量子電腦來襲：加密貨幣的生存危機？Project Eleven、StarkWare、Tezos、Electric Capital 對談

0:00開場與講者介紹

0:00大家午安，感謝你們今天來參加。我們先從自我介紹開始，從最遠的講者開始。大家好，我是 Arthur Breitman，是 Tezos 協議的共同創辦人與設計者。Tezos 從 2014 年開始發展，現在已經 12 年，2018 年上線後持續運作，展現出很強的韌性，並且透過鏈上治理機制，持續保持安全與創新。Thank you so much for joining us this afternoon. Maybe before we get started, we could start off with a round of intros. Maybe start from the furthest and then come down. All right. Hi, everyone. I'm Arthur Breitman. I'm a co-founder and creator of the Tezos protocol. Tezos is a protocol that started in 2014. It's been now 12 years. It's run continuously since 2018, showing lots of resilience, and it is focused on security and staying at the cutting edge through an on-chain governance model.

0:47我是 Eli Ben-Sasson。你們可能不知道，以前有個叫做數學的行業，人類會做這件事。我以前就是數學家，專注於零知識（ZK）領域，包括後量子 ZK。2013 年愛上了 Bitcoin，寫了 Zcash 的白皮書，並共同創辦了 Zcash。後來又發明了後量子安全的 ZK-STARKs，並創辦了 StarkWare，現在是 CEO。Eli Ben-Sasson. I don't know if you know, but a long time ago, there used to be this field, this occupation that humans did called mathematics. I used to do that back in the day. Humans don't do mathematics anymore. That's for machines. So I started my career as a mathematician, did a lot of research on ZK, including post-quantum ZK. Fell in love with Bitcoin in 2013. Wrote the white paper on which Zcash is built, co-founded Zcash, built some post-quantum secure ZK called Starks, co-founded Starkware. I'm CEO of that today.

1:24我是 Alex，Project Eleven 的執行長。我們在做後量子金鑰管理和數位資產簽章基礎設施。等下會聊到，量子運算對密碼學整體會有很大影響，尤其是數位資產的底層密碼假設。我們就是在協議之上的基礎設施層，專注於這些升級。很高興來到這裡。Yeah, and I'm Alex. I'm the CEO of Project Eleven. So Project Eleven builds post-quantum key management and signing infrastructure for digital assets, right? So we're going to talk about this, but obviously quantum computing is going to have implications for cryptography as a whole, but for digital assets in particular around the underlying cryptographic assumptions, and we're the infrastructure layer on top of the protocols that are obviously thinking about these upgrades. Pleasure to be here.

1:53我是 Ren，Electric Capital 的普通合夥人。想先幫大家定一下討論的基調，但我覺得我們可以直接切入主題，因為現在產業和全世界都認為量子運算真的快來了。大家都覺得這件事很近，可能是中期就會發生。Cool. And I'm Ren, engineer general partner from Electric Capital. I wanted to frame the conversation up a bit, but maybe we should just jump straight into it because I think the industry and the world has reached the point where quantum is certainly coming. There's a question of when, but I think most people have this belief now that it is quite soon, like medium term.

2:20量子電腦會破壞什麼？

2:20既然量子威脅就在眼前，我們先來聊聊量子到底會破壞什麼？大家常聽到量子風險，但更深入一層，區塊鏈哪些部分會被破壞？哪些是敏感的？現在所有區塊鏈都用某種密碼學。密碼學一開始是做加密，但大多數區塊鏈其實沒用加密，而是用簽章。簽章就是證明你知道一個秘密，擁有這個秘密的人可以對訊息簽名。幾乎所有區塊鏈都用橢圓曲線來做這件事。橢圓曲線很棒，用傳統電腦基本上打不破，要天文數字的運算力。但如果有量子電腦，就可以很有效率地破解橢圓曲線。So. With this looming threat ahead of us, maybe we can start off by diving into what exactly would quantum break? Because I think a lot of people have heard a lot about the quantum risk, but diving a bit one layer deeper, like what aspects of the blockchain might break? What's sensitive? All blockchains today use some form of cryptography. Cryptography started out with encryption primarily. Most blockchains do not use encryption. What they use instead is signatures. You need to attest that you know a secret, and I am, you know, the person who knows the secret or controls the secret attests to this message. That's what signatures do. And by and large, almost all blockchains use elliptic curve to do this. And elliptic curves are great. They're fantastic to work with. They let you do all sorts of things. And using classical computers, we cannot break their cryptography. It would take an astronomical amount of power. We don't know how to do it. However, with quantum computers, we can do that very efficiently.

