even change as the testing continues, like you said. So when you think about eventually

What Must Be True For Mainnet

SPEAKER_00 20:28

bringing this work to Tezos mainnet, what would you personally need to see before you felt confident it was ready?

SPEAKER_01 20:39

Um it's it's a difficult question. Uh, you know, at Nomadic Labs we are uh very keen to come with uh mathematical proof uh because we believe that the strongest form of uh guarantees, uh, and we are very happy to see uh the rest of the world uh today uh realizing that's probably the only way uh to work uh in the uh AI uh the AI error because uh with AI you can produce plausible uh output that looks like they are valid but they are not. And conversely, you can uh find with an AI all the flows in uh in the software that you uh you have shipped. So uh for something to go to my net today, it's the bar is far higher than before. And so, as I've said, uh a mathematical proof would be uh uh a good a good uh good green light uh for for a go. Now, not everything uh requires the same level of uh of guarantees, not everything also is at the same level of complexity. Uh there are things that are easier to prove and uh for which we can uh can simply uh do it with uh AI agent and check the the theorems specifically. But math are not enough because math in general they talk about a model or uh the the code but in uh through a given abstraction and there is another thing running the code on existing hardware hardware. Is it still uh above the bar of what is required for regarding performance and regarding also uh a lot of attacks that are not intrinsic to the software itself, but from its environment, you have you have seen many times people looking at uh ways to interfere with software execution that were okay but still uh showing too much. So there are many many things that you can look at, but at the same time, there is a sense of urgency. It's probably needed to have something shipped uh 2027, uh at least for uh the majority of uh of the stack um to protect our uh the users of the Tesos protocol. Fortunately, Tesos is upgradable. We have this uh possibility to ship things, iterate, improve, uh, make it

AI Challenges Cryptographic Assumptions

SPEAKER_01 23:18

even more resistant. And uh and so to today it's uh it's a it's how we think about it. We want to be quantum resistant, but also AI resistant in some sense.

SPEAKER_00 23:27

I was gonna say you that's something maybe we should touch on briefly. There's this this risk now. I mean, like the being able to figure out the math is one thing, executing uh a whole host of non-human things is another. Is that on the horizon as well?

SPEAKER_01 23:45

Yes, yes. Um and when you do math, what you do is to take you know some assumptions to a conclusion. Okay, and you you try to be as clear as and minimal regarding your assumptions, and then you can deduce what uh what you need. But what we have seen today is that some assumptions that we were used to to make are being broken by AI. And one actually was broken uh a couple of days ago, uh maybe three days ago. Uh it was it was about um uh what is called the uh three sat problem. So it's a bit technical, but it's it's quite uh easy to understand. Uh it's about um it's about um uh sorry, uh you have uh how to say that you you have some some way to um uh turn off and on some lights, and um and the and you have a formula and you need to use these lights to uh to actually make the formula valid or uh or invalid. And this problem actually we assumed for a long time it was very hard, what we call exponentially hard in some sense, in the in the time it takes to solve the problem. And recently this assumption, uh exponential time uh hypothesis, has been broken, uh is supposed to be broken by uh by an AI. It's still under uh verification, but apparently, and given also the simplicity of the tools that are used for this proof, I kind of think it's it's actually broken and it will continue that way. So it means that some algorithms that we believe were hard were actually not that hard thanks to AI, we are able to push the limits. And so it means that uh when we do our reasoning, we need to look at the assumption and believe okay, are we really sure that no AI will show that this assumption is actually wrong or not? And that makes uh the the uh the deal uh a bit more interesting, let's say, because if on classical computer some algorithm will begins to be improved in such a way that uh difficult problems become to be tractable, uh it's it's it's even more complex than quantum computer because everyone today can buy a uh a classical computer that goes fast and breaks your uh your system. So we need to be quantum resistant, AI resistant. Yeah, it's an interesting uh uh world to live in, I'd say, for a scientist at least.

SPEAKER_00 26:31

Did did you anticipate this on the horizon anytime sooner than this?

SPEAKER_01 26:35

Is this uh no, no, no, no. I I told you last time uh when I was uh a researcher, uh professor, uh at the University of Paris. I was in a in a uh in a lab where uh a group was uh designing quantum algorithms. So you know, algorithms that are supposed to run on a computer, quantum computer. It was 10 years ago, uh a bit more now. And I I remember oh, this algorithm, I was saying these algorithms are very neat, very interesting, but we won't never have the computer to run them, so it's fine. And actually, I was wrong. We will probably have such computers soon, and uh it's amazing, it's uh it's a marvelous uh piece of technology and uh new new new possibilities for science to to compute, to do some simulations, to to solve very difficult problems, so it's it's a very good news. But for us, uh people that are building critical software systems that needs to be secured, uh well, create some uh challenges.

Closing Thanks And Sign-Off

SPEAKER_00 27:41

Well, Jan, thank you so much for coming back on Test Talks. It's always good catching up with you.

SPEAKER_01 27:48

Same for me.

SPEAKER_00 27:50

And thanks to everyone watching. We'll see you next time.

SPEAKER_01 27:55

See you. Bye bye.