Eli Ben-Sasson：量子電腦會終結「你的私鑰、你的幣」嗎？StarkWare 創辦人深度解析

0:00量子威脅與加密貨幣的未來

0:00大家都很擔心量子電腦會不會讓整個區塊鏈系統崩潰。昨天才有一則推文引起了很多討論，我今天想來談談這個議題。回到以前，人類還在做數學的時代——我自己以前就是做數學的，今天想跟大家分享我的想法、我的擔憂，以及我對後量子區塊鏈未來的看法。Everyone's worried about quantum computers and whether, you know, all of blockchain will break. There was just a tweet yesterday that caused a lot of noise about this, and I want to address this. So back in the day when humans did math, I was one of those people who actually did math as an occupation, and I want to share with you my thoughts, my fears, and what I think could be the future of post-quantum blockchain.

0:40這一切其實都回到一個問題：未來的貨幣協調點（Schelling point）會是什麼？在後量子、後 AI 的世界裡，大家會怎麼看待錢？簡單回顧一下歷史，過去大家都認為錢就等於黃金。如果你坐在這裡，應該也知道現在世界上已經有一種新的、更好的黃金，那就是數位黃金，也就是 Bitcoin。And it all boils down to the question of what will be the Schelling point for money. In the post-quantum and post-AI world. So a little bit of background. Back in the day, everyone agreed that money equals gold. And if you're sitting here, you probably know that there's a new and better form of gold that the world agrees to, and that is digital gold, also known as Bitcoin.

1:08最近有很多人說，錢必須要有隱私性。Zcash 就開始在這個領域佔有一席之地。問題是，未來大家會不會認為，錢還需要其他特質才能被認定為錢？這就是我今天想討論的主題。簡單介紹一下我自己，我參與了很多現在區塊鏈上用到的密碼學技術的開發。More recently, a lot of people have been saying that for something to be money, it needs to have privacy. And Zcash is starting to occupy this space. And the question is if at some point people will say, wait a second, money needs to have other attributes for it to be considered money. And that is what I want to talk about. So a little bit about myself. I helped build a lot of the cryptography that is now used out there in blockchain.

1:34從 ZK 到 zk-STARKs：密碼學的演進

1:34我以前做研究，直到 2013 年發現了 Bitcoin，才意識到我一直在研究的 ZK（零知識證明），其實可以同時解決區塊鏈的隱私和擴展性問題。於是我轉換了研究方向，跟我的合著者一起寫了一篇叫做 ZeroCash 的論文，後來被實作成 Zcash，我也是 Zcash 的共同創辦人。看到 Zcash 現在的成就我很自豪，這幾天大家也聽到很多精彩的分享。So I used to do research until I found Bitcoin in 2013, and then I realized that ZK, which was the stuff I was working on and that no one in the blockchain world heard about back then, is something that can solve both the privacy and the scalability problem of blockchain. So I shifted my work, and with my co-authors, we wrote a paper called ZeroCash that then ended up being implemented in Zcash, which I co-founded, and I'm very, very proud of the success of Zcash these days, and you heard a lot of great talks about it.

2:17但這還不夠。當時我就開始擔心量子威脅，思考能不能有更好的密碼學方式。這也促使我投入 zk-STARKs 的研究，這是一種基於雜湊（hash-based）的技術，對量子和 AI 威脅更安全。這就是我後來創辦 StarkWare 和 Starknet 的原因。But that wasn't enough, and one of the things I was worried back then about was quantum threat, and can you have better forms of cryptography, which led to my work on zk-STARKs, which are hash-based and are safer from quantum and AI threats. And that's how I came about to co-found StarkWare and Starknet.

2:42量子電腦如何破解你的私鑰

2:42我們來談談量子電腦的威脅，還有我們可以怎麼預防量子造成的災難。大家都喜歡區塊鏈，因為「你的私鑰、你的幣」這句話。但這句話有個但書：前提是底層的數學難題還是難的。我想用個比喻來說明加密是怎麼保護你私鑰的。So let's dive into the threat of a quantum computer, I want to explain to you what exactly it's about and what can we do to prevent a quantum-based meltdown. So everyone loves blockchain because we know that, you know, your keys, your coins. But of course, there's a fine print, and the fine print is that it's your keys, your coins, provided the math underlying this remains hard. And I want to give you some mental image for how encryption works when it comes to controlling your keys.

3:18你的私鑰其實就是一串很長的數字或字母，只要沒有人知道這串密碼，你的 Bitcoin、Zcash、Starknet 幣（甚至 Ethereum）就很安全。那別人怎麼攻擊你的私鑰？傳統的方式，就是用你現在的筆電或手機，想辦法猜出這串密碼。這就像走迷宮一樣，每個路口都要選擇左轉還是右轉，每一位都要猜對，才能走出迷宮。So, you know, you have some long sequence of numbers or letters that represents your key, your secret key that controls your Bitcoin or Zcash or Starknet coins, doesn't matter, Ethereum. Okay, and as long as no one else knows that sequence, you're safe. Now, how does someone else attack that and find your keys? So the classical way, classical means, you know, on the laptops and smartphones that you have today, finding out your sequence, your key, and stealing your coins is a little bit like... Finding an exit to a maze. So you're standing at a point in the maze, and you have, you know, two paths diverging, and you have to choose right or left. And whatever you choose, there's going to be another choice that you need to make, right? If you think about a key, like it's a long sequence, you have to guess what is the first letter, then the second letter, the third letter, and you got to get all of them right in order to exit the maze.