3:23現在我們還沒有量子電腦，但如果有的話，橢圓曲線就會被破解。更廣泛來說，任何有強大代數結構（像交換群）的密碼學，通常都會被量子電腦破解，雖然不是絕對，但大多數都會被破。這代表很多密碼學都會被打破，但不是全部。有些密碼學量子電腦只有一點點優勢，沒有指數級的優勢。Now, we don't have quantum computers, but if we did have a quantum computer, you can break elliptic curve. The broader picture is like anytime you have something that has this very strong algebraic group structure, like commutative groups, that tends to be broken. It's not a hard rule, but that tends to be broken by quantum computers. So they break a whole lot of cryptography, but not all of it. So thankfully, lots of cryptography is not susceptible to quantum computers. The quantum computers have a small advantage over a classical computer for it, but not a big or exponential advantage.

3:57我想用比較哲學的角度來看這個問題。區塊鏈會怎麼壞掉？其實要看是哪一條鏈。區塊鏈有很多種，有 Bitcoin 這種原始型態，也有用零知識證明的鏈，還有支援智慧合約的鏈，每種鏈的威脅模型都不太一樣。但共通點就是大家都用橢圓曲線簽章來證明擁有權。在後量子時代，如果沒做防範，擁有權這個概念就會消失。因為如果我有量子電腦，看到 Bitcoin 上的公開金鑰，Satoshi 的幣就是我的幣，任何公開金鑰都能被我證明擁有。所以在那個世界，擁有權就沒有意義了，這是很深層的問題，會引發一連串的挑戰。Maybe the way I would—I'll take, I think that's right—I'll take maybe a philosophical frame is like, you know, think about blockchains. So how do blockchains break, I think, your prompt? And I would say it depends on the blockchain. Blockchains come in all shapes and sizes, right? We have Bitcoin, the original. You know, there are blockchains that are defined by zero-knowledge proofs, and there are blockchains that have smart contracts, and all these have slightly different threat models, but I think the thing I would just, the way I would frame it is, you know, we kind of distinguish between blockchains based on technical features and decentralization, kind of, and that can be defined in any number of ways. But I think the universal aspect here, exactly what Arthur said, is that we all use elliptic curve cryptography for signing. And what is signing used for? It's effectively to prove ownership, right? So the concept of ownership. In a post-quantum world, assuming it's not mitigated, kind of ceases to mean anything. Because, like, if I have a quantum computer and I'm looking at Bitcoin, say, you know, Satoshi's coins are my coins, and anyone with an exposed public key I can prove ownership of. And so what does it mean to own something in that world? And this is why I think this is a very deep problem, and it has a number of things that fall from it.

5:10後量子密碼學的解方與挑戰

5:10既然我們知道哪些東西會壞掉，像是擁有權這個大問題，那能不能修好？你們三位現在都在做什麼？產業內外有哪些不同的解法？我可以先說，這絕對是可以解決的。其實大家早就知道量子電腦的威脅，從 80 年代就有理論，90 年代就有實用的破解演算法。密碼學家已經思考這個問題快 30 年了，所以這不是新問題。解方就是後量子密碼學，也就是後量子簽章，理論上可以直接取代橢圓曲線簽章，這樣就沒事了。So now that we have a rough sense of what might break, this question of losing ownership, big issue, can it be fixed? What are the three of you working on? What are the different approaches that different teams in the industry and outside of the industry are taking. Yeah, I mean, I can maybe quickly start. Can it be fixed? Absolutely, it can be fixed. In fact, the world has known—it's not like quantum computers have been, like, you know, theorized since the '80s. Practical algorithms for breaking cryptography have been known since the '90s. Cryptographers have been thinking about this for the better part of three decades, and so this is not a new thing for the field of cryptography. So there's a solution in the form of post-quantum. Cryptography, so post-quantum signatures that you could, in theory, drop in everywhere there's elliptic curve signatures, and then everything would be fine.

6:02但問題是，直接換成新密碼學不是一比一的替換。像橢圓曲線簽章很有效率、很小，Bitcoin 一直在算區塊能塞多少簽章。如果換成像 lattice（格基）這種後量子簽章，可能會大十倍，等於吞吐量變十分之一，或要把區塊變大十倍。這些都是導入後量子密碼學會帶來的挑戰。The issue is that the implications of dropping in this new cryptography, you know, kind of, it's not exactly a one-for-one replacement. For example, elliptic curve signatures are very, very efficient. They're very small in size, for example, right? And Bitcoin. If I can be transaction throughput, you know, people think about, okay, how many elliptic curve signatures can I fit into a block? Well, now if my potentially post-quantum signature scheme, like lattice, is maybe 10 times as big, let's say, as an elliptic curve scheme, so that's now your throughput is 10 times smaller, all things being equal, right? So you have to either increase the block size by 10. Or accept 10x lower throughput potentially, right? And so it's these implic- it's the implications of introducing post-quantum cryptography that I think the challenges start to show up.

