Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quantum computing bombshells that are not April Fools

scottaaronson.blog

Post reply on HN
Print view View original

101–110 of 118 posts

Re: Quantum computing bombshells that are not April Fools

#101

Post by Strilanc »

timbowhite wrote: post #86
ozim wrote: post #58

Earlier quoted context omitted.

Your bank doesn’t depend only on cryptography. It would be still a lot of effort to simply make transfer from a bank account. Quantum computer will not magically give an answer for a password of a hash you don’t have. TLS is moving to post quantum as we speak. For crypto currency you have all the data you need to break whole system ready in your hands as you will be able to produce private key from public keys of wal…

In Bitcoin's case, public keys are only revealed during a transaction. And every transaction completely spends the source keypairs' funds. So the only attack vector a quantum computer could use is: 1. Observing newly broadcast/unconfirmed transactions 2. Deriving the private key(s) from the public key(s) 3. Creating and broadcasting its own transaction using the stolen keypairs before the original transaction confirm…

The newest transaction mechanism (taproot; P2TR) exposes the public key of the receiver as part of the transaction. If it becomes more commonly used, the supply of bitcoins with exposed public keys would start going up again. See figure 5 of https://arxiv.org/pdf/2603.28846#page=14 .

Re: Quantum computing bombshells that are not April Fools

#102

Post by bawolff »

cyberpunk wrote: post #59
bawolff wrote: post #47

Earlier quoted context omitted.

> If Bitcoin is broken then your bank encryption and everything else is broken also. Its a lot easier for your bank to change encryption methods than it is for bitcoin. Presumably you mean TLS here (where else do banks use encryption? Disk encryption?). People are already deploying experiments with quantum-proof TLS. > As far as I know quantum computers still can't even honestly factor 7x3=21, so you are good. And th…

I still don’t really get the argument, like okay this extremely rich theoretical attacker can obtain the private key for the cert my service uses, and somehow they’re able to sniff my traffic and could then somehow extract creds. But that doesn’t give them my 2fa which is needed to book each transaction, and as soon as these attacks are in the wild anti fraud/surveillance systems will be in much harder mode. I don’t…

My bank definitely doesn't require 2FA on every transaction. It only requires it to log in. I guess other people have more security concious banks then me.

Even still, i think there is some benefit to attackers being able to passively monitor connections. Getting the info neccesary to conduct some other type of fraud outside of the system. Lots of frauds live or die on knowing enough about the victim's financial situation.

However it really doesn't matter, when it happens we will just switch to different encryption.

Re: Quantum computing bombshells that are not April Fools

#103

Post by bawolff »

i2km wrote: post #67
cyberpunk wrote: post #59

Earlier quoted context omitted.

I still don’t really get the argument, like okay this extremely rich theoretical attacker can obtain the private key for the cert my service uses, and somehow they’re able to sniff my traffic and could then somehow extract creds. But that doesn’t give them my 2fa which is needed to book each transaction, and as soon as these attacks are in the wild anti fraud/surveillance systems will be in much harder mode. I don’t…

It’s turning into a bit of a grift now. So many crypto agility “consultants “ popping up with their slop graphics. Never mind the fact that even if a relevant quantum computer is built it will still cost the user millions of dollars to break each RSA key pair…

I dont neccesarily think it would cost millions per key pair. Hard to say with the technology so immature, but it seems like the sort of thing with huge upfront costs but low marginal costs. Once you have a QC you dont have to build a new one for the next key pair.

Re: Quantum computing bombshells that are not April Fools

#104

Post by amluto »

MattPalmer1086 wrote: post #44
Mistletoe wrote: post #23

Earlier quoted context omitted.

If Bitcoin is broken then your bank encryption and everything else is broken also. As far as I know quantum computers still can't even honestly factor 7x3=21, so you are good. And the 5x3=15 is iffy about how honest that was either. https://news.ycombinator.com/item?id=45082587 Bitcoin uses 256-bit encryption, it's a universe away from 5x3=15.

All serious financial businesses already have a quantum strategy and are actively working on transitioning their cryptography to post-quantum secure algorithms. Bitcoin doesn't use 256 bit encryption, unless you mean 256-bit hashing. The cryptographic algorithms that are mostly under quantum threat are asymmetric, e.g. digital signatures.

> All serious financial businesses already have a quantum strategy and are actively working on transitioning their cryptography to post-quantum secure algorithms.

That’s hilarious and it’s not even April 1 anymore.

Lots of serious financial businesses still use FTP or use SFTP running some unbelievably bad server implementation on a Windows machine somewhere that uses such outdated cryptography that it doesn’t even interoperate with modern OpenSSH. Operations do not necessarily score highly on the ACID scale. It’s tied together with duct tape and baling wire.

On the other hand, the system works and is really remarkably resilient to various failure modes. You would be hard pressed to cause more than severe annoyance by compromising these crappy old systems.

Re: Quantum computing bombshells that are not April Fools

#105

Post by looshch »

freetonik wrote: post #25

I worked at a quantum computing company that builds superconducting QC chips (so, not really applicable to one of the “bombshells” from the article). My team was designing the software stack which allows to control the QC, run quantum jobs/algorithms, and calibrate the parameters. I’ve made two attempts to explain the work we’ve been doing and to explain the current realistic state of the industry: 1. A talk at PyCon…

> I worked at a quantum computing company

the moment i read it i immediately thought about Rakhim, then i checked your username and indeed it was you. Fun!