4:22破解私鑰、偷走你的幣，就像在迷宮裡找出口。傳統電腦只能一條一條慢慢試，或是用暴力法全部試過。但量子電腦就不一樣了。你可能聽過薛丁格的貓，量子現象就是同時存在多種狀態。想像你在迷宮裡，每到一個岔路就可以分身，同時走左邊和右邊，每遇到一個路口又可以再分身。這就是量子力學的威力。So. Breaking a key and stealing your coins is like finding your way out of a maze. And in a classical computer, you need to do this by chance or exhaustively check all the different ways to turn. But here's where a quantum computer comes in and works differently. So you may be familiar with this concept of Schrödinger's cat, which is at the same time, alive and dead. So the quantum phenomena means something like this, that for certain periods of time in certain systems, you can have the universe in two different situations, right? Or if you think about the maze, what if you could clone yourself? And go both right and left, and do not only that, but then subsequently, with every, you know, intersection that you have, you can clone again and again yourself. Okay? So this is what quantum mechanics allows you to do.

5:37但量子力學有個「測量」的過程，最後宇宙會收斂成一個狀態。就像你只能看到一隻貓，不會看到無限多隻貓。重點是，有些迷宮的結構很特別，當宇宙收斂時，剛好就會落在出口，也就是你的私鑰。這就是為什麼量子電腦可以破解橢圓曲線密碼學（像 ECDSA）或質因數分解，因為它能同時走所有路徑，最後直接找到答案。So now think about this sort of, you know, person who has, or a cat that has cloned itself and is—Trying out all different paths. There is a part in quantum mechanics called a measurement in which sort of the universe collapses and just picks one version, right? Because we know that, you know, if there's one cat, then we see only one cat. We don't have the ability to clone cats and people. So there's just this phenomenon where for some time you can check many things in parallel. But then it all collapses down to one version of the universe. And the point is that certain mazes have a very nice structure that when you collapse the universe, it collapses to a state that corresponds to an exit of the maze. And that's how you break things like elliptic curve cryptography. Or factoring using a quantum computer, there is the ability to check all paths, and then the universe sort of collapses to one state, and that one state happens to be the solution, which happens to be your keys.

6:42量子抗性密碼學與未來的安全基礎

6:42這就是量子電腦的威脅。不過，有一類密碼系統，例如 ZK-STARKs（Starknet 和其他系統的基礎），它們的迷宮結構不像傳統那麼容易被量子電腦破解。這類密碼學被稱為量子抗性（quantum resistant）。Okay, so that is the threat of a quantum computer. And there is a class of cryptographic systems such as ZK-STARKs, on which Starknet and other systems are based. That doesn't have incited mazes that are nice and simple that allow the universe to find solutions. And those classes of cryptographic systems are known as quantum resistant.

7:04目前 Bitcoin、Ethereum、Zcash，幾乎所有鏈上的幣，都是靠那種量子電腦容易破解的迷宮來保護。這就是為什麼我們要轉移到更安全的基礎。回到一開始的問題，未來世界一定會收斂到某種同時能抵抗量子威脅的貨幣。每個現有的幣都想成為那個標準，所以我們一定要有後量子安全的方案。So the quantum threat is that in Bitcoin, Ethereum, Zcash, basically all chains out there, your coins are secured right now by something that corresponds to a maze that a quantum computer can break, because it's a very nice maze, and we want to move that. So I'm going back to this question of, you know, the world will converge on some version of money at some point that also has to be safe from something like a quantum threat. And the question is, what will it converge on? And obviously, every existing coin wants to be it. Okay. So we definitely need to have something that is post-quantum safe.

7:42AI 也能破解密碼學？安全基礎的再思考

7:42但還有另一個潛在威脅。現在有很多被建議用來取代傳統密碼學的方案，像是 lattice-based（格基）或 coding-based（編碼理論）密碼學，但這些底層數學其實也開始出現裂縫，尤其是 AI 已經破解了一些這類方案。舉例來說，三個月前有個叫 Hawk 的後量子簽章被 AI 破解了，經典的 McEliece 編碼系統也在一個月前被攻破。But there's another threat that is lurking behind, because if you think about some of the replacements out there suggested to replace the quantum susceptible stuff, the mazes that underlie them, or the math that underlies them, is also in many cases very nice and structured. So there are things like lattice-based constructions and coding-based constructions, but the problem is that the math underlying these things has seen some cracks in it, meaning, especially AI has seen some of the schemes based on these other things break and crack. So one example, there was a candidate for a post-quantum secure signature called Hawk that was cracked about three months ago by AI, and the classic McEliece system based on coding theory that has been considered safe for 50 years saw another crack about a month ago.