6:51現在最大問題是，很多主流專案並沒有認真看待這件事。尤其是 Bitcoin，大家有種鴕鳥心態，覺得 Bitcoin 完美無缺，量子電腦不可能威脅它。但你看 Y2K（千禧蟲）事件，當時產業投入了上千億美元和無數工程師年數，才沒出事。現在最重要的就是要正視這個問題，承認『我們有大麻煩』，這樣才有辦法推動改變。The one thing you need to do about it, and unfortunately not a lot of the big projects are doing that, is take it very seriously and understand that it's a big problem. So, and to me the biggest problem is that Bitcoin isn't approaching it in this manner. There's a sort of sticking the head in the sand kind of mentality, you know, Bitcoin is perfect. So, you know, and in particular because it's perfect. A quantum computer is never going to threaten it. But, you know, if you think about something like the Year 2000 bug, the reason it didn't cause any harm in the end was because the whole industry, right, put billions of dollars and thousands of, maybe hundreds of thousands of engineer years into addressing the problem. So the number one thing. That needs to be done is to say, holy shit, you know, Houston, we have a problem. Once that is said, it's easier to move on.

7:56其實我比較不擔心量子電腦什麼時候會來，因為如果真的有突破，應該會是大公司或國家慢慢釋出消息，大家還有時間準備。我更擔心的是 AI 在數學上的超能力，搞不好會找到傳統電腦就能破解的演算法。如果這種事情發生，任何人五分鐘就能在筆電上跑，這才是真正的未知威脅，影響的不只是區塊鏈，而是整個數位經濟。甚至連備援機制也有風險，因為它們也建立在很乾淨的數學結構上。There's, you know, the known unknown, which is, will a quantum computer break cryptography soon? I'm less worried about that because I think the nature of that kind of thing will be, you know, will come slowly, relatively slowly, from a respected, you know, company or nation state, and there'll be time to prepare. What really freaks me out is that with, like, the super intelligence in math of just of AI. I'm really worried that there will be classical algorithms. Classical means they run on your smartphone that could break these things. And if that happens, so you know, this morning OpenAI released 400 new papers and results, each one of them just staggering. You know, as I said, I used to be a mathematician. Like, my heart goes out to all of my colleagues who are, like, saying, Okay, what do we do tomorrow, right? There's no more room for mathematical innovation just by yourself. So, but the issue is that we cannot rule out in a week or in a year. A classical algorithm coming. Now, a classical algorithm is something that anyone can implement, you know, in five minutes on their laptop. And this to me is the bigger threat because this is the unknown unknown. And I'll say this: it affects much more than just blockchain. It affects the whole digital economy. And I'm even worried about the fallback mechanisms, which are also based on very clean, structured math.

9:46所以一旦你意識到這是大問題，就要開始做避險和準備。最安全的避險方式就是用 hash-based（雜湊型）密碼學。我 2018 年共同發明的 ZK-STARKs 和相關簽章，就是只用 hash。現在最需要做的，就是大家盡快轉向 hash-based 密碼學，否則我晚上會睡不安穩。So, I mean, once you recognize there's a big problem, you have to start hedging and preparing. The safest kind of hedging is based on what's called hash-based cryptography. And, you know, I didn't have premonition, but ZK-STARKs and the signature schemes based on them, which I co-invented in 2018, they're based only on hashes. So what is needed is to say there's a huge problem and converge as quickly as possible to the safest ground, which is hash-based cryptography. Anything short of that, I wouldn't sleep well at night.

