Eli Ben-Sasson：量子電腦來了，哪些密碼學仍安全？
Zero Knowledge
- Eli Ben-Sasson StarkWare
影片
影片與逐字稿來源：Network State Podcast （CC BY）
場次摘要
StarkWare 共同創辦人 Eli Ben-Sasson 以迷宮比喻說明量子演算法為何可能破解部分現有密碼技術。他認為，密碼學仍有可因應量子運算等新威脅的設計空間，並提到 Starknet、Zcash 和以太坊社群都在研究相關方向。這是一場對潛在風險與研究路線的說明，並非宣稱量子電腦已破解區塊鏈。
值得記下的 5 件事
- ZK-STARKs 以雜湊函數為基礎，提供一條抗量子密碼學的設計路徑。
- 量子演算法可利用橢圓曲線與因數分解的特定結構，威脅依賴它們的密碼系統。
- 雜湊、格與錯誤更正碼提供不同抗量子路徑，雜湊的結構較少。
- 密碼學突破也可能影響網頁、銀行與信用卡的安全通道，範圍超出區塊鏈。
- Starknet、Zcash 與 Ethereum 都在探索較能抵禦新型威脅的密碼學設計。
逐字稿
開場
早安，Network State 的朋友。我想簡單講我的故事。很久以前，人類還能對前沿數學有貢獻，我有幸是最後一代做得到的人之一。Hello, good morning, Network State. So I want to tell you a little bit about my story. Long ago, there was a time when humans could actually contribute to frontier math, and I was lucky to be a member of the last generation of people who could do that.
當年我是 Zcash 白皮書七位作者之一，和六位傑出學者一起創立科學團隊。之後我做一些後量子安全密碼學。2018 年我們發表 ZK-STARK 白皮書，以雜湊為基礎，相當安全。那時我不知道，後來大家會這麼關心量子威脅。So back in the day, I was one of seven authors who wrote the white paper on which Zcash is founded, and I was one of the founding scientists alongside these six illustrious academics. Then I worked on some post-quantum-secure cryptography. So, in 2018, we published the white paper about ZK-STARKs. Which is hash-based and pretty safe. Now, I didn't know back then that we'd be in a state where quantum threat is on everyone's mind.
我想花幾分鐘，幫大家建立一個畫面：這是什麼、以及若量子電腦甚至 AI 突破出現，密碼學的安全底線在哪。So I want to spend, like, a few minutes just to give you some mental image of what it's about and also what is the safe ground for cryptography. If quantum computers, or actually even AI breakthroughs, come forward.
破解密碼系統通常是試很多不同可能，像猜密碼。就像走迷宮時一連串選擇。So cracking a cryptographic system is usually done by trying a lot of different things, like, you know, guessing your password. So it's like a sequence of choices you have to make walking in a maze. Now.
量子演算法與密碼迷宮
量子現象神秘地讓宇宙可以把一個人（或薛丁格的貓）短時間同時放在好幾個地方，然後再坍縮成單一狀態。Quantum phenomena allow, mysteriously, the universe to sort of clone a person—or a cat, if it's Schrödinger's cat—to be sort of in several different places at the same time for some period of time, but then it collapses to just one single state.
某些迷宮、某些密碼問題（例如橢圓曲線、分解相關）很「友善」：你用量子現象複製、同時試很多路，再讓宇宙坍縮成一個狀態，那個狀態剛好是迷宮出口。Now. It so happens that certain mazes, certain cryptographic problems, like ones related to elliptic curves and to factoring, are very nice in the following sense. When you sort of use quantum phenomena to sort of clone and, you know, check a whole bunch of paths, and then collapse the universe to one state, that one state just happens to be an exit of the maze.
這種演算法，這種先散開再選一個的量子現象，會帶你找到出口，從而破解密碼。還有其他迷宮沒這麼規律，像左邊那些。So that sort of algorithm, this quantum phenomenon of spreading around and then just picking one thing, leads you to the exit and then breaks cryptography. There are other kinds of mazes where they're not as nice and structured, like the ones on the left.
你做同樣把探索者送出去再坍縮的把戲，那個人只會落在隨機一點。後量子抗性的類別有好幾種，有的基於格，有的基於糾錯碼，最安全的是雜湊，因為雜湊幾乎沒結構，看起來很亂。And then when you sort of do this trick of sending someone all around and collapsing the universe, that person just ends at a random point. And there are several different classes of quantum-resistant stuff, some based on lattices, some based on error-correcting codes, but the safest is based on hashes, because hashes have very little structure, so they look very messy.
雜湊基礎與 ZK-STARK
我想說的是：視量子電腦或超級智慧能破解多少，影響可能遠超區塊鏈、全球資訊網、銀行，你每次用安全通道送信用卡資料都可能受影響。好消息是，只要用完全以雜湊為基礎的東西，數位商務、區塊鏈上安全付款仍然做得到。Now, what I want to say is that depending on how much can be broken, either by quantum computers or by, you know, superintelligence, this may have effects that go way beyond blockchain, the World Wide Web, banking—every time you send your credit card over a secure channel, that may be affected by that. But the good news is that you can have digital commerce, you can have safe sending of payments and stuff like that on blockchains, as long as you use something that is completely hash-based.
我認為各條路都指向 ZK-STARK：用零知識做隱私與擴展，且只建立在「存在某種雜湊函數」之上。所有雜湊函數都被破解，機率不高。And I think that all roads lead to ZK-STARKs, which is this technology that uses zero knowledge for privacy and scale, and it is based only on the existence of some hash function. And it's unlikely that hash functions, all of them, are going to be broken.
所以有一塊安全底線。我聽 Zooko 說 Zcash 已在研究；Starknet 我們做很久了，以太坊和其他專案也在做。So there is a safe ground. I heard from Zooko that there's already work looking into this at Zcash. Certainly, at Starknet, we have been doing that for a very long time, and Ethereum and other projects are doing that as well.
想聽更多，我寫了一本書，講我從學界走向區塊鏈創業。可以在這個連結下載。下次見面帶一本來，我很樂意簽名。非常謝謝。If you want to hear more, I wrote a book about my story moving from academics to basically blockchain entrepreneurship. You can download it at this link. Next time I see you, bring a copy. I'll be happy to sign it. Thank you very much.