8:36所以問題來了：我們到底要移到哪一種安全基礎？答案是，應該要選擇 hash-based（雜湊基礎）的密碼學。昨天 Justin Drake 也發了一則推文，討論要轉向 hash-based 密碼學。這也是我們 StarkWare 和 Starknet 從一開始就堅持的方向。So the question is, you know, where is the safe ground that we should move to? And the answer is you want to move to things that are hash-based. So again, the tweet yesterday by Justin Drake talks about moving to hash-based cryptography. Everyone's talking about that, and that's been my passion and our passion at Starkware and Starknet since the beginning.

9:01AI、電影與現實：密碼學的脆弱性

9:01我想給大家看一段 90 年代很棒的電影《Sneakers》的片段，推薦大家去看。電影裡說，密碼學系統是建立在極難解的數學問題上，沒鑰匙就無法解開。但主角發明了一個晶片，能不用鑰匙就破解這些問題。電影裡甚至有人問：『要不要讓幾架客機墜毀？』然後大家趕快關掉機器。So I want to show you a scene from a very nice movie from the '90s called Sneakers. You should all check it out. How is this possible? Cryptography systems are based on mathematical problems so complex they cannot be solved without a key. Janek must have figured out a way to solve those problems without the key, and he hardwired it into that chip. Anybody want to crash a couple of passenger jets? Turn it off. Turn it off.

9:32這部電影一開始就是一位天才數學家被謀殺，劇情圍繞著他破解密碼學的能力。但現在我們面對的不是一個天才，而是 AI 這個更強大的『天才』。我們真的要擔心，AI 會不會把這些保護我們系統的密碼學全部破解。In this movie. There's, it starts with a genius mathematician being murdered, and the plot revolves around basically this genius being able to crack a lot of the math that underlies cryptography. It's a very nice movie. You should watch it. But now we have this much bigger genius out there, which is AI, and we should be worried. Will it crack open some of this cryptography that underlies all of the security of our systems.

9:59而且這不只是區塊鏈或 Bitcoin 的問題，網路、銀行、通訊、身分認證，全部都靠這些公開金鑰加密系統。現在我們真的要開始擔心這些基礎是不是還安全。And when I say all of our security, it goes way beyond just blockchain and Bitcoin, because everything on the web, banking, messaging, identities, all of that is currently based on these public key encryption systems, which are now, well, we should be at least a little bit more concerned about them.

10:20加密敏捷性與 Starknet 的未來

10:20還有一個更大的議題正在醞釀，這也是我和我的團隊現在花很多時間思考的事。現在連主權基金、大型機構都來問我們，未來的路要怎麼走？答案是，我們必須讓系統具備加密敏捷性（crypto-agility），隨時能切換到最安全的基礎，也就是 hash-based 密碼學，並用正確的 ZK 技術。And there's a bigger issue looming, and that is something that I am spending a lot of my time, and my team is spending a lot of time thinking about. We're also being approached by sovereign wealth funds, by very large institutions asking, what is the path forward? So the path forward has to be that you want to be crypto and cryptographically agile. And move to the safest ground possible, which is something that will be hash-based, using technologies that are proven and use the right kind of ZK.

11:00最後回到我一開始的問題：幾千年來，錢就是黃金。現在大家可能都同意 Bitcoin 是一種更好的數位貨幣。有些人也認為錢必須要有隱私，像 Zcash 這樣的專案。我很愛這個專案。那什麼才是後量子、又能靈活應變的貨幣？我希望是 Starknet，但這終究要看世界怎麼選擇。就像黃金一樣，沒有人能單獨決定，這是全球共識的問題。So I end with the question I started. Money has been gold for millennia. Everyone sitting here probably agrees that Bitcoin is some new form, better form of digital money. Some of you may agree that money needs to be private and are converging a little bit on Zcash, which is a project I really love. And the question is, what can be post-quantum and agile money? So, I hope it will be Starknet, but this will be something for the world to decide, because just like gold, you know, there's no one person or entity that decided it. It's really a question about, you know, what the world believes.

11:51Starknet 的量子抗性與未來規劃

11:51我們在 Starknet 會讓系統保持靈活、量子抗性、AI ready，只用 hash-based 密碼學。我們有一個遷移路線圖。目前我們還依賴 Ethereum 作為結算層，但如果 Ethereum 轉型太慢，Starknet 也可能會成為自己的 L1。這是我們正在思考、也常被問到的問題。如果你有興趣，歡迎來聊聊。And we at Starknet are going to make it agile. Quantum resistant, AI ready, using only hash-based cryptography. We have a migration roadmap. Currently we have a dependency on Ethereum because we settled onto it, and the question is if Ethereum is too slow. Well, if Ethereum is too slow to adopt, then Starknet will need to become an L1, and that is something that we are, you know. Being asked and considering, and I'd love to talk to you guys about it if you're interested to hear more.

12:28最後，如果你想要更多資源，我們有一個 Quantum Hub，可以掃這個 QR code。謝謝大家！So with that, I want to end. If you want more resources, you can look. We have a Quantum Hub. You can take and scan this QR code. Thank you very much.