10:20我同意剛剛講的，但再補充一點。技術上是可以解決的，確實有現成的密碼學原語，只是成本比較高。從橢圓曲線換到 lattice（格基）會更貴，而且 lattice 也有 Eli 剛剛擔心的數學結構。如果要用 hash-based 簽章，安全性會更高，但成本也更高，簽章更大。除了技術問題，還有社會層面的問題。區塊鏈其實可以很快升級，尤其遇到緊急狀況時，像 Bitcoin 這種鏈，真的有事時，升級一天就能搞定，程式碼一天就能寫好。但社會問題是，還有很多使用者的資產會有風險，需要每個使用者都花時間遷移，尤其是那些公開金鑰已經曝光的地址。這些人可能很久沒動過資產，也不會每個月關心量子電腦新聞，所以你要給大家足夠的時間遷移。現在就該開始準備，不能等到最後一刻。So I agree with much of what has been said. I will add one thing. So they are—there's a, you know, can it be solved from a technological standpoint? Absolutely. There are primitives that exist. And, you know, to your point, the problem is, like, they are more costly. And in fact, if you move, you know, from elliptic curve to lattices, it's more costly. But lattices also have this type of algebraic structure that Ellie's worried about. So if you want to move to hash-based signatures, then I think you're very safe indeed. But then the cost is even higher, right? They're even bigger. So there's a cost aspect. But there's also a social aspect, and I believe that blockchains can be updated. Fairly quickly, especially in an emergency, you know, I don't think that we're going to wake up tomorrow and there's a quantum computer attacking Bitcoin and the chain hasn't upgraded. I think that can be done in a day, right? And the code for doing it can be written in a day. But there's a social problem. If you did this tomorrow, you would still have tons of users who have funds at risk. You need every single user who has their fund at risk, who has addresses that are based on elliptic curve, especially if the public key, if they reuse the address, the public key is visible. And all of these need time to migrate because some of them, you know, they bought some Bitcoin or they bought some cryptocurrency and they're sitting on it, and they don't want to monitor it every month. They're not reading the news about quantum computers, and you want to have as long of a window. So the reason blockchains should wait now is not because necessarily like, oh, we know for sure it's coming, you know, next month. I think it's going to be at least a couple of years. But you don't want to wait till the last minute. You want to give your users years to migrate, and that's why I think it's important to move quickly.

12:09後量子簽章：格基 vs 雜湊型

12:09剛剛提到兩種主流後量子簽章：hash-based（雜湊型）和 lattice-based（格基型）。這兩種未來五年會被大家討論很多，也會有很多爭論。能不能幫大家解釋一下這兩種簽章的權衡和現況？You brought up throughout that conversation two interesting... So two different approaches in terms of post-quantum signatures, hash-based signatures, lattice-based signatures. Maybe for the audience, because these will be terms that you will likely hear for the next five years, and there will be great debate about these two topics. Maybe for the audience, can you explain the trade-off between these two types and families of signatures and where they currently sit.

12:40舉個 lattice（格基）的例子，你看螢幕後面那些規律的點，就是二維格基，每個點距離都一樣。你可以想像三維、甚至一百維的格基。格基有很多結構性，很有規律。格基被用來當作後量子密碼學的數學難題，假設在高維空間裡找兩個很近的點很難。這種結構讓簽章很短、計算很快，大家很愛用，但也因此比較危險。hash（雜湊）就沒那麼漂亮，基本上就是把一堆 bits 攪在一起，沒有明顯結構，比較亂，簽章也比較長，但也因此更能抵抗超級智慧的攻擊。Let me give you an example of a lattice. If you look behind, you see these regular dots. They form a two-dimensional lattice, so sort of points that are at the same distance from one another. That's a lattice structure. Now this is a two-dimensional lattice. You can imagine a three-dimensional lattice. Maybe some of you can imagine a hundred-dimensional lattice. I cannot, but that's what a lattice is. Now, as you can see, it has a lot of structure, right? It's very repetitive. So lattices are used as a sort of math problem to form post-quantum cryptography, and there is an assumption of hardness. The assumption of hardness is that it is very hard to find a point in the lattice that is very close to another point. Okay, now it's very easy in two dimensions, but you'll have to trust me that it's very hard in a hundred dimensions to do this. However, it has a lot of structure, and that makes for short signatures for things that are fast to compute, and that's why everyone loves them. But that's also why they're a little bit more scary. Hashes are—they don't look nice like this. They are basically, a hash function is something that says, take a bunch of bits, you know, garble them around, throw them at each other, do that again without any sort of reasonable structure. And they're messier. They lead to longer signatures. But because of that, they're going to be more resilient to things like superintelligence. That's, like, the kind of mental image you should have.

14:33補充一下，這不是 AI 越強 lattice 就越危險，而是數學上我們不知道有沒有效率的破解演算法。hash function 基本上很難被破解，如果真有那種演算法，這世界會變得很奇怪。但 lattice 就不確定，可能有 10% 或 20% 的機率被破解。最近 NIST 選的 Hawk（格基型簽章）就被 AI 找到攻擊方法。還有 McEliece 系統，這是很老的系統，經過幾十年分析才被人類破解。現在如果你想發表數學論文，真的要趕快，因為 AI 也會搶著做這些事。I think I'd like to add that it's not necessarily—it's not a graduation. It's not like, oh, the more intelligent AI gets, you know, the more lattices is going to be broken. Mathematically, it is a mathematical fact. Whither or not they are efficient algorithms for lattices, and we just don't know. Now, it's very unlikely that efficient algorithms exist for hash functions, because if they were, we would live in a very strange world. However, for lattices, we generally don't know, and so, you know, you want to give it like a 10% chance, 20% chance. In fact, recently. One of the lattice-based signature algorithms that was proposed and that was selected by the NIST, Hawk, artificial intelligence found attacks on this problem. There's another system, the McEliece system, which is a very old system which has resisted decades and decades of cryptographic analysis, was also broken. By artificial intelligence, they. So, no, that was actually humans, I think. It was humans. Yeah, yeah. One of the last human— I have jury disparage, one of the last human discovery. I mean, I know the authors, and they told me that it's not AI, so I trust them. Don't give up on mathematics yet. You have to, if you want to write a math paper, you have to get it out now. Yeah, it's the last call.