Re: Quantum computing bombshells that are not April Fools

#106

Post by dumbfoundded »

Strilanc wrote: post #98
dumbfoundded wrote: post #92

Earlier quoted context omitted.

I don't think you're understanding how cryptography works. A commitment is basically a hash that is both binding and hiding. In this example it's probably easiest to think of it as a hash. So you hash your post-quantum public key (something like falcon-512) and then sign that hash with your actual bitcoin private key (ecdsa, discrete-log, not quantum safe) and then publish that message to the bitcoin network. Then qu…

The DoS attack in this scenario is someone just submitting reasonable-looking but ultimately bad precommitments as fast as possible. The intuition is that precommitments must be hard to validate because, if there was an easy validation mechanism, you would have just used that mechanism as the transaction mechanism. And so all these junk random precommitments look potentially legitimate and end up being stored for lat…

If the question is storage, bitcoin itself provides a perfectly good mechanism. idk the exact costs but it'd be in the range of ~$0.45 to store a commitment. That's cheap enough to enable good users with small numbers of keys but also expensive enough to prevent spam. It's kind of the whole point of blockchains.

As for verification being expensive, it sounds like you don't know the actual costs. It's basically a hash. Finding the pre-image of a hash is very expensive to the point of being impossible. Verifying a pre-image + hash function = a hash is extremely cheap. That's the whole point of 1-way functions. Bitcoin itself is at ~1000 EH/s (exahashes per second)

Again, this isn't a technical problem. It's a coordination problem.

Re: Quantum computing bombshells that are not April Fools

#107

Post by MattPalmer1086 »

amluto wrote: post #104
MattPalmer1086 wrote: post #44

Earlier quoted context omitted.

All serious financial businesses already have a quantum strategy and are actively working on transitioning their cryptography to post-quantum secure algorithms. Bitcoin doesn't use 256 bit encryption, unless you mean 256-bit hashing. The cryptographic algorithms that are mostly under quantum threat are asymmetric, e.g. digital signatures.

> All serious financial businesses already have a quantum strategy and are actively working on transitioning their cryptography to post-quantum secure algorithms. That’s hilarious and it’s not even April 1 anymore. Lots of serious financial businesses still use FTP or use SFTP running some unbelievably bad server implementation on a Windows machine somewhere that uses such outdated cryptography that it doesn’t even i…

I work in the sector, and I'm responsible in my own organisation for our quantum strategy. Most, if not all, of the serious players are doing this. This doesn't mean we have replaced all our old crypto; far from it.

NIST has defined a timeline for post quantum readiness to be complete by 2035. Crypto migrations historically take a long time; you can't just replace your own stuff, or upgrade just a server. All the clients that interact have to upgrade as well or it all breaks.

Re: Quantum computing bombshells that are not April Fools

#108

Post by amluto »

dumbfoundded wrote: post #106
Strilanc wrote: post #98

Earlier quoted context omitted.

The DoS attack in this scenario is someone just submitting reasonable-looking but ultimately bad precommitments as fast as possible. The intuition is that precommitments must be hard to validate because, if there was an easy validation mechanism, you would have just used that mechanism as the transaction mechanism. And so all these junk random precommitments look potentially legitimate and end up being stored for lat…

If the question is storage, bitcoin itself provides a perfectly good mechanism. idk the exact costs but it'd be in the range of ~$0.45 to store a commitment. That's cheap enough to enable good users with small numbers of keys but also expensive enough to prevent spam. It's kind of the whole point of blockchains. As for verification being expensive, it sounds like you don't know the actual costs. It's basically a hash…

Commitment validation would indeed be trivial.

This whole scheme fails if an attacker can manage to delay a transaction for a day, and if the commitment also commits to a particular transaction fee, then the user trying to rescue their funds can’t easily offer a larger transaction fee if their transaction is delayed. But if the commitment does not commit to a transaction fee, then an attacker could force the transaction fee to increase arbitrarily.

Maybe the right strategy would be commit, separately, to multiple different choices of transaction fee.

Re: Quantum computing bombshells that are not April Fools

#109

Post by pyuser583 »

freetonik wrote: post #25

I worked at a quantum computing company that builds superconducting QC chips (so, not really applicable to one of the “bombshells” from the article). My team was designing the software stack which allows to control the QC, run quantum jobs/algorithms, and calibrate the parameters. I’ve made two attempts to explain the work we’ve been doing and to explain the current realistic state of the industry: 1. A talk at PyCon…

Does quantum have any money making prospects?

Breaking encryption is illegal. Making encryption is difficult to profit from.

Other than that, what’s the value add?

Re: Quantum computing bombshells that are not April Fools

#110

Post by pseudohadamard »

pyuser583 wrote: post #109
freetonik wrote: post #25

I worked at a quantum computing company that builds superconducting QC chips (so, not really applicable to one of the “bombshells” from the article). My team was designing the software stack which allows to control the QC, run quantum jobs/algorithms, and calibrate the parameters. I’ve made two attempts to explain the work we’ve been doing and to explain the current realistic state of the industry: 1. A talk at PyCon…

Does quantum have any money making prospects? Breaking encryption is illegal. Making encryption is difficult to profit from. Other than that, what’s the value add?

Scaring people, then selling them stuff that you claim will deal with the scare. It's practically a license to print money.
Post reply on HN