Oh welcome to gossip about gossip. Powered by Hedera Hashgraph. And each episode will cut through the hype of blockchain promises and explore real world examples of organizations creating the next generation of decentralized applications, which will bring trust back to the internet for us all. Hello and welcome to our latest episode of gossip about gossip, the podcast, where we talk about real world applications of distributed ledger technology. My name is Zenobia Gottschalk and I'm the SVP of communications here at swirl labs, helping to grow the Hedera ecosystem. I am delighted to be joined by RHO Khanna, who is a cryptographer here at swirl labs. Hi, rohit, how are you? Good nice to be here. Excited to talk about cryptography and quantum computing in general? Yes, absolutely. So I think there has been a lot of discussion about quantum computing and why it may break or affect the standards that we use today. Can you give our viewers a little bit of background on that and what the concerns are in the industry? Yeah, absolutely. So quantum computing, of course, people have been working on it for a long time. Recently there has been a lot of breakthroughs. For example, Google, a couple of years back, announced quantum supremacy. And of course, there was debate around that, what it really means to be whether they have really achieved quantum supremacy. But in general, there's been a lot of progress steadily building more and more impressive quantum computing, and it has lots of applications. There's ways in which quantum computing can speed up scientific computation across various different industries. But on the other side, because they're so good at, you know, solving different math problems, it does pose a threat to cryptography. So as we know, cryptography in its essence relies on the hardness of certain math problems, for example, factoring numbers into primes or solving the discrete log problems. All of the cryptography that's been used all over the internet, including, you know, various distributed ledgers, banking systems and so on. All of that cryptography does rely on these assumptions. And some of those assumptions are challenged by increasingly sophisticated quantum machines. So basically, these quantum machines can do calculations all the faster, which means that they could break the cryptography faster. Is that Super simple level? Exactly so. So yeah, let's dive into that. So so for quite a long time, cryptographers have known about these attacks. So for one, there's this Grover's attack or Grover's algorithm, which is basically a way for quantum computing to brute force through a large space of different solutions. And that could be used to figure out the cryptography key being used to protect your system, for example, your signing key or the AES encryption key that you're using to encrypt the data. But there is a simple solution for that. You just use larger keys. And so we haven't been super concerned about that. We can we can, in fact, et cetera we are already compliant with cnsa standard, which means we use Sha hashes of large enough size 384 bits or 256-bit a keys which which protects us against the Grover's attack. That, there's another algorithm in quantum computing called the Shor's algorithm, which in fact, which is a little hard to defend against. Shor's algorithm can be used to factor numbers into their primes or solve the discrete log problem, which affects things like public key encryption or signature schemes and signatures are used all over the place in distributed ledgers. We we use signatures to authorize transactions. And that's one thing where. When quantum computing can potentially impact security. And for that reason, the next announcement that we are going to be discussing today is of importance. All right. So so we know we have an issue help our audience understand what is missed and what have they been working towards? Yeah so this is a standardization body and they have been pushing standards of different in different industries for several decades, especially in cryptography. We we may be familiar with their massive effort on hashing standards and encryption standards. So several years back, they organized competitions for encryption, which is the de facto encryption algorithm used in industry. And their effort several years back was very important for our industry. So similarly, they have been interested in post quantum cryptography, encryption algorithms and signature algorithms that are safe against quantum attacks. And they have had a competition for allowing people to submit proposals for cryptographic schemes that are secure against quantum computing. And the competition has been progressing in several rounds and only recently they have announced a few algorithms that they are pushing forward with standardization. All right. So competition can sound like a light word, but it sounds like a tremendous amount of work has gone into this. And there's been a pretty open process for sharing these algorithms. Yeah so. So the general idea of doing this is to publish proposals in the open, have researchers, cryptography researchers all over, look at them, analyze them and see if they're potential attacks. And a lot of the algorithms, you know, the first version of the competition had over 70 submissions and a lot of them were found to be broken. And that's good. That's what we want. We want everyone to look at it and figure out if it's safer. Over time, you know, people have understood, like, what are the mathematical assumptions each of them rely on which ones are more trustworthy, which ones can be attacked in ways. I think that process has been super healthy. And I think we are arriving at solutions, which, of course, it's who knows, maybe people may find attacks in the future. But as of now, you know, they look like really good candidates. So as know, you've been following this nest, made an announcement a couple of weeks ago. Can you share with us what they announced and what you think that means? Yeah so they announced four algorithms that they're pushing for standardization, one being a public key encryption scheme, which is used to, which is used to encrypt data and also can be used for key encapsulation mechanisms. In addition to that, they propose three candidate signature schemes. Now, signatures, of course, is widely used in distributed ledgers to authorize transactions. And, and yeah, these three signature schemes, they, they don't all rely on the same mathematical assumptions, which is good because we want that diversity in case some, some are found to be vulnerable. There are others that we can piggyback on. So it's important that they're pushing a diverse pool of algorithms forward. That's important for us at Hedera because of course, so we as I mentioned, we use cryptography in these cryptographic algorithms. We use signatures. So we are actively following the standardization process. And, you know, we are analyzing what the trade offs, what it means for us. Like how large are these signatures? Because we're going to be storing them on our ledger. And yeah, if once, once the standardization becomes more mature and the implementations become more mature, we can certainly adopted in our platform. And so you mentioned that there are multiple algorithms. Would you be using all of them or is it going again And you think it's going to center around a single one? Well, so like next we would want to be flexible if needed. We can transition from one to the other if the industry decides one is safer than the other. Of course, we're going to have to make a decision on one of them going at least to start with what? Whichever one means best for our ledger. For example, whichever one has the smallest signature size, because we don't want to be storing lots of data on our nodes. Yeah so it's going to be an interesting decision making process for sure. Yeah and how do you see? I'm sure there is much more work to be done there as you see this being applied to distributed ledgers. You've mentioned sort of analyzing it and testing it, starting to implement it. What else do you see happening in this space in the next six or 12 months? Yeah so I should mention that quantum computing is still in its early stages. You know, the attack, the cryptography that we are using today requires quantum computing with several thousands or even millions of qubits, which is the way you measure the strength of the quantum computer and the state of the art is 5200 qubits. So we are several years away. We don't have to do this now. But at the same time, we should be prepared. So so I don't think we need to do anything in the next six or 12 months. I don't think we'll have. I might be wrong, but we could have. I don't think we are going to see that big leap in quantum computing anytime soon. But at the same time, I think we should be ready to make that transition and will for us at Hedera. And I think the internet in general, I think we should be watchful of the standardization process. We should prepare our systems to be ready for that transition. And in a lot of ways. Or in a lot of ways, we can do that, for example. It's if your system relies on TLS communication channels to secure communication between nodes which had error does although it doesn't impact we don't rely on it for security, but we still use TLS. It's a matter of switching the TLS library to one that's using a post-mortem secure key exchange mechanism. As far as digital signatures go, it is a relatively straightforward switch to supporting wallets that use quantum secure signature schemes. And we're certainly ready to make that step on our end. But as I said, I don't think we need to do that in the next 12 months or perhaps even in the next one decade. Yeah got it. And rohit, as other parts of the ecosystem start to think about it, it sounds like you would recommend a measured approach, sort of watch it and continue to monitor and think about how they incorporate this over their product roadmap. Exactly Yeah. We should all be ready to meet to transition. Yeah all right. Well, rohit, Thank you so much for sharing with us. This was very valuable and we appreciate you taking the time. Yeah, absolutely. This was fun to talk about. Thank you for having me. All right. Thanks