15:53我再補充一點，很多人只從密碼學角度想這些問題，但實務上像 Project Eleven 就要考慮現有的託管基礎設施。有些人用硬體安全模組（HSM），就是把密碼學寫在晶片上。如果要換成後量子簽章，首先要找到支援新演算法的硬體，這些硬體目前選擇很少，而且新演算法還沒經過長時間考驗。AI 在數學上的突破不只會影響傳統密碼學，也會影響後量子密碼學。hash function 經得起考驗，但其他新演算法就不一定。像 Hawk 幾年內就被破解，這很可怕。基礎設施上，萬一某個演算法突然被破解，要怎麼換到新的？這會有很多連鎖效應。現在產業內還沒有共識標準，大家都覺得 hash-based 很保守但成本太高，所以各種方案百花齊放，還沒收斂成標準，這對基礎設施和託管來說是大問題。The only thing, I guess, to agree with everything that was said, the trade-off that I would add that I focus on is, you know, I think a lot of people think about the cryptography and, okay, kind of like in the abstract, what does this mean for block size, et cetera. I would say from the practical standpoint, which is where Project Eleven sits, it's like, okay, we have custody infrastructure that is built today in a certain way. Some people use hardware security modules. By the way, what does that mean? It's a chip that actually has, like, all the cryptography kind of layered onto the chip, and so that's the security assumption, is, like, the hardware has the cryptography. When you're going away from elliptic curves, you have to, first off, you need to find hardware that supports your given post-quantum scheme. And there are some hardware, you know, there's beginning to be some trusted hardware that's getting deployed, but it's, you know, typically very limited in the range of algorithms that it can support. And these are kind of—Untested algorithms. The thing I would add to what Ellie said, which is really important, is, you know, AI is obviously, you know, making great strides in mathematics and these breakthroughs. And I think it's definitely worth worrying about that from classical cryptography, but I think it's also worth worrying about from post-quantum cryptography. In post-quantum cryptography, so hash functions have stood the test of time for sure, but other new algorithms. Have not, and I think this is why you see exactly what Arthur said with Hawk. You know, Hawk had been around for a few years, but it got broken kind of overnight, effectively. And this is kind of the scary thing, is that you might have a situation from an infrastructure standpoint where suddenly an algorithm is now broken, and then how do you move from what is broken to something new? Because there's a lot of dependencies here, right? Because blockchains need to support the signature scheme that you want to move to. Also, the hardware or the MPC technique that you're using to aggregate or somehow thresholdize or basically enforce the policies of your customers has to also be, you know, fit with that, right? So there's just a lot of second and third order effects. That folks aren't considering. And I'll say from my perspective, where we talk to a lot of different chains in space, like we work with the EF, we've advised the Bitcoin Security Consortium, done grant work with Solana, Ripple, others. You know, unfortunately, no one is really coalescing around a standard. I think a lot of people like the conservative nature of the hash-based signatures, but they often find they are impractical from the cost perspective. So they try and invent optimizations, which unfortunately It turns into there's a lot of different schemes out there, and maybe at some point they'll reconverge into a single standard. But right now, the field of post-quantum cryptography is very balkanized, and I think that has big implications for infrastructure and custody.

18:21後量子時代的區塊鏈體驗與基礎設施

18:21我們在 TOKEN2049，現場很多人關心市場影響，或五到十年後的區塊鏈會長什麼樣。如果產業最後真的選擇 hash-based 簽章，對基礎設施有什麼影響？使用者體驗會怎麼變？硬體、驗證者、網路層需要改什麼？Let's talk about that. So we're at Token 2049. A lot of the people in the audience probably care about potential market implications or, like, what, what, what, what. Do blockchains look like in five, ten years? Like, let's say hypothetically, the industry settles on hash-based signatures. Let's just say hypothetically that happens. If we go down, like, the most, the largest pieces of infrastructure within the industry, what are the implications of that? What does the day-to-day, like, user experience look like? What needs to change at, like, the hardware level or the validator level or even the network level in that future?

19:03我先講，轉換到新密碼學方案，短期內 UX 一定會變差，錢包種類也會變少，因為這些密碼學更複雜。像有些 hash-based 簽章需要記錄狀態，除了要保管秘密，還要記錄計數器，不能重複簽名，這對錢包來說是全新挑戰，也可能導致使用者資產損失。以前只要套用橢圓曲線函式庫，現在變得更複雜。結果就是錢包會先大幅整併，去中心化的成本也會變高。橢圓曲線簽章小，交易也小；lattice 和 hash-based 簽章都比較大，區塊和狀態都會變大，網路架構也要調整，可能會有更多改善或集中化的設計。像 Ripple 這種驗證者比較少的鏈，反而比較好升級，不像 Bitcoin 技術和哲學門檻都很高。要維持去中心化，現在就要開始規劃，不能掉以輕心。Maybe I'll start with this one and go back that way. I think an unavoidable consequence of the transition to these new cryptographic schemes is the UX is going to potentially degrade in the short term. And I think it will make it much more expensive, I think, to have the variety of wallets that we have today. I think, so practically speaking, this cryptography is going to be much more complex. To take an example, some of the hash-based schemes that are being considered for Bitcoin, say, involve a stateful element, which means in addition to kind of keeping this secret, you also need to kind of keep a counter and make sure you don't sign twice. That, you know, using the same, you know, you don't sign at the same level of the counter, right? And so this is kind of, it's like, it's a completely new paradigm for wallets to have to manage that has implications that include users' loss of funds, right? And so this problem that was kind of commoditized and easy, just implement this, you know, elliptic curve library, is now kind of gotten a little bit more—it's gotten more complicated. And so I think. That's going to see, you're going to see a consolidation, I think, first of all, of wallets. I think also it's going to make the cost thing is going to drive, it's going to make the cost of decentralization higher, right? And so I think for different ecosystems, obviously everyone is at a different point on how much value there is on decentralization versus not decentralization. But I think it's just the simple fact is. Elliptic curve signatures are small, therefore transactions based on them are small. Lattice-based and hash-based signatures, on average, are bigger, and therefore blocks are bigger, and therefore maintaining that state is bigger and harder, and the network needs to look different. And that just means there needs to be probably architecture, or like an approach would be to make architecture more efficient by optimizing slash centralizing it. So I think you're kind of going to see, ironically, some of these blockchains. I'll pick an example like Ripple. You know, the validator set there is kind of smaller. People, I think, sometimes criticize Ripple. It's like, oh, this is like a permissioned kind of multisig. But in a sense, they're kind of well positioned here because they already have this semi-permissioned... system that they can upgrade and not pay as much of a cost as, say, Bitcoin, I think, where again, not only because, like, the technical constraints are high, but also the philosophical belief in what is important in Bitcoin is very deep. I think that'll be a challenge. I think for any ecosystem to remain decentralized, I think the planning has to start now, because I think everyone here believes decentralization to some degree is important, but that can't be taken for granted, I think is what I would say.

21:33我比較樂觀。網路上有個迷因說：『想知道五年後的 Ethereum 長什麼樣，去看現在的 Starknet。』因為 Ethereum 正在往 zk-STARKs 方向走，這是後量子安全、基於 hash 的技術，能做簽章聚合、交易聚合，也能提升規模和隱私。這些東西在 Starknet 都已經上線，UX 很順暢，還有帳戶抽象，像用手機生物辨識簽名。對使用者來說，轉換過程可能分兩種情境：如果災難發生在大多數鏈還沒升級前，大家就會看到價格暴跌、資金逃往安全鏈。但我比較樂觀，覺得大家會適應，最後像 Y2K 一樣，什麼事都沒發生，只有開發者（現在還有 AI 幫忙）在背後努力。你會看到規模變大、zk-STARKs 和精簡 zkVMs 普及、隱私提升、交易聚合。單筆交易可能從 1KB 變成 10KB、20KB，但沒差，因為驗證者和 prover 會做大量聚合。這些在 Starknet 都已經運作多年，大家可以去體驗。I'm more optimistic. So there is a saying. I saw this as a meme on the internet. It says, If you want to know what Ethereum will look like in five years, check out what Starknet is today. And what stands behind it is, if you look at, you know, what... Where Ethereum is heading, so it's heading to use zk-STARKs, which are post-quantum secure and hash-based for, you know, signature aggregation and aggregation of transactions. It's looking at higher scale through that and privacy. All of these things exist today on Starknet, and I can tell you that in terms of UX for privacy and for transactions, it's a very smooth UX. They have account abstraction, which basically you know, you could use your whatever smartphone biometrics to sign transactions. So I think from the user's point of view, the transition will be, well, okay, there are two scenarios. If the catastrophe hits before enough blockchains do whatever is needed, then everyone will just see, you know, prices plummet and everyone rushing to wherever. Whichever safe haven there exists. But I'm an optimist. I think that, you know, folks will adapt. And then it will feel like the year 2000, you know, bug event, where nothing happens and nothing is noticed by end users. Along the way, you will see developers doing a lot of work. Well, now it's going to be AI helping us, but like. You will see basically a lot more scale. You will see adoption of zk-STARKs with lean zkVMs. You will see—Privacy outed this way, you will see aggregation of transactions. So a single transaction will be longer. Today it's whatever, let's say one kilobyte. So maybe a single transaction will be 10 kilobytes or 20 kilobytes. But that's not a big deal because you'll just have a lot of aggregation by, you know, validators and provers, and you will, again, I'm saying I'm very optimistic because all of this. This has been working for years on Starknet, and you can check it out.

23:37最後補充一下，因為我做過 Bitcoin 和 hash-based 簽章，常被主權基金、大型機構問建議。我們寫了一份 Quantum Hub，裡面有遷移路徑、各鏈評估，大家可以去 quantum.starkware.co 或 Google Quantum Starkware 找資源，歡迎來聊。The final thing I'll say on this is that we, so, you know, because of my work on Bitcoin and hash-based signatures and stuff like that, so I actually get asked a lot by, you know, sovereign wealth funds and large institutionals and so on to advise on these matters. So. To this end, we wrote a Quantum Hub that you can go and check out. It has migration paths, you know, evaluation of different networks. All you need to do is go to quantum.starkware.co or just Google Quantum Starkware. There's a whole bunch of resources there. Check it out. Talk to us. Happy to advise and, you know, share information.

24:15Bitcoin 的社群與升級困境

24:15我想再強調，Bitcoin 最大的問題其實是社群情感，不是技術。現在電腦運算力比 Bitcoin 剛上線時高十萬倍，USB 隨身碟容量也從 16GB 變成 1TB。如果 hash-based 簽章讓 Bitcoin 區塊變大十倍，其實沒什麼大不了，技術上完全沒問題，但很多人會覺得這樣破壞了 Bitcoin 的精神，這才是最大阻力。Yeah, so I would whistle out of that. I would say again on the wallet and the cost. So I think the biggest problem for Bitcoin is feelings more than technology. Because, you know, nowadays computers are about a hundred thousand times, you know, have a hundred thousand times more compute than they did when Bitcoin launched. When Bitcoin launched, you would buy a USB key with 16 gigabytes, and now you get, like, a USB drive of a terabyte. So, you know, if hash-based signatures in Bitcoin make it ten times bigger. It's fine to increase the block size by 10x. It is not going to break Bitcoin. The problem, of course, is, like, it's going to hurt a lot. It would hurt a lot of people's feeling, and therefore maybe it doesn't happen. But that's the big problem.

24:57補充一下，Bitcoin 社群對去中心化的看法很分歧，但最有爭議的是 Satoshi 的幣該怎麼辦？是要燒掉還是讓量子電腦拿走？我們之前在舊金山的 Bitcoin Presidio 活動現場問過，開發者和投資人幾乎一半一半，有人覺得應該放著，有人覺得要燒掉。這會是很有趣的社群辯論。Just to quickly interject on the Bitcoin one, I think there are people that feel differently about decentralization, but I think the one that divides the Bitcoin community the most is Satoshi's coins. What do you do with them? Do you burn them? Or do you let the quantum computers take them, basically? And this is a very divisive issue. We were at an event in San Francisco, Bitcoin Presidio, where they polled the audience, which consisted of a lot of Bitcoin core devs, investors, etc., and it was split basically 50-50 whether it was right that you, you know, you let it, you just kind of live and let live, or you burn the coins. And I think that's a debate that I think will be very interesting to see how it plays out.

25:30我自己的看法是，Satoshi 的幣要嘛燒掉，要嘛鎖住不能轉帳。如果 Satoshi 本人出現，他有很多方法證明身分。還有一些地址是大家認為屬於 Satoshi，但公開金鑰還沒曝光，可以把其他幣轉到這些安全地址。其實不用現在就決定要不要全面換 hash-based 簽章，可以讓使用者同時擁有多種金鑰：橢圓曲線、lattice、hash。等到真的有風險時，比如 lattice 被新研究攻破，再停用某種金鑰，資產也不會被卡住。這個問題現在就能解決。如果我現在能對 Bitcoin 揮魔法棒，我不會直接換 hash-based，而是讓使用者可以註冊 hash-based 金鑰，甚至強制每個 key 都要有，這樣大家就有充裕時間準備。Yeah, so for the strategic coin, here's where I land. I think essentially either you burn them or you block them. You know, you make them non-transferable, and then you say, look, if Satoshi comes, they have many, many ways of proving that they're Satoshi, and therefore they will be able to do this. Or you use some addresses which are strongly believed to be Satoshis, but which still have a hash that protects the public key is not known, and then you put the other coin under that. You don't have to choose today between being prepared for quantum and having more expensive signatures. What you can do is you can give users multiple keys. So you give your user an elliptic curve key, and you give your user a lattice key, and then you give them a hash key. And if and when it becomes very, very clear that the risk is too high, so for example, you've seen new research on lattices, I don't think you wake up tomorrow and it's completely broken. You'll have a little bit of a warning shot. Then you can deactivate one on a network and the funds don't get stranded. So that's the number one problem to solve, and it can be solved today. So today, if I were to do one thing on Bitcoin today, if I had a magic wand, it wouldn't be like implement hash-based signatures or anything like that. No, no, no. Just allow users to register a hash-based signature. That's it. Just this one thing, actually mandate it. Users do this for every single key. And then you have all the time in the world. You can prepare, you can do all of this, but give users a time to pick their key so that they can prove ownership later.

27:02我覺得帳戶抽象（account abstraction）會變成未來必備功能，因為你永遠不知道哪種密碼學方案最後會被破解，哪種才適合你的應用。這種彈性一定要有，我完全同意。Yeah, I think account abstraction, which you mentioned, I think is going to be just going to be a must-have feature in the future, where you kind of just don't know exactly what cryptographic schemes will ultimately not be, you know, not be broken, and then what will be the best for whatever use case. Completely agree. That flexibility, I think, is going to be a must-have. Great.

27:20總結：量子是威脅還是機會？

27:20最後一分鐘，請給個結論：量子運算真的是加密貨幣的生存威脅嗎？我想用樂觀的角度看，量子力學其實可以提供全新方式來保護價值和資訊，甚至成為新的密碼學基礎。像量子金鑰分發、量子亂數產生，雖然現在還不實用，但未來有了量子電腦，量子力學本身也許能成為我們保護資訊的新假設。這是物理假設，不只是數學假設，因為這就是世界的運作方式，這很有潛力。Maybe in the last minute here, final verdict: is quantum an existential threat to crypto? This is where I'm going to give my optimistic take. Quantum mechanics can actually provide, I think, a different way to secure value and secure information. It can be a different basis for cryptography. I mean, there's been—Some research around, you know, quantum key distribution, quantum random number generation. Today it's kind of toy-like; it's not very practical. But I think in the future, as we have working quantum computers, it's possible that quantum mechanics can become another assumption that we leverage to protect information. I think, to me, that might be what crypto looks like. It integrates this to make these systems more secure, because the nice thing about quantum mechanics—Is it's, you know, it's not just a math assumption, but a physics assumption. Like, to the best that we know, this is how the world works at a very, very small level. And so I think for that reason, it's potentially powerful.

28:12我也是樂觀派，覺得量子是生存機會。腦中一直浮現 Bob Dylan 的歌詞：『現在的贏家將來會變輸家，因為時代在變。』我百分之百相信，現在的贏家未來可能會落後，因為變化比 1960 年代還快。大家要多學習、多避險、多支持必要的改變。如果想要更多資源，可以到 quantum.starkware.co 找我們。I'll say that I'm an optimist, so I view quantum as an existential opportunity. But the one thing that keeps repeating in my head. With respect to quantum and with respect to AI is Bob Dylan's line, The winners now will later be last, for the times are a-changing, and I'm 100% convinced that the winners, some of the winners now will later be last because. The times are changing in a way that even Bob Dylan didn't foresee when he wrote this in the 60s. So educate yourself, learn, hedge, support the things, you know, the changes that are needed. As I said, if you want more resources, you can find them on quantum.starkware.co and reach out.

29:04量子是不是加密貨幣的生存威脅？我覺得大多數人都能及時升級，現在軟體開發成本幾乎趨近於零。但 hardcore Bitcoin 支持者常常把 Bitcoin 和 crypto 分開談。對 crypto 整體來說，我不覺得是生存威脅；但對 Bitcoin，如果社群不積極反應，可能真的會有威脅。Yes, is it an existential threat to crypto? I think most people will be able to upgrade in time, and we also live in an age where software development is, you know, the cost of software development is almost free nowadays. But, you know, hardcore Bitcoiners like to draw a difference between Bitcoin and crypto. So is it an existential threat to crypto? I don't think so. To Bitcoin, it could be if there's not more of a reaction in the community. Great.

29:33謝謝大家今天的參與！Thank you so much for your time this afternoon. Thanks, man. Thanks